008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf0}, 0x0)

14:55:15 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000463044000ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  389.717503] jfs: Unrecognized mount option "permit_directio" or missing value
[  389.786394] binder: 13276:13280 IncRefs 0 refcount change on invalid ref 65280 ret -22
[  389.949765] binder: 13276:13288 IncRefs 0 refcount change on invalid ref 65280 ret -22
[  389.958270] binder: BINDER_SET_CONTEXT_MGR already set
[  389.979904] binder: 13276:13280 ioctl 40046207 0 returned -16
14:55:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x300}, 0x0)

14:55:16 executing program 3:
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:16 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:16 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:55:16 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000163404000ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  390.321836] jfs: Unrecognized mount option "permit_directio" or missing value
[  390.444761] binder: 13351:13360 got reply transaction with no transaction stack
14:55:16 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xfffff000}, 0x0)

[  390.544403] binder: 13351:13360 transaction failed 29201/-71, size 0-0 line 2762
14:55:16 executing program 3:
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:16 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  390.620893] binder: 13351:13365 got reply transaction with no transaction stack
[  390.621397] binder: BINDER_SET_CONTEXT_MGR already set
[  390.648509] binder: 13351:13365 transaction failed 29201/-71, size 0-0 line 2762
14:55:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x3000000}, 0x0)

[  390.737980] binder: undelivered TRANSACTION_ERROR: 29201
[  390.743988] binder: 13351:13360 ioctl 40046207 0 returned -16
[  390.772986] jfs: Unrecognized mount option "permit_directio" or missing value
[  390.818279] binder: undelivered TRANSACTION_ERROR: 29201
14:55:16 executing program 3:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:17 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000263044000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:17 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x9effffff}, 0x0)

[  391.122185] binder: BC_ACQUIRE_RESULT not supported
[  391.134504] jfs: Unrecognized mount option "permit_directio" or missing value
[  391.150056] binder: 13396:13397 ioctl c0306201 20000000 returned -22
14:55:17 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  391.236617] binder: BINDER_SET_CONTEXT_MGR already set
[  391.245582] binder: 13396:13397 ioctl 40046207 0 returned -16
[  391.256114] binder: BC_ACQUIRE_RESULT not supported
14:55:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xb6010000}, 0x0)

14:55:17 executing program 3:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  391.302660] binder: 13396:13402 ioctl c0306201 20000000 returned -22
[  391.515212] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:17 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x34000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:17 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000001163484000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xffffff7f}, 0x0)

[  391.739850] binder: 13420:13424 got transaction to invalid handle
14:55:17 executing program 3:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  391.817158] binder: 13420:13424 transaction failed 29201/-22, size 0-0 line 2855
14:55:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x30000}, 0x0)

[  391.963343] binder: 13420:13431 got transaction to invalid handle
[  391.969880] binder: BINDER_SET_CONTEXT_MGR already set
14:55:18 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000863104000ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  392.003899] binder: 13420:13431 transaction failed 29201/-22, size 0-0 line 2855
[  392.011783] binder: 13420:13424 ioctl 40046207 0 returned -16
[  392.034623] jfs: Unrecognized mount option "permit_directio" or missing value
[  392.062129] binder: undelivered TRANSACTION_ERROR: 29201
[  392.109839] binder: undelivered TRANSACTION_ERROR: 29201
[  392.143063] binder: 13440:13441 BC_INCREFS_DONE u000000000000ff00 no match
14:55:18 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x1ea}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:18 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x400300}, 0x0)

14:55:18 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x3}, 0x0)

14:55:18 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x26}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  392.271462] binder: 13440:13444 BC_INCREFS_DONE u000000000000ff00 no match
[  392.278632] binder: BINDER_SET_CONTEXT_MGR already set
[  392.299664] binder: 13440:13441 ioctl 40046207 0 returned -16
[  392.308375] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:18 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:18 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e63514000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xffffffffa0008000}, 0x0)

[  392.531919] binder: 13463:13465 unknown command 1079075598
[  392.567090] jfs: Unrecognized mount option "permit_directio" or missing value
[  392.579440] binder: 13463:13465 ioctl c0306201 20000000 returned -22
[  392.645720] binder: BINDER_SET_CONTEXT_MGR already set
14:55:18 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  392.710538] binder: 13463:13473 unknown command 1079075598
[  392.716910] binder: 13463:13465 ioctl 40046207 0 returned -16
[  392.744669] binder: 13463:13473 ioctl c0306201 20000000 returned -22
14:55:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xfffffffffffff000}, 0x0)

[  393.025729] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:19 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c5100ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:19 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xa00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xffffff7f00000000}, 0x0)

14:55:19 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  393.317423] binder: 13486:13487 unknown command 1359766286
[  393.380665] binder: 13486:13487 ioctl c0306201 20000000 returned -22
[  393.444693] binder: BINDER_SET_CONTEXT_MGR already set
14:55:19 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:19 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:55:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x2000000}, 0x0)

[  393.475999] binder: 13486:13498 unknown command 1359766286
[  393.486514] binder: 13486:13487 ioctl 40046207 0 returned -16
[  393.514704] binder: 13486:13498 ioctl c0306201 20000000 returned -22
[  393.596967] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:19 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c407aff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:19 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:55:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xb601}, 0x0)

[  393.838947] binder: 13511:13513 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65402
[  393.870509] binder: BINDER_SET_CONTEXT_MGR already set
[  393.878421] binder: 13511:13513 ioctl 40046207 0 returned -16
[  393.884992] binder: 13511:13515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65402
14:55:19 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:19 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c406cff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf00}, 0x0)

[  394.145517] binder: 13526:13528 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65388
14:55:20 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xb00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:20 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  394.277467] binder: BINDER_SET_CONTEXT_MGR already set
14:55:20 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4060ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  394.351782] binder: 13526:13528 ioctl 40046207 0 returned -16
[  394.370137] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:20 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x200000000000000}, 0x0)

14:55:20 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  394.555050] binder: 13547:13549 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65376
[  394.592336] binder: BINDER_SET_CONTEXT_MGR already set
14:55:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x100000000000000}, 0x0)

[  394.605080] binder: 13547:13553 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65376
[  394.612892] binder: 13547:13549 ioctl 40046207 0 returned -16
14:55:20 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xa00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  394.702799] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:20 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4048ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x3000000000000}, 0x0)

14:55:20 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  394.913282] binder: 13566:13569 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65352
14:55:20 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f00000008c0), 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  395.023430] binder: BINDER_SET_CONTEXT_MGR already set
[  395.060868] binder: 13566:13573 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65352
[  395.070212] binder: 13566:13569 ioctl 40046207 0 returned -16
[  395.388643] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:21 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x9effffff00000000}, 0x0)

14:55:21 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c40ffe0"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:21 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:21 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f00000008c0), 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  395.574195] binder: 13591:13594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 57599
14:55:21 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  395.619479] binder: BINDER_SET_CONTEXT_MGR already set
[  395.628797] binder: 13591:13594 ioctl 40046207 0 returned -16
[  395.635377] binder: 13591:13597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 57599
14:55:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x1b6}, 0x0)

14:55:21 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  395.680637] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:21 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c406300"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:21 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f00000008c0), 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:21 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xfffffff0}, 0x0)

14:55:21 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xb}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:21 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  395.939772] binder: 13618:13622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 99
[  395.953439] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x34000}, 0x0)

[  396.017201] jfs: Unrecognized mount option "permit_directio" or missing value
[  396.043802] binder: BINDER_SET_CONTEXT_MGR already set
[  396.049509] binder: 13618:13622 ioctl 40046207 0 returned -16
14:55:22 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x0, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x40030000000000}, 0x0)

14:55:22 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:22 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4004ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  396.301574] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:22 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x0, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  396.512730] binder: BINDER_SET_CONTEXT_MGR already set
[  396.535859] binder: 13648:13650 ioctl 40046207 0 returned -16
14:55:22 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4002ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x8000a0ffffffff}, 0x0)

[  396.647374] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:22 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x100000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:22 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  396.705030] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:22 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x0, &(0x7f0000000940)={[{@quota='quota'}, {@grpquota='grpquota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:22 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  396.853736] binder: BINDER_SET_CONTEXT_MGR already set
[  396.904031] binder: 13662:13668 ioctl 40046207 0 returned -16
14:55:22 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xa0008000}, 0x0)

14:55:23 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  397.062856] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:23 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:23 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4003ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  397.281904] binder: BINDER_SET_CONTEXT_MGR already set
14:55:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x1000000}, 0x0)

[  397.307522] binder: 13691:13694 ioctl 40046207 0 returned -16
14:55:23 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c404cff"], 0x0, 0x0, &(0x7f00000001c0)})

[  397.433045] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:23 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:23 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2a00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf0ffff}, 0x0)

[  397.655364] binder: BINDER_SET_CONTEXT_MGR already set
14:55:23 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  397.714489] binder: 13705:13710 ioctl 40046207 0 returned -16
14:55:23 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4068ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:23 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf000000}, 0x0)

[  397.972821] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:24 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  398.046864] binder: BINDER_SET_CONTEXT_MGR already set
[  398.052462] binder: 13729:13732 ioctl 40046207 0 returned -16
14:55:24 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x80ffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:24 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4074ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  398.120613] jfs: Unrecognized mount option "permit_directio" or missing value
[  398.180925] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x8000a0}, 0x0)

14:55:24 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  398.341597] binder: BINDER_SET_CONTEXT_MGR already set
[  398.408186] binder: 13746:13748 ioctl 40046207 0 returned -16
14:55:24 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:24 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  398.455819] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:24 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4005ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:24 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

14:55:24 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x54}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf}, 0x0)

[  398.560691] jfs: Unrecognized mount option "permit_directio" or missing value
[  398.658482] binder: BINDER_SET_CONTEXT_MGR already set
14:55:24 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}, {@subj_type={'subj_type', 0x3d, 'system.posix_acl_access\x00'}}]})

[  398.705821] binder: 13766:13774 ioctl 40046207 0 returned -16
14:55:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf0ffffffffffff}, 0x0)

14:55:24 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4007ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  399.256360] binder_thread_write: 15 callbacks suppressed
[  399.256375] binder: 13787:13789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65287
[  399.281046] jfs: Unrecognized mount option "permit_directio" or missing value
14:55:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x300000000000000}, 0x0)

14:55:25 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  399.493872] binder: BINDER_SET_CONTEXT_MGR already set
[  399.499473] binder: 13787:13789 ioctl 40046207 0 returned -16
[  399.506275] binder: 13787:13794 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65287
14:55:25 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c400a00"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:25 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:25 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}, {@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}]})

14:55:25 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x23}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0xf00000000000000}, 0x0)

[  399.688572] binder: 13805:13808 BC_REQUEST_DEATH_NOTIFICATION invalid ref 10
[  399.770799] binder: BINDER_SET_CONTEXT_MGR already set
[  399.803175] jfs: Unrecognized mount option "permit_directio" or missing value
[  399.817516] binder: 13805:13808 ioctl 40046207 0 returned -16
[  399.817714] binder: 13805:13815 BC_REQUEST_DEATH_NOTIFICATION invalid ref 10
14:55:26 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4006ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x3}, 0x0)

14:55:26 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}]})

14:55:26 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffffff8d}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  400.283863] binder: 13828:13829 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65286
14:55:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x3000000}, 0x0)

[  400.350758] binder: BINDER_SET_CONTEXT_MGR already set
[  400.351117] jfs: Unrecognized mount option "permit_directio" or missing value
[  400.368292] binder: 13828:13829 ioctl 40046207 0 returned -16
[  400.393904] binder: 13828:13837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65286
14:55:26 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}]})

14:55:26 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x80ffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:26 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c400000"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:26 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x2}, 0x0)

[  400.640814] binder: BINDER_SET_CONTEXT_MGR already set
[  400.680761] jfs: Unrecognized mount option "permit_directio" or missing value
[  400.714852] binder: 13848:13850 ioctl 40046207 0 returned -16
14:55:26 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@permit_directio='permit_directio'}]})

14:55:26 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c400000"], 0x0, 0x0, &(0x7f00000001c0)})

14:55:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0)

[  401.115060] jfs: Unrecognized mount option "permit_directio" or missing value
[  401.165050] binder: BINDER_SET_CONTEXT_MGR already set
[  401.217978] binder: 13865:13869 ioctl 40046207 0 returned -16
14:55:27 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}]})

14:55:27 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x8000a0ffffffff}, 0x0)

14:55:27 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x74, 0x0, &(0x7f00000001c0)})

14:55:27 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  401.429999] binder: 13879:13880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:27 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x3000000000000}, 0x0)

[  401.632481] jfs: Unrecognized mount option "smackfshat=/dev/usbmon#" or missing value
14:55:27 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}]})

14:55:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x9effffff00000000}, 0x0)

[  402.098461] jfs: Unrecognized mount option "smackfshat=/dev/usbmon#" or missing value
14:55:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xfffffffffffff000}, 0x0)

14:55:28 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$jfs(&(0x7f00000001c0)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000700)}], 0x49, &(0x7f0000000940)={[{@quota='quota'}], [{@smackfshat={'smackfshat', 0x3d, '/dev/usbmon#\x00'}}]})

14:55:28 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  402.345821] binder: BINDER_SET_CONTEXT_MGR already set
14:55:28 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xea01000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  402.393505] binder: 13879:13909 ioctl 40046207 0 returned -16
[  402.430792] jfs: Unrecognized mount option "smackfshat=/dev/usbmon#" or missing value
14:55:28 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xffffffffa0008000}, 0x0)

14:55:28 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x2000000, 0x0, &(0x7f00000001c0)})

[  402.759263] binder: 13936:13939 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:28 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x9effffff}, 0x0)

14:55:28 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x3800}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:28 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xb6010000}, 0x0)

14:55:29 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x2000000}, 0x0)

[  403.542459] binder: BINDER_SET_CONTEXT_MGR already set
14:55:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf00}, 0x0)

[  403.593462] binder: 13936:13960 ioctl 40046207 0 returned -16
[  403.593705] binder: 13936:13961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:29 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6000000, 0x0, &(0x7f00000001c0)})

14:55:29 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  403.762247] binder: 13964:13967 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:29 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x80ffffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:29 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x34000}, 0x0)

14:55:29 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xea01000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf00000000000000}, 0x0)

14:55:30 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x400300}, 0x0)

14:55:30 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf0ffff}, 0x0)

[  404.595273] binder: BINDER_SET_CONTEXT_MGR already set
[  404.600858] binder: 13964:13993 ioctl 40046207 0 returned -16
[  404.612461] binder: 13964:13996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:30 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x7000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:30 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:30 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7400, 0x0, &(0x7f00000001c0)})

14:55:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xb601}, 0x0)

14:55:30 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  404.918345] binder: 14009:14012 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:30 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:30 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf}, 0x0)

14:55:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x100000000000000}, 0x0)

14:55:31 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:31 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xb601000000000000}, 0x0)

14:55:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xfffff000}, 0x0)

14:55:31 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x11000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:31 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  405.730357] binder: BINDER_SET_CONTEXT_MGR already set
[  405.754011] binder: 14009:14043 ioctl 40046207 0 returned -16
[  405.754242] binder: 14009:14045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:31 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x500000000000000, 0x0, &(0x7f00000001c0)})

14:55:31 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:31 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf0}, 0x0)

[  406.052478] binder: 14055:14056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf000000}, 0x0)

14:55:32 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf0ffffff}, 0x0)

14:55:32 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:32 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xfffffff0}, 0x0)

14:55:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x40030000000000}, 0x0)

14:55:32 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x11000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:32 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x200000000000000}, 0x0)

[  406.844540] binder: BINDER_SET_CONTEXT_MGR already set
[  406.865567] binder: 14055:14086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  406.873710] binder: 14055:14084 ioctl 40046207 0 returned -16
14:55:32 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6c00000000000000, 0x0, &(0x7f00000001c0)})

14:55:33 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xffffff7f}, 0x0)

14:55:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x1000000}, 0x0)

[  407.124588] binder: 14094:14095 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x30000}, 0x0)

14:55:33 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xffffff9e}, 0x0)

14:55:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x1b6}, 0x0)

14:55:33 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x11000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x7000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x74000000, 0x0, &(0x7f00000001c0)})

14:55:33 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x1100}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:33 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf000}, 0x0)

[  407.899156] binder: BINDER_SET_CONTEXT_MGR already set
[  407.906082] binder: 14094:14130 ioctl 40046207 0 returned -16
[  407.912319] binder: 14094:14131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  407.996862] binder: 14136:14138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x300}, 0x0)

14:55:34 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0)

14:55:34 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x11000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:34 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xffffff7f00000000}, 0x0)

14:55:34 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:34 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x15000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  408.795230] binder: BINDER_SET_CONTEXT_MGR already set
[  408.800591] binder: 14136:14166 ioctl 40046207 0 returned -16
[  408.815247] binder: 14136:14168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:35 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7a00, 0x0, &(0x7f00000001c0)})

14:55:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x300000000000000}, 0x0)

14:55:35 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  409.151749] binder: 14173:14175 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0xa0008000}, 0x0)

14:55:35 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:35 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x8000a0}, 0x0)

14:55:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf000000}, 0x0)

14:55:35 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:35 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x11}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:35 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0)

[  409.959077] binder: BINDER_SET_CONTEXT_MGR already set
[  410.007297] binder: 14173:14204 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  410.016050] binder: 14173:14203 ioctl 40046207 0 returned -16
14:55:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xffffffffa0008000}, 0x0)

14:55:36 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x60000000, 0x0, &(0x7f00000001c0)})

14:55:36 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:36 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf}, 0x0)

[  410.371002] binder: 14215:14217 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:36 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xa0ff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0)

14:55:36 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0)

14:55:36 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x60}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x0)

14:55:36 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:36 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:37 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x700, 0x0, &(0x7f00000001c0)})

14:55:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0)

14:55:37 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:37 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  411.131613] binder: BINDER_SET_CONTEXT_MGR already set
[  411.137337] binder: 14215:14252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  411.145726] binder: 14215:14251 ioctl 40046207 0 returned -16
[  411.316236] binder: 14259:14261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:37 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xa0ff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0)

14:55:37 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:37 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xb6010000}, 0x0)

14:55:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x400300}, 0x0)

14:55:37 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:37 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x300}, 0x0)

[  412.083653] binder: BINDER_SET_CONTEXT_MGR already set
[  412.116724] binder: 14259:14288 ioctl 40046207 0 returned -16
[  412.121805] binder: 14259:14290 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:38 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7, 0x0, &(0x7f00000001c0)})

14:55:38 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:38 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x1f00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0)

14:55:38 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xa0ff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x3000000000000}, 0x0)

[  412.430263] binder: 14300:14301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x40030000000000}, 0x0)

14:55:38 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:38 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x8000a0ffffffff}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:38 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0)

14:55:38 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xa0008000}, 0x0)

[  413.175545] binder: BINDER_SET_CONTEXT_MGR already set
[  413.181372] binder: 14300:14303 ioctl 40046207 0 returned -16
[  413.190266] binder: 14300:14330 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:39 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x3, 0x0, &(0x7f00000001c0)})

[  413.314532] binder: 14332:14333 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0)

14:55:39 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:39 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0)

14:55:39 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:39 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x400300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x3000000}, 0x0)

14:55:39 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:39 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x1b6}, 0x0)

[  414.153678] binder: BINDER_SET_CONTEXT_MGR already set
14:55:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf00000000000000}, 0x0)

[  414.203373] binder: 14332:14365 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  414.211347] binder: 14332:14364 ioctl 40046207 0 returned -16
14:55:40 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xffffff7f00000000, 0x0, &(0x7f00000001c0)})

14:55:40 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:40 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  414.412163] binder: 14371:14373 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x8000a0ffffffff}, 0x0)

14:55:40 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2b000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:40 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0)

14:55:40 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:40 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0)

14:55:40 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x1000000}, 0x0)

[  415.225964] binder: BINDER_SET_CONTEXT_MGR already set
[  415.264475] binder: 14371:14415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  415.274101] binder: 14371:14413 ioctl 40046207 0 returned -16
14:55:41 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7a000000, 0x0, &(0x7f00000001c0)})

14:55:41 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x30000}, 0x0)

14:55:41 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  415.448160] binder: 14417:14425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:41 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:41 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf000}, 0x0)

14:55:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf0}, 0x0)

14:55:41 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2b000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:41 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:41 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xf00}, 0x0)

14:55:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x34000}, 0x0)

[  416.255472] binder: BINDER_SET_CONTEXT_MGR already set
[  416.283653] binder: 14417:14456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  416.291455] binder: 14417:14454 ioctl 40046207 0 returned -16
14:55:42 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4c000000, 0x0, &(0x7f00000001c0)})

14:55:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x300000000000000}, 0x0)

14:55:42 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  416.474067] binder: 14461:14465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xb601}, 0x0)

14:55:42 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:42 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2b000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:42 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:42 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x9effffff00000000}, 0x0)

14:55:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0xb601000000000000}, 0x0)

[  417.268170] binder: BINDER_SET_CONTEXT_MGR already set
[  417.286674] binder: 14461:14486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  417.293138] binder: 14461:14485 ioctl 40046207 0 returned -16
14:55:43 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:43 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x20000000, 0x0, &(0x7f00000001c0)})

14:55:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0)

14:55:43 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  417.577386] binder: 14491:14494 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:43 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2b000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:43 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x8000a0}, 0x0)

14:55:43 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x3}, 0x0)

14:55:44 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0)

14:55:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x2000000}, 0x0)

[  418.315550] binder: BINDER_SET_CONTEXT_MGR already set
[  418.321314] binder: 14491:14497 ioctl 40046207 0 returned -16
[  418.339228] binder: 14491:14522 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:44 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6, 0x0, &(0x7f00000001c0)})

14:55:44 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:44 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:44 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:44 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:44 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  418.866601] binder: 14533:14539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:45 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x1500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  419.609862] binder: BINDER_SET_CONTEXT_MGR already set
[  419.615340] binder: 14533:14535 ioctl 40046207 0 returned -16
[  419.616039] binder: 14533:14561 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:45 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:45 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4c, 0x0, &(0x7f00000001c0)})

14:55:45 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:45 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  420.010418] binder: 14576:14579 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:46 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:46 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:46 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:46 executing program 5:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:46 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  420.799177] binder: BINDER_SET_CONTEXT_MGR already set
[  420.826240] binder: 14576:14608 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  420.835656] binder: 14576:14606 ioctl 40046207 0 returned -16
14:55:47 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x600000000000000, 0x0, &(0x7f00000001c0)})

14:55:47 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x10000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:47 executing program 5:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  421.136897] binder: 14623:14625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:47 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:47 executing program 5:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:47 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:47 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  421.947031] binder: BINDER_SET_CONTEXT_MGR already set
[  421.969688] binder: 14623:14651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  421.977252] binder: 14623:14650 ioctl 40046207 0 returned -16
14:55:48 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4800000000000000, 0x0, &(0x7f00000001c0)})

14:55:48 executing program 5:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  422.117398] binder: 14658:14661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:48 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:48 executing program 5:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:48 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:48 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6000000000000000, 0x0, &(0x7f00000001c0)})

14:55:48 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffffff7f}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:48 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:48 executing program 5:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  422.900899] binder: BINDER_SET_CONTEXT_MGR already set
[  422.906851] binder: 14658:14695 ioctl 40046207 0 returned -16
[  422.913036] binder: 14658:14698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:48 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  423.034518] binder: 14706:14711 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:49 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:49 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x500000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:49 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6c, 0x0, &(0x7f00000001c0)})

14:55:49 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:49 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:49 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffa0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  423.816561] binder: BINDER_SET_CONTEXT_MGR already set
[  423.822137] binder: 14706:14740 ioctl 40046207 0 returned -16
[  423.822176] binder: 14706:14741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:49 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  423.944206] binder: 14749:14752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:50 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:50 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:55:50 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:55:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:50 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x8000a0, 0x0, &(0x7f00000001c0)})

14:55:50 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:50 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x1100000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:50 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  424.706592] binder: BINDER_SET_CONTEXT_MGR already set
[  424.712185] binder: 14749:14780 ioctl 40046207 0 returned -16
[  424.712235] binder: 14749:14781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:50 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[  424.802941] binder: 14787:14792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:50 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:55:50 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:50 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffffff7f00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:51 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:55:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:51 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:55:51 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6c000000, 0x0, &(0x7f00000001c0)})

14:55:51 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:51 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  425.577637] binder: BINDER_SET_CONTEXT_MGR already set
[  425.583293] binder: 14787:14819 ioctl 40046207 0 returned -16
14:55:51 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:52 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x1100000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:52 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:55:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:52 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  426.491864] binder: BINDER_SET_CONTEXT_MGR already set
[  426.497348] binder: 14828:14858 ioctl 40046207 0 returned -16
[  426.504633] binder_thread_write: 2 callbacks suppressed
[  426.504646] binder: 14828:14859 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:52 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x500, 0x0, &(0x7f00000001c0)})

14:55:52 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xc000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:52 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  426.742763] binder: 14869:14871 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:52 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:52 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:55:53 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf000)

14:55:53 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  427.546944] binder: BINDER_SET_CONTEXT_MGR already set
14:55:53 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  427.600703] binder: 14869:14899 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  427.610593] binder: 14869:14897 ioctl 40046207 0 returned -16
14:55:53 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xffffffffa0008000, 0x0, &(0x7f00000001c0)})

14:55:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf0)

14:55:53 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf00)

[  427.886039] binder: 14906:14908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:53 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:53 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xff000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xfffffff0)

14:55:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x2000000)

14:55:54 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf0ffff)

14:55:54 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  428.727771] binder: BINDER_SET_CONTEXT_MGR already set
14:55:54 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xb6010000)

[  428.769131] binder: 14906:14933 ioctl 40046207 0 returned -16
[  428.769197] binder: 14906:14934 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:54 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xc000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:54 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x400000000000000, 0x0, &(0x7f00000001c0)})

14:55:54 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x3000000)

[  429.130460] binder: 14946:14948 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x8000a0)

14:55:55 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:55 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2700}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x9effffff00000000)

14:55:55 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:55 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x100000000000000)

14:55:55 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xc000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  429.921145] binder: BINDER_SET_CONTEXT_MGR already set
[  429.940140] binder: 14946:14972 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  429.948327] binder: 14946:14971 ioctl 40046207 0 returned -16
14:55:56 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7000000, 0x0, &(0x7f00000001c0)})

14:55:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x3000000000000)

14:55:56 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  430.266029] binder: 14979:14981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf0ffffff00000000)

14:55:56 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xc000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:56 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xfffff000)

14:55:56 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x6000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:56 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x1b6)

14:55:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf)

[  431.032434] binder: BINDER_SET_CONTEXT_MGR already set
[  431.061564] binder: 14979:15009 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  431.069227] binder: 14979:15008 ioctl 40046207 0 returned -16
14:55:57 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4c00, 0x0, &(0x7f00000001c0)})

14:55:57 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:57 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xffffffffa0008000)

[  431.305530] binder: 15014:15017 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:57 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x300000000000000)

14:55:57 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf000000)

14:55:57 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xffffff9e)

14:55:58 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  432.137719] binder: BINDER_SET_CONTEXT_MGR already set
14:55:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xb601000000000000)

[  432.186121] binder: 15014:15043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  432.194064] binder: 15014:15041 ioctl 40046207 0 returned -16
14:55:58 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xfffffdfd, 0x0, &(0x7f00000001c0)})

14:55:58 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:58 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:58 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xffffff7f00000000)

[  432.506929] binder: 15056:15057 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:58 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x300000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x8000a0ffffffff)

14:55:58 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:58 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x1000000)

14:55:59 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xfffffffffffff000)

14:55:59 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:59 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf0ffffffffffff)

[  433.294671] binder: BINDER_SET_CONTEXT_MGR already set
[  433.300033] binder: 15056:15089 ioctl 40046207 0 returned -16
[  433.306112] binder: 15056:15090 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:59 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x5000000, 0x0, &(0x7f00000001c0)})

14:55:59 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2700}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:59 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xa000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:59 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:59 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x40030000000000)

[  433.588256] binder: 15096:15101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:55:59 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:55:59 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x400300)

14:56:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x9effffff)

14:56:00 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x34000)

14:56:00 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffa0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  434.412125] binder: BINDER_SET_CONTEXT_MGR already set
[  434.417733] binder: 15096:15121 ioctl 40046207 0 returned -16
[  434.434397] binder: 15096:15128 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:00 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:00 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x600, 0x0, &(0x7f00000001c0)})

14:56:00 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:00 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x60000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x2)

[  434.614589] binder: 15137:15139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:00 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf00000000000000)

14:56:00 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x30000)

14:56:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xffffff7f)

14:56:00 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:01 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffa0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:01 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffffff7f}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:01 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x100000000000000, 0x0, &(0x7f00000001c0)})

14:56:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xb601)

14:56:01 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:01 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  435.387694] binder: BINDER_SET_CONTEXT_MGR already set
[  435.393419] binder: 15137:15179 ioctl 40046207 0 returned -16
[  435.400118] binder: 15137:15180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x3)

[  435.570810] binder: 15190:15191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:01 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x300)

14:56:01 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x200000000000000)

14:56:02 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:02 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffa0}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xa0008000)

14:56:02 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7a00000000000000, 0x0, &(0x7f00000001c0)})

14:56:02 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0xf0ffffff)

[  436.367636] binder: BINDER_SET_CONTEXT_MGR already set
[  436.373263] binder: 15190:15219 ioctl 40046207 0 returned -16
[  436.379321] binder: 15190:15221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:02 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2a000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:02 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:02 executing program 2:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00')
sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f00000002c0)={&(0x7f0000000100), 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="824d0ea9e8b02aeacd2bd630772088000000", @ANYRES16=r1, @ANYBLOB="030328bd7000fedbdf25110000002800030014000200766574683000000000000000000000000800040006000000080007004e2200000800060000800000080004000300000054000300080005000000000508000500e000000214000600fe80000000000000000000000000000f0800030000000000080003000100000008000800f300000014000600fe80000000000000000000000000001f"], 0xa0}, 0x1, 0x0, 0x0, 0x1}, 0x2400c005)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f00000001c0))
ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000000140))
sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x28, 0x829, 0x70bd2c, 0x0, {0x15}, [@typed={0x8, 0x86, @u32}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000000}, 0x0)

[  436.511014] binder: 15229:15231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:02 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:02 executing program 2:
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x200200, 0x0)
ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000240)=""/175)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:02 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000002802290800ecffff2529d9e088747172"], 0x14}}, 0x0)

14:56:03 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x60000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:03 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x3000000, 0x0, &(0x7f00000001c0)})

14:56:03 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400000, 0x0)
ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f0000000040)={0x3, 0xffff, 0x401})
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000240)={<r2=>0x0, 0xb7, "8e52a326f76dac9f66149d52d1194370336ceb3b84149b9113117dbdbe391a70af9c2c1b0f976ffaf337da4a87ff05709b98cfc981a07e2c3d3dd1285830e2be2e4ea379d06a7494d3b8ea356c587f2a8f34a4eb822f5648572f05c577d56b257492f5e33537e33eafb304c9b20329081b23ca9f1216bbeb82be90532a42ee4f7aac88266aac9ba9f15e9ba4eb8617d38abbef7fd4182f51a950aaa1127db57db01dcfefa52296a3a157fb2ac2934e3bb841358e3acec4"}, &(0x7f0000000140)=0xbf)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000300)={r2, 0xa8, "5e249e280636c2a7f4fbcb9bb0deba8421491ec0838c781ae47531b2f805f5aec3758d14d4161bb8ecaf095e5a03c9ac7f64a16821dc160dcbcfdd579ee1ebbac08e4644b09970035b3d12ab524b8c83b4385ce69643c407f6a9fed02dd63d38bc73cab19407848d4055d1f69923d5be1f1676d947847281277f0c6c018dbcb6c1484a9fffb9f6b6d1b4663d1626a237487b7d5cc1cf02c71854a457f3c947ae411e6c9459c3ad2e"}, &(0x7f00000001c0)=0xb0)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000080))

14:56:03 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4400}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  437.293836] binder: BINDER_SET_CONTEXT_MGR already set
[  437.299515] binder: 15229:15266 ioctl 40046207 0 returned -16
[  437.305750] binder: 15229:15267 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  437.395640] audit: type=1400 audit(1539442563.376:68): avc:  denied  { getattr } for  pid=15270 comm="syz-executor2" path="socket:[52217]" dev="sockfs" ino=52217 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  437.442920] binder: 15274:15277 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xe052118e4ffa2cda}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYRES16=r0], 0x3}, 0x1, 0x0, 0x0, 0x20048001}, 0x8000)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00')
accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000300)=0x14, 0x800)
accept$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000480)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000004c0)=0x14)
getpeername$packet(0xffffffffffffffff, &(0x7f0000001ec0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001f00)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000001f40)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@dev}}, &(0x7f0000002040)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002080)={'team0\x00', <r8=>0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000020c0)={{{@in, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in6=@remote}}}, &(0x7f00000021c0)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000002200)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002240)=0x14, 0x80000)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000002280)={@empty, @loopback, <r11=>0x0}, &(0x7f00000022c0)=0xc)
accept$packet(0xffffffffffffff9c, &(0x7f0000002340)={0x11, 0x0, <r12=>0x0}, &(0x7f0000002380)=0x14)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f00000023c0)={@local, <r13=>0x0}, &(0x7f0000002400)=0x14)
rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00')
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000002440)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000002540)=0xe8)
sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000002940)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x22000020}, 0xc, &(0x7f0000002900)={&(0x7f0000002580)={0x354, r2, 0x0, 0x70bd26, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7720}}}]}}, {{0x8, 0x1, r4}, {0x1ec, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x100}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}]}}, {{0x8, 0x1, r11}, {0x3c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r12}}}]}}, {{0x8, 0x1, r13}, {0xbc, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6f}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8000}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}]}, 0x354}, 0x1, 0x0, 0x0, 0xc040}, 0x4)

14:56:03 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  437.658008] audit: type=1400 audit(1539442563.636:69): avc:  denied  { ioctl } for  pid=15280 comm="syz-executor2" path="socket:[53109]" dev="sockfs" ino=53109 ioctlcmd=0x8933 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
14:56:03 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="141700002800290820000000000000090c0000f4"], 0x14}}, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@mcast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{}, 0x0, @in=@local}}, &(0x7f0000000040)=0xe8)
sendto(r0, &(0x7f0000000000)="cee1e7a60a89163363a2d8393c8b", 0xe, 0x4008000, &(0x7f0000000340)=@hci={0x1f, r1, 0x3}, 0x80)

14:56:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:03 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:03 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000028002908000000000008000000000000"], 0x14}}, 0x0)

14:56:04 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xc00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:04 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x48, 0x0, &(0x7f00000001c0)})

14:56:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000000)={&(0x7f0000000200)={0xfffffffffffffeec, 0x28, 0x829, 0x0, 0x8000000, {0xc}}, 0x100000087}}, 0x0)

14:56:04 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:04 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  438.246310] binder: BINDER_SET_CONTEXT_MGR already set
[  438.261421] binder: 15274:15306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  438.269171] binder: 15274:15303 ioctl 40046207 0 returned -16
14:56:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80900}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xdc, r1, 0xf04, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffff}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x23}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3e}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xa4a}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x9a15be2f84a4d629}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20000050}, 0x4000004)
r2 = fcntl$dupfd(r0, 0x0, r0)
r3 = fcntl$getown(r0, 0x9)
sendto$unix(r2, &(0x7f00000003c0)="35976bbd12108f977e840eeb04f8153797e09a812d0b4445cc47018243622ce4b9fcd4b03a9fbbf07be901de6f6ea3f5bf44b25e9907db237c7bd9bc4d0291449715924cc8126e993521a1d421647b8f69e72b84ca8f4c419c46c7e678ec47678b2bdb2e5b5e18e99846e3c4ee6cbe971c1bf9e9a0827589e8281812d10c9b90", 0x80, 0x81, &(0x7f0000000440)=@abs={0x1, 0x0, 0x4e21}, 0x6e)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=<r4=>0x0)
r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8000, 0x0)
kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r0, &(0x7f0000000080)={r5, r0, 0x8001})
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  438.451123] binder: 15317:15318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:04 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:04 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000000)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:04 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xc00000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:04 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:05 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x10000, 0x0)
write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x1, {{0x50, 0x4, 0x6}, 0x2}}, 0x18)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:05 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:05 executing program 2:
socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000240)={0x7, {{0xa, 0x4e20, 0x9, @mcast2, 0x9}}, 0x1, 0x4, [{{0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0x1e}, 0x81}}, {{0xa, 0x4e23, 0x85, @remote, 0x400}}, {{0xa, 0x4e21, 0x9, @remote, 0x8}}, {{0xa, 0x4e20, 0x8, @empty, 0x1}}]}, 0x290)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
signalfd(r1, &(0x7f0000000180)={0x9}, 0x8)
sendmsg$nl_generic(r2, &(0x7f0000000000)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x0, 0x0, 0x0, {0xa}}, 0xb}}, 0x0)
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x20001, 0x0)
mkdirat(r3, &(0x7f0000000080)='./file0\x00', 0x80)

[  439.283463] binder: 15317:15349 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  439.283466] binder: BINDER_SET_CONTEXT_MGR already set
[  439.283482] binder: 15317:15347 ioctl 40046207 0 returned -16
14:56:05 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x200000000000000, 0x0, &(0x7f00000001c0)})

14:56:05 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x54000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:05 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
r2 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x7, 0x244001)
write$P9_RVERSION(r2, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0x522, 0x6, '9P2000'}, 0x13)
setgid(r1)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000100280029010b0063f300000021cd766ce59c85bf8264caaf83bd0dd7d387adcc43a9866ded2800432bf248a1c946a18ebe4dcb4c"], 0x14}}, 0x0)

14:56:05 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:05 executing program 2:
r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x3ff, 0xa44c0)
ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000000240))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4000, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  439.644324] binder: 15358:15363 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:05 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40a082, 0x20)
setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000040)={0x80000001, 0x5, 0x193f, 0x3}, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:05 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:06 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@rand_addr, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast1}}, &(0x7f0000000400)=0xe8)
setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000440)={@rand_addr, @empty, r1}, 0xc)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r3 = accept(r2, &(0x7f0000000000)=@alg, &(0x7f0000000080)=0x80)
setsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000140)=0x2, 0x4)

[  440.108537] audit: type=1400 audit(1539442566.086:70): avc:  denied  { accept } for  pid=15376 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
14:56:06 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:06 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2, 0x0)
bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:06 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x5400}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  440.435688] binder: BINDER_SET_CONTEXT_MGR already set
14:56:06 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)

[  440.515113] binder: 15358:15391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  440.523655] binder: 15358:15390 ioctl 40046207 0 returned -16
14:56:06 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x2000000000000000, 0x0, &(0x7f00000001c0)})

14:56:06 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:06 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000080)={'veth0_to_bridge\x00', 0x8000})
ioctl$KVM_SIGNAL_MSI(r2, 0x4020aea5, &(0x7f0000000040)={0x117000, 0x6000, 0x8, 0x10001, 0x9})
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  440.755192] binder: 15399:15400 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:06 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:07 executing program 2:
socket$inet6_dccp(0xa, 0x6, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r1 = semget$private(0x0, 0x2, 0x52)
semctl$GETVAL(r1, 0x3, 0xc, &(0x7f0000000000)=""/122)

14:56:07 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/dev\x00')
readv(r0, &(0x7f00000000c0)=[{&(0x7f0000002380)=""/4096, 0x1000}], 0x20000000000000b4)

14:56:07 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:07 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x3000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:07 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
times(&(0x7f0000000000))
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0xa24c2, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000240)={0x9, [0x0, 0x0, 0x0, 0x0, <r2=>0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000280)=0x28)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000002c0)={r2, 0x80010000}, 0x8)
accept(r0, &(0x7f0000000040)=@sco, &(0x7f0000000140)=0x80)

14:56:07 executing program 5:
r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x3, 0x182)
r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0)
pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
sendfile(r0, r0, &(0x7f0000000000), 0x2000005)
socket(0x0, 0x0, 0x0)
close(r0)

[  441.557258] binder: BINDER_SET_CONTEXT_MGR already set
14:56:07 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

[  441.600419] binder: 15399:15439 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  441.609066] binder: 15399:15438 ioctl 40046207 0 returned -16
14:56:07 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x6000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:07 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4c00000000000000, 0x0, &(0x7f00000001c0)})

14:56:07 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000280029bddcf1dac3683ca7d3b6cd64b5dd41ef"], 0x14}}, 0x0)

14:56:08 executing program 5:
io_setup(0xffffffffffffff81, &(0x7f0000000640))
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x200000, 0x0)
ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f00000007c0)={{0x5}, {0x6}, 0x1, 0x7, 0x7f})
r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8003, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f00000004c0)={@mcast2, <r3=>0x0}, &(0x7f0000000500)=0x14)
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000540)={@remote, 0xb, r3})
r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CLR_FD(r1, 0x4c01)
setsockopt(r2, 0x3, 0x1, &(0x7f00000003c0), 0x0)
ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef, 0x0, 0x3f0000003f000000, 0x0, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}})
close(r0)
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000900))
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f00000002c0)={<r5=>0x0, @in={{0x2, 0x4e22, @rand_addr}}, [0x5, 0x3, 0x10000, 0x0, 0x4, 0x0, 0x2, 0x8, 0x4, 0xf15, 0x0, 0x100, 0x9]}, &(0x7f0000000080)=0x100)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000240)={r5, 0x8000}, 0x8)
shutdown(r2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3})
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000480))
io_destroy(0x0)
setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000280)=@assoc_value={r5, 0x400}, 0x8)
accept(r2, &(0x7f0000000180)=@ethernet={0x0, @link_local}, &(0x7f0000000200)=0x80)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xffffffbffffffffe, 0x0, @dev}, 0x1c)
ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000440)=0x20)
r6 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x3, 0x0)
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r6, 0xc00c642d, &(0x7f0000000880)={<r7=>0x0, 0x0, r6})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000008c0)={r7, 0x0, r6})

[  441.980034] binder: 15452:15454 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:08 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:08 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
r1 = syz_open_pts(r0, 0x0)
r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0)
ioctl$TIOCCONS(r1, 0x541d)
dup3(r2, r1, 0x0)
dup3(r1, r0, 0x0)

14:56:08 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x10600, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000028002908cacc46907c0f9b9aa801b165715e98da879cc0d4e38add252e287cc38edb42f3b8b0255a7a04b1992213feafc7e96a6d6baba678e37b82f8c59a1e2818d4b98f7d33451f4907dc8f6fdc7d121010ae929b21ad7502573875b5188641a36b8db9118e5ca8d0e3958973617ada9cddfdc7d9cda61442dc659ff14278a1ae6e54627e550f812a9c06163972fd5201dd1c32edcca4fd1c8974a1f92b9a620610e856f9ce65fedbcd74bb2fcc3594c0"], 0x14}}, 0x0)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200, 0x0)
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={<r2=>0x0, 0x2}, &(0x7f0000000080)=0x8)
inotify_add_watch(r1, &(0x7f00000001c0)='./file0\x00', 0x85000201)
setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={r2, 0x9}, 0x8)
fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000240))
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000002c0)={0x4, 0xffffffffffffff80, 0x8000, 0xb5b2, 0x3, 0x9, 0x2, 0xe1e, r2}, &(0x7f0000000300)=0x20)

14:56:08 executing program 2:
r0 = gettid()
r1 = getpgid(r0)
r2 = syz_open_procfs(r0, &(0x7f0000000040)='net/udp6\x00')
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0x100000, 0x10d000, 0xd, 0x3, 0x1, 0x0, 0x8, 0x0, 0x4, 0xffffffffffffffff, 0x7, 0xbe}, {0xf000, 0x2000, 0xc, 0xfffffffffffffffb, 0x33, 0x400, 0x1, 0x7fffffff, 0x2, 0x6ee, 0x1ff, 0x8}, {0x2, 0x2, 0x0, 0x4, 0x9, 0x10001, 0x7, 0x43, 0x1ff, 0x2, 0x57d1, 0x6}, {0x4000, 0x4, 0xe, 0x6, 0x6, 0x2, 0xba, 0x101, 0x1, 0x800, 0x5, 0x3}, {0xf000, 0x5005, 0xf, 0x3ff, 0x882, 0x6, 0xfff, 0x99a2, 0x81, 0x2, 0x4, 0xfff}, {0x105000, 0x101000, 0x8, 0x1ff, 0x1654000, 0x2, 0x4, 0x0, 0x10001, 0x0, 0xfffffffffffffff8, 0x9}, {0x4000, 0x10000, 0x1d, 0x7, 0x7, 0x1, 0x2a7f, 0x1, 0x7, 0x1, 0x6b, 0x101}, {0x0, 0x2, 0xf, 0x9217, 0x3f, 0x69, 0x81, 0x7, 0x7, 0x8, 0xfffffffffffff9cd, 0x1f}, {0x3000, 0x103002}, {0x100002, 0xd002}, 0x4, 0x0, 0x100000, 0x50000, 0x0, 0x9800, 0x4, [0x4, 0x0, 0x9, 0x6]})
ptrace$poke(0xffffffffffffffff, r1, &(0x7f0000000000), 0x5)
ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, &(0x7f0000000080)={0x2, 0x1, 0x5, 0x5c, 'syz0\x00', 0x20})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000002800290800000000800000000c000000"], 0x14}}, 0x0)
r4 = msgget(0x1, 0x210)
msgrcv(r4, &(0x7f0000000080)=ANY=[], 0x0, 0x3, 0x3000)
getpgid(r1)

14:56:08 executing program 1:
setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = gettid()
socketpair(0xa, 0x0, 0x0, &(0x7f00000000c0))
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x8)
wait4(0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140))
finit_module(0xffffffffffffffff, &(0x7f0000000240)="c12d73656c6673656c665d2d5447504c2d00", 0x0)

14:56:08 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xa000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:08 executing program 1:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0)
pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806)
r1 = openat$random(0xffffffffffffff9c, &(0x7f0000000180)='/dev/urandom\x00', 0x2, 0x0)
sendfile(r1, r0, &(0x7f0000000480), 0x2000005)

[  442.730414] binder: BINDER_SET_CONTEXT_MGR already set
[  442.760733] binder: 15452:15496 ioctl 40046207 0 returned -16
[  442.760779] binder: 15452:15497 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:08 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/arp\x00')
sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={&(0x7f0000000080)=@nl, 0x80, &(0x7f00000004c0), 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1000000000000304, 0x400000000100)
ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x0)
ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000100))

14:56:08 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4000000, 0x0, &(0x7f00000001c0)})

[  442.980587] binder: 15503:15505 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:09 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/arp\x00')
sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={&(0x7f0000000080)=@nl, 0x80, &(0x7f00000004c0), 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1000000000000304, 0x400000000100)
ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x0)
ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000100))

14:56:09 executing program 1:

14:56:09 executing program 3:

14:56:09 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000380)="153f6234488dd25d766070")
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x0)

14:56:09 executing program 3:
r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
fsetxattr$security_ima(r0, &(0x7f0000000100)='security.ima\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="043704166878010d51709f498680983100000000000000de811dc3"], 0x1, 0x0)
open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0)

14:56:09 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x3f00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  443.338928] audit: type=1804 audit(1539442569.316:71): pid=15520 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir068729057/syzkaller.IQX2B9/317/bus" dev="sda1" ino=16587 res=1
14:56:09 executing program 2:
r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x20100, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x2c, @loopback, 0x4e22, 0x0, 'fo\x00', 0x0, 0x3ff, 0x74}, 0x2c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x111000, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000040)=0xfff)

14:56:09 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
writev(0xffffffffffffffff, &(0x7f0000002980), 0x20000254)
ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400))
listen(r0, 0x5526c56d)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff)
r2 = memfd_create(&(0x7f0000000180)='syz1\x00', 0x0)
write$P9_RFSYNC(r2, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0x7)
sendto$inet6(r1, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r3 = creat(&(0x7f00000004c0)='./bus\x00', 0x4)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0)
r4 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000440)="22af30fbe9904010f60f71e3bff0662c", 0x137)
write$selinux_context(r4, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84)
creat(&(0x7f00000005c0)='./bus\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000380), 0x0)
write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xfffffeb3)
select(0x40, &(0x7f0000000040)={0x0, 0x0, 0x100000000000000}, &(0x7f0000000080), &(0x7f00000001c0)={0x10001}, &(0x7f0000000280)={0x77359400})
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000001000)=ANY=[@ANYBLOB="7365637572697479000000000000000000000000000000000000000000000000c40000004e8b4b1e7fa37c911d43b7dfc1540065e2cf063a33e71b0300744582ab311411bb94c232461f22877f4a2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc474078acbead561a51093ca99b61c426c9382417876b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f150e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3acfd6d899dd2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb99320750390dc04b3af4959443184210edb4f658ccf485fb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596052191868741cecd379b6e87b1c1a8c0dc6b8004595fb61135ed10927d6dfa43071d53b4dfb44a757c13d8ceb4b62bbde3caec0e7bb3b315374b2ddefb57fceb51dbbe6315b43f6e092c2f7fd6e31ed3a27bc312f9b63e662885e159251a427909f2de432ba7fb86d076a06866210cddcdf6d765bfa30ecb2372e8e8f25e956e87fef3edb972a367c85eb7e3f854d5f68ed4888426a101de7450eab90012d17d86888f2daaaba1b378b5b28081331760240bafa63f3ef839759377187163cb3ee92ceba919040febd755cf"], &(0x7f00000002c0)=0x1)
recvfrom$inet6(r1, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c)
r5 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0)
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000500)='/dev/ptmx\x00', 0x100, 0x0)
write$binfmt_elf32(r6, &(0x7f00000008c0)=ANY=[@ANYBLOB="7f454c46faff0620fcffffffffffffff0300060001000000df01000038000000d9010000008000000500200001000800000009000000000051e574640f0800006aea000001000000ff0f00000700000000000000030000009668bb908cb6726a43142f86d6a3fd7e3694e62d98a3e9867574876ee71867bf2e366f01b23e2e1379b68172953a00526b7d081df73b01e59505389f7178db42a55382f65205109c6d82eef645af9a7800bba6dc33a0e11764aee1f50814804cd2e86c9c49808774f99128bbe8aad3a137bac703406b6b90c2f4ce4e6da6c62eb33877fe163de28737983f7ecf4a43d94c66b7930d966cd749f6b569db2ced85c7f3808662a8707cc5337ac6640000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b533b6172f2db3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x705)
sendto$inet6(r5, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000340)={0x0, <r7=>0x0})
fchdir(r0)
ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000380)=r7)

14:56:09 executing program 5:
clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f00000000c0)={<r0=>0x0, <r1=>0x0})
ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000100)={0x2, 0xffffffffffffff80})
futex(&(0x7f0000000080)=0x1, 0x6, 0x0, &(0x7f0000000180)={r0, r1+30000000}, &(0x7f0000000140), 0x0)

14:56:09 executing program 3:
socket(0x0, 0x2, 0x0)
syz_open_procfs(0x0, &(0x7f0000000440)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f7980584303d01f0549a89d78dc4af89ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5ad3657818feb0279188b92b2e6b035cde4c66c6b00081bd106f6adfe58108a8be89d3695670374e304c071de17635f3034de8c2372e07000000000000007d656f")
r0 = socket$inet6(0xa, 0x1000000000001, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
socket$pptp(0x18, 0x1, 0x3)

[  443.441767] audit: type=1804 audit(1539442569.346:72): pid=15520 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir068729057/syzkaller.IQX2B9/317/bus" dev="sda1" ino=16587 res=1
14:56:09 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  443.603617] audit: type=1804 audit(1539442569.356:73): pid=15526 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir068729057/syzkaller.IQX2B9/317/bus" dev="sda1" ino=16587 res=1
[  443.810482] binder: 15503:15557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  443.818259] binder: BINDER_SET_CONTEXT_MGR already set
[  443.853657] binder: 15503:15555 ioctl 40046207 0 returned -16
14:56:10 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x1000000, 0x0, &(0x7f00000001c0)})

14:56:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xffffffffffffff81, 0x800)
r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0)
accept4$unix(r1, &(0x7f0000000240)=@abs, &(0x7f00000001c0)=0x6e, 0x80000)
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000002c0)={{0xa, 0x4e20, 0x2, @mcast2, 0x1}, {0xa, 0x4e23, 0xffffffffffffffd3, @local, 0x7}, 0x3, [0x20, 0x0, 0x86, 0x4, 0x400, 0x101000, 0x9, 0x7]}, 0x5c)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
getsockopt$inet6_udp_int(r2, 0x11, 0xa, &(0x7f0000000080), &(0x7f0000000140)=0x4)

14:56:10 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:10 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xffffff8d}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  444.181661] binder: 15563:15566 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xfff, 0x1)
setsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000040)=@srh={0x32, 0xe, 0x4, 0x7, 0xffffffffffffff0f, 0x20, 0x5, [@mcast1, @dev={0xfe, 0x80, [], 0x10}, @loopback, @empty, @empty, @ipv4={[], [], @multicast2}, @local]}, 0x5ec)

14:56:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="000000000000001c00004eef3600de1cfe92ac19a4f3c3d247badc839090fcb678947c33fc19e1cce01483ef982676caa7f770998f1b32572bdefc772505f30c9f44a75186e045afd6aa8ae53409f12e805b8ad785a5a28ea60a69d011ddceee3021a5eacfbc3ef44ccc713179c934534737fa9b9f28229a2a8112d0"], 0x14}}, 0x0)

14:56:10 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0x10, 0x34003, 0x0, 0x40004000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x8, 0x829, 0xfffffffffffffffc, 0x3, {0xc}}, 0x14}}, 0x0)

14:56:10 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$inet6_dccp(0xa, 0x6, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1400000028002908fcd4f5be10a26aacd44b45cb00000000000000000c0000004f343c60785886f0ed6680c818064ee3f1c32ce85f8ec19564d66776c5a71f720a32f597718fbeb05410ddf9bdf1254f4ed4cfd62c68bf17e4d856546f36f67948ed5e372aa7e815cf4a3d7c4f9bfaa15d152b4cda44d8698982b58233ea71"], 0x14}}, 0x0)

14:56:11 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  444.991524] binder: BINDER_SET_CONTEXT_MGR already set
[  445.001180] binder: 15563:15593 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  445.049043] binder: 15563:15591 ioctl 40046207 0 returned -16
14:56:11 executing program 2:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000480))
clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff)
r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/load\x00', 0x2, 0x0)
write$selinux_load(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757816000000c2fdae0ef47f92b50082570040000000ffff0000fbfe400001000000"], 0x30)
ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000000c0))
r2 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000100))
socket$nl_generic(0x10, 0x3, 0x10)
bind(r2, &(0x7f0000000000)=@nfc={0x27, 0x1, 0x1, 0x4}, 0x80)

[  445.308798] SELinux: ebitmap start bit (1) is not a multiple of the map unit size (64)
[  445.323772] SELinux: failed to load policy
14:56:11 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6800, 0x0, &(0x7f00000001c0)})

14:56:11 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:11 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xf00}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  445.340285] audit: type=1400 audit(1539442571.316:74): avc:  denied  { bind } for  pid=15607 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  445.383210] SELinux: ebitmap start bit (1) is not a multiple of the map unit size (64)
14:56:11 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000002804290800000000000000000c00000074cd8a2d5dfd7507b35184969a0a3e231ab174034d556fb7d30b975df2594c713912fa4ff23770a5ce521c5e80015a3aff09ad178a13d3728194bf3f550c9a1449e4bbc29f1baff07102a4d60da0c1d08c0000bf3e2f64f4c5296f99ee809c04f8005ae21aea6f290493874dd88c7658a029606cd31baca89840c947c98c39dcfa4803c2d84117b49d15f07708353aa99c70b710ee331ac589cefbc3aed8bd8d96b08cf8f38be1259bd36722b99763bd479f5e5793f2abe3ea53aee3968ac9803b82d9723b1fc7244953e1c15f0889f5fffa09930fd6f49ef3db6088090694bfa370856a8d"], 0x14}}, 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4800)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000240)=""/212)
setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x7c8}, 0x4)

[  445.449612] SELinux: failed to load policy
[  445.450275] binder: 15615:15618 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:11 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f00000001c0)={{0x2, 0x4e21, @multicast1}, {0x307, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x12, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x12}}, 'bond0\x00'})
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="14e1ff002800291d00000000000000000c3ec20a676c9a06c39a49610ddc481042d273e1bbca26e49f5636b3d7b7ed9c8a4d0e5d995cd7c17765e66a9c0fc57de54a1c3509f5393d65910cd16957c2981ef5f4f9f3df215a1748780d2ee6024eaf33dc22be6bbbf58d3dce1467e6e42710891c95f72033427a277652bf71bf831f8d8d21ceea0a0a2b850c0000000000008e36ca22163404cf23011eabb7ce238146"], 0x14}}, 0x0)

14:56:11 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xe}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:12 executing program 2:
r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1)
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000))
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:12 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  446.277961] binder: 15615:15640 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  446.285807] binder: BINDER_SET_CONTEXT_MGR already set
14:56:12 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:12 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x60, 0x0, &(0x7f00000001c0)})

[  446.332311] binder: 15615:15638 ioctl 40046207 0 returned -16
14:56:12 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_open_dev$usb(&(0x7f0000000300)='/dev/bus/usb/00#/00#\x00', 0x80000001, 0x2)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="3b00000028002909000000000000eeff0c00000004605800d6e6dc98ae73e77172c0b55d98a5da487328bdd31a320f7213f27c119f5bc3c9d9db9bbcea1f370c7ea6ee196836e7a5c9e5f583d48654b694233867b8e2c0f91bd56f69a0ee0aeed1c6032a1dcb6dfd5e07da9595d9b14ebb2f0bfdbc0c6ca7fc809d8234b95fca5fd3efaeb48de2bd6566dbde7516ae784ea5b3"], 0x14}}, 0x0)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000240)={<r2=>0x0, 0xff, 0x20, 0x4, 0x80000000, 0x1, 0x1, 0x7, {0x0, @in6={{0xa, 0x4e24, 0x80000000, @empty, 0x7}}, 0x10001, 0x8000000000, 0x2, 0xffffffffffffffff, 0x5}}, &(0x7f0000000080)=0xb0)
getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=r2, &(0x7f00000001c0)=0x4)
r3 = getpgid(0xffffffffffffffff)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000400)={{0x7, 0x7, 0x4, 0x3, '\x00', 0x7}, 0x1, 0x0, 0x2, r3, 0x1, 0x10, 'syz1\x00', &(0x7f0000000200)=["2773797374656deb00"], 0x9, [], [0x80000001, 0x5, 0x80, 0x10001]})
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x77b7}, 0x4)

14:56:12 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:12 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x38000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  446.438128] binder: 15647:15649 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:12 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x12, 0x4)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="140400802800290800002708484e00000c000000ce7269319e8ed9a142d827abbb6dff199bd046fdde753fa37cdb8db8011599d0b2461c383ec7dd4db80ae9012d0374e7cc194e054ca69541deac4b70b2fc87912548c9bb23893d42f542da70c2041c13eda9c139bf90cce7f26ce23060b63d1e9595340ead9cdd19e7a1bd3b6811f02494929b8bd7a7143307abcd32a52e83be7839486fc85714029f811222d91f0d17896fad2044cd18cc6adc510b46f61592bade2cc6d50f49511137b0fd555d9dca94b85813b6bc16895e34"], 0x14}}, 0x0)

14:56:12 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000028002908000000000000000000000000"], 0x14}}, 0x0)

14:56:13 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:13 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x109182, 0x0)
setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x6, 0x1, 0x7, 0x6, 0x4c}, 0xc)

14:56:13 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  447.242217] binder: BINDER_SET_CONTEXT_MGR already set
[  447.247877] binder: 15647:15672 ioctl 40046207 0 returned -16
[  447.254704] binder: 15647:15674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:13 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_proto_private(r0, 0x3, &(0x7f0000000000)="c11fd4428b555007ed41b593270861706f0398097e18bc2f188a686a9744dd372c85019b3e4b")

14:56:13 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xff000000000000, 0x0, &(0x7f00000001c0)})

14:56:13 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x4c00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:13 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:13 executing program 2:
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80800, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x8c, r1, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xb9f}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7f}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x300}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffffffffffc}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1ff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x40000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000300)={0x1})
sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x0, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000003c0)={<r4=>0xffffffffffffffff}, 0x13f, 0x100d}}, 0x20)
write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000440)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x1, @local, 0x8}, r4}}, 0x30)
ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000340)=""/61)

[  447.596036] binder: 15685:15687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:13 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="14a4f276d04661940000000c000000542a3bf1819965c4b143abdeb06d0000000000"], 0x14}}, 0x3)
r1 = socket$kcm(0x29, 0x2, 0x0)
r2 = fcntl$getown(r0, 0x9)
fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r3, r4}, 0xc)
r5 = accept(r0, &(0x7f0000000040)=@pppol2tpin6, &(0x7f00000000c0)=0x80)
setsockopt$inet_MCAST_LEAVE_GROUP(r5, 0x0, 0x2d, &(0x7f0000000240)={0x0, {{0x2, 0x4e24, @remote}}}, 0x88)

14:56:13 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r1 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r1, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:13 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r1 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r1, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000000))
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:14 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x38000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x900}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000002800290800000000000000c39393c21651c938ec1436c104ea71000c000000"], 0x14}}, 0x0)

[  448.372710] binder: BINDER_SET_CONTEXT_MGR already set
[  448.389779] binder: 15685:15723 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  448.397885] binder: 15685:15722 ioctl 40046207 0 returned -16
14:56:14 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x8000a0ffffffff, 0x0, &(0x7f00000001c0)})

14:56:14 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000000)=0x1, 0x4)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  448.673986] binder: 15729:15731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:14 executing program 2:
r0 = msgget$private(0x0, 0x200)
msgctl$IPC_INFO(r0, 0x3, &(0x7f0000000240)=""/190)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xd3, 0x402201)
connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffc1, {0x9, 0x0, 0x7, 0x3, 0x8, 0x6}, 0x1, 0x80}, 0xe)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000028004d6b57610008000000000c000000"], 0x14}}, 0x0)

14:56:14 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:14 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80, 0x0)
getsockopt$inet6_tcp_buf(r1, 0x6, 0x1d, &(0x7f0000000040)=""/105, &(0x7f0000000140)=0x69)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:15 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:15 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xffffff80}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:15 executing program 2:
socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:15 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  449.293743] audit: type=1400 audit(1539442575.276:75): avc:  denied  { create } for  pid=15756 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1
14:56:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$inet(0x2, 0x80007, 0x2, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000140)={0x7, 0x0, 0x7, 0x40, 0x1000}, 0x14)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000001c0)={0x10, 0x34003, 0x0, 0xfffffffffffffffd}, 0xfffffe3c, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000200029080000db53761bec4000000000"], 0x14}}, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x1000000802})
ioctl$TUNSETOFFLOAD(r2, 0x400454d0, 0x100000000000b)
r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x20000, 0x0)
openat(r3, &(0x7f0000000040)='./file0\x00', 0x40000, 0x4)

[  449.463189] binder: BINDER_SET_CONTEXT_MGR already set
[  449.508710] binder: 15729:15765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  449.517319] binder: 15729:15764 ioctl 40046207 0 returned -16
14:56:15 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x400300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:15 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xa0008000, 0x0, &(0x7f00000001c0)})

14:56:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000002c00290800000000000000000c000000"], 0x14}}, 0x0)

[  449.629187] binder: 15775:15777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:15 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x400300}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:15 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0)
setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x5, 0x4)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:15 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x240000, 0x0)
ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000040)=0x5)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:16 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x80ffffff}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:16 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r0 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r0, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r1 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r1, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:16 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xffffff80}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000240)=[@in6={0xa, 0x4e22, 0x7, @local, 0x7}, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e24, @rand_addr=0x6}, @in6={0xa, 0x4e21, 0x1, @empty, 0xe4}, @in={0x2, 0x4e21, @local}, @in6={0xa, 0x4e22, 0x8, @empty, 0x7619}, @in6={0xa, 0x4e21, 0xffffffff, @mcast1, 0x401}], 0xb0)
syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x80)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000080)=0xe9b, 0x4)

14:56:16 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  450.454944] binder: BINDER_SET_CONTEXT_MGR already set
[  450.479739] binder: 15775:15820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  450.487870] binder: 15775:15819 ioctl 40046207 0 returned -16
14:56:16 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xffffff7f, 0x0, &(0x7f00000001c0)})

14:56:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2000, 0x0)
getsockopt$inet_dccp_int(r1, 0x21, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000028002908000000007f7c07a0aec9757b"], 0x14}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
flistxattr(r2, &(0x7f0000000140)=""/51, 0x33)

14:56:16 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r0 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r0, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r1 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r1, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:16 executing program 2:
r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000300)={<r1=>0x0, @in6={{0xa, 0x4e22, 0x3, @ipv4={[], [], @multicast2}, 0x100000001}}, 0xfffffffffffffffd, 0x3ff, 0xf0, 0x100}, &(0x7f00000003c0)=0x98)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000400)={r1, @in={{0x2, 0x4e22, @multicast1}}, [0x7fff, 0x86de, 0x3f, 0xfffffffffffff7f3, 0x8001, 0x7fffffff, 0x7fffffff, 0xffffffffffffffff, 0x100000001, 0x0, 0x9, 0x100, 0x1, 0xc96d, 0x5]}, &(0x7f0000000500)=0x100)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00')
io_setup(0x80, &(0x7f0000000000)=<r3=>0x0)
r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x400, 0x0)
io_cancel(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x3, 0x6, r2, &(0x7f0000000040)="d34df5c2c2914daedad031471e2507650590c43ee028c468cc668425fdde5d86ae5aa363e73f0b6421d056484e9533eb26d4bb0eeac28bc7781884139eacd20fabe5eaac5dabc581248286071c7c5f39d5ea315b1d2055b30dc014bb33eb40fc3cef5056699ebb95f2ac5d035f7db38756d5343d90fea3f3d0454b0368c6", 0x7e, 0x3f0, 0x0, 0x2, r4}, &(0x7f0000000240))
io_cancel(r3, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x6, r4, &(0x7f0000000540)="34b531bf287a574310f34d75d7185ab68108e09e5846f62d0e55780a8afa07edb39dd8bc0d0510e98b55f87c746f687e7bb109c887eeff53cb23c3424974619f96573ddab9ae076cac3b33daf55333cfc27bb184980668a6f972549a0dd55317c8c3d7123eac9e6568746fd338fe6f0b573f23719a34661a2e1dc9b957517a169687d0fae6a8b933b3c587ab12eb8372e50bcc7ff14f13606cb146a67d97c72baed7e0820e56c9099da05f1e89a4176df621296a070396b4", 0xb8, 0x9, 0x0, 0x0, r4}, &(0x7f0000000640))
ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000680))
sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000002800290800000000000000080c000000"], 0x14}}, 0x0)

[  450.858809] binder: 15823:15827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:17 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2500}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:17 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:17 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:17 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000500)={0x2b8, 0x28, 0x829, 0x0, 0x0, {0xc}, [@nested={0xb8, 0x4e, [@generic="42e16794368ab0ab028079384f3ae00ed2428e7eaa64c45660a5f7f6c9948517dbab966552508baab61213b76e831dbb2a4fffb296a76fa205163bccc52c010417d0e04082a27f1a8b6070e867f3efbd47371a7aa0f7f6709bf811439e711f5a70eb78774f0a891dd382983916a8fe5dd64af7c8cca1b0362e3f2f39da6e3aa636f716476b532157808f6f45f83f9f4df15f01eedc2dd99cba3ffad519bf93b659d5585288c4047a5c9b1bece0634fd10b6f"]}, @typed={0x8, 0x7f, @ipv4=@multicast1}, @generic="ad1715b6ec142d3d6510288e755eb0d2d604b78c494aa26b7c62e341ee433a", @nested={0x10, 0x69, [@typed={0xc, 0x83, @u64=0x13}]}, @generic="87c92188d70a86841211a244bed05f124c1c6c0c397a3ad8b6a4bcf4d7ed2416799a255748f4ccc42fa12d2688ebc017bea2400882fef529c657dc44c35271335c5e5a9b84f3afb3d8e7218b071a60cf1c64033ddd1df9f733c9e72e859421ae7645dc5dd2b303a0fe1707ad0daf3a765f2cbc1503766ca22c6d71637ed4c2bdd20441c0b36deb0f5124bfcfe12658323e0f", @nested={0x120, 0x7e, [@generic="d4f4584b7d4b09292ba2e9db765e45ac554ec30781c318135fda1d17a1c6ea649ad29975d59be7cffb0d3f4987d78ad5c320934db71a9fc5a68a6950fae98054", @generic, @typed={0x14, 0x85, @ipv6=@local}, @generic="06b28978a0c17b355fef5b1804db98398f4991e4adc8a353d8f6b30c48ab949e544812d8ea6bf23659b720dc85fc0ee92c9f7b630384d77815c34698ef5b1a37a2042c5bdea97482f44192eaa0c22050da9c1139862d5e9bfba5d9e102f6776bfd3ae67a728a720c48b6c9c6ad0c6b614d069ecff7cf3cd99a5d1eb83640242fef7e2b97b3c1d5e38d96b211d1059a1b572386aa888e474dc2d3c3b4097f79d0e6bc", @typed={0x8, 0x36, @str='+}\x00'}, @typed={0x14, 0x26, @ipv6=@loopback}, @typed={0x8, 0x70, @fd=r0}]}]}, 0x2b8}}, 0x0)
poll(&(0x7f0000000000)=[{r0, 0x111}, {r0, 0x1}, {r0, 0x20}, {r0, 0x21}], 0x4, 0x4c14)

[  451.331374] netlink: 484 bytes leftover after parsing attributes in process `syz-executor2'.
[  451.392224] netlink: 484 bytes leftover after parsing attributes in process `syz-executor2'.
14:56:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffe, 0x220000)
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e22, 0x1f, @dev={0xfe, 0x80, [], 0x15}, 0xdd50}, {0xa, 0x4e20, 0x2, @ipv4={[], [], @broadcast}, 0x8c}, 0x4000000000000, [0x6, 0x4, 0x7fffffff, 0x0, 0x9, 0x5, 0xfffffffffffffffa, 0x7]}, 0x5c)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  451.623996] binder: BINDER_SET_CONTEXT_MGR already set
[  451.658617] binder: 15823:15856 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  451.666530] binder: 15823:15855 ioctl 40046207 0 returned -16
14:56:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x70bd26, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:17 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6000, 0x0, &(0x7f00000001c0)})

14:56:17 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:18 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1f4}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:18 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:18 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0xfd, 0x0, [0x0, 0x3a9, 0x80000000, 0x4]})
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  452.138133] binder: 15866:15868 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x7fffffff)
r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x101800)
statx(r1, &(0x7f0000000080)='./file0\x00', 0x800, 0x22c, &(0x7f0000000240))

14:56:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x6, 0x4)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:18 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={<r1=>r0})
setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000040)=0x2, 0x4)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  452.942230] binder: 15866:15894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  452.950025] binder: BINDER_SET_CONTEXT_MGR already set
[  453.003625] binder: 15866:15891 ioctl 40046207 0 returned -16
14:56:19 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x2, 0x0, &(0x7f00000001c0)})

14:56:19 executing program 1:
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x20000801)
r1 = memfd_create(&(0x7f0000000000)='vmnet1trustedcgroup\\selinux\x00', 0x1)
write$P9_RREADLINK(r1, &(0x7f0000000040)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10)

14:56:19 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x40000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  453.110152] binder: 15901:15902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:19 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2500}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0)

14:56:19 executing program 1:
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:19 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xf401000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="aac5c7c9c2feb5dbd454170000"], 0x14}}, 0x0)

14:56:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00')
sendmsg$FOU_CMD_DEL(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="020026bd7000fedbdf2502760000220002000a000000bbe7ddc0f80e6f59228009e60800040003000000"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x20000004)

14:56:19 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2700000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:19 executing program 1:
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  453.945970] binder: BINDER_SET_CONTEXT_MGR already set
[  453.976622] binder: 15901:15938 ioctl 40046207 0 returned -16
[  453.990883] binder: 15901:15939 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:20 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x5, 0x0, &(0x7f00000001c0)})

14:56:20 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x3, {0xc}}, 0x28}}, 0x40000)

14:56:20 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  454.170620] binder: 15948:15950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r1 = getuid()
sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xbd8c49dfd4a10552}, 0xc, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="880300001c00100027bd7000fbdbdf25190000006a623d872dad69d605403bae18fb79fff4cc2659fc9120daf86a36ae74ba501202ef4e6cbae08be28230bc43e14cb4edaa34a04b81f03c08d2e4fedd9d5064202cab8fbad107107796f84ad9440bfb098e3c77a653a9420155499c078381a184fb8b10e06135b56913c34131a88a6caf16792e8add365f2302feabcbea40d729e5ca4bd4cb518d0804908016cae9310f2ba0f61247f538565dbe3e1ac2cf06c4ba4f2af48042cb3d15bf46ff46fd695b94915997bf0762de237e8ac37fcd245ceca25132a7443a46d6f0b8280d3ee825bd6d27f58124a7a62e16a466e72108924b16cfd105dc7006f5d0723bde0b4ad544f931e72c2e125aeb367d6506af197998a6b4343aca5b78a69d6c6e8ee4f9420ab5376ffa79231779c191eced805044234d16afbfbe54d568e6dce9c87587a69f3d630ba2f3466048573ebaeac53a04ae6c2c65c027c9108ac7976dbb85df1bf9df0f19a6161b72cb3d0850a581b6256beb6258a0e1e90c0013000700000000000000a888477b9462d49e615d66d6be1f5ff2d8c2251041237bfff459f29a4b4ca171c8b26ec6583492977a6e0a77dafc269739007b72a4fc1b4263925aaf656ac8be94508a0152f4a02e0171d1183fecdfc96f6d33d6660b4968df1f6b3cb958d5249979cad7ebb89771c5b0fd654f474df2648135c2e329524c79b7ae60f0988717d85795f1a7fac732b205f13f5785509263d1140062000000000000000000000000000000000008000f00", @ANYRES32=r1, @ANYBLOB="e2b1517538884cb6b7f30a7f49d7c14115348becb2abc590df447a5be398b45349b2d7d973b050a85ecdd70b5afeff9a8bbbdcb7624dd71ec36749a749e61fe751ca8ac6b7084572a80f21fc0c3d500a1898e182f6316664a19bcc7d7cfc45e262c673f53d3425c803201f51996fa8a21d3d8f2926453dedb335d1fb696a3144967ab6d4ae785494ab39eb24b00bcc24992e1bbaa2ff6d300dfba39948c3c328abf9671fbc3a17cc232b0c38d1f41b3d97abb3b0455cbb30561e3330ad74404ad8ecef82abafa9b8bae954c20e8668b43488727d335346ccbb83eb75b0de865dd6c1f08538535ff1b9472af1ba637310ee9557a8d59ea29bce453d7dfa4e6ebfe9ec44cfdb695dc17f32a419496b11c8f6dc1fa95549030ad9504eb331470b05fd2890b70f65243dab430fc6c6ad34e8553e79606921f7748c3f95c85a1231594825f032d160ce1c8017435f42fecb8b1c0000"], 0x388}, 0x1, 0x0, 0x0, 0x20000040}, 0x4)

14:56:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x62}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x114, r1, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x33}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2e}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1c, 0x10}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6a}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x1}}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x20000000}, 0x40011)

14:56:20 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xbfffffff00000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, <r1=>0x0}, &(0x7f0000000140)=0xc)
fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000001e80)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000001ec0)=0x6, 0x4)
setreuid(r1, r2)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10000, 0x0)
ioctl$UI_GET_VERSION(r4, 0x8004552d, &(0x7f0000000040))
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000002800290811d86a6d3069314f8631859c0c2e49c0e3bf19a00d8ad622e2b73231b8bf99931ffd73346c0046e290fc3d575c73754cd69d99b8cf0f4ec9ceffe8ea18c17a0b2f145d7c93195021ea2e110238d6929322eedf0851748da2b7eec4ae7c378426a07f2bb81171ae6f7a4a496e3f0e6b9362c364ad1006e9f713a79072cff1041b7035f39c426e7d3da4aff1c6c2a6f6248a7408dedd33d2705add55f88a68009b17d8c559b9fe6c504843fbeccee82ce2d5a9f49e30e7383de48e037353bc461ee34e54a443949a9bf5c39f541cdd6896c02141b5aa6e31e0cb8f03206d2671c30ac26af050a231fd7e1310075386d88457a73f605da0d36ca12677f59da25dda1450007c6e7714"], 0x14}}, 0x0)
sendmsg$nl_generic(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000680)={0x3c0, 0x3e, 0x110, 0x70bd29, 0x25dfdbfc, {0x3ff}, [@typed={0x8, 0x4e, @ipv4}, @generic="d2cd08ecfbe26b3cfdbb42f9", @typed={0x8, 0x42, @fd=r4}, @typed={0x8, 0x54, @ipv4=@loopback}, @typed={0xc, 0x8a, @u64}, @nested={0x2d0, 0x2d, [@generic="1d9d77e9af4bea914efa2180faa07b69ecfd5fe8d463fcca5364fc23b4b87c2f432155225c496b2875a5918879852a43513029289825f1971ba44eaaf9ac4451bfa55b6182a53d801637fd2638cc2cb0bc1778ede3c250ae93bd202a1051924d44c332dc7385", @generic="994dd5294049d4b0207f2147b635bac55043c53147012b34d2c88c64e43cf283cfa3c08e6aa302cc6e2b7db7a044f8fad15930c4310ffe7a782092cbfbabf539f9084322762cec5b902aaa4c51a5c4d62a1dbc298cfc49502e14d41fd85513e7ce5db5270e8abdbcc59042113eb29997ef1b4f92adc0c60564a786efbd0d01355478efdd4dbc7b03dcd5d73fa1a380cf09de810292bb984905e3e23943a4217108b048d0218143788f24acfbeffb733b7b1b9aaada9962470ce3b284aaf078447c", @generic="9be7f11a5e9d37a33ea55d39bf994a9dab1fca14f984f81cf6ef0b53d11f9a97f44566d4704581e259525ad48a0353e1bdf81070976105c7cb5e8379fdb13f132096406efa1e35650bff53b9ed9f5cb395f5e1440aa9574911d3f01e568775fe52f2490b023b1da8facc62ed7130dc591d37db7267de5f2cae453c69a8aa269c70f6a678457af70dcf73fad3d013ddf99463e8bf6bd2f7e8f36e6594cc6a60a2e38bdb759a247bd26cac32f0e5b7d1349f65f00a5c485e15b05b2efa3d4b4dc3794f738cdf3136e19cb40a1daa8ec239f4ff58077d41ee3f1feac92a38752460", @typed={0x8, 0x7d, @fd=r4}, @generic="041e0f32307ec9f8e86f1de65797651d93197e5a6fc207cc33e9dfd2c00d04f6846694fd6c6e82e636461d1fcd2c21a5233188bab3dc41df878115d50ecb505b62034b5af5cdcdeaa054f60bfef45c27e50dcf803668c395b1e7762066f79050da61c31c7b7ed03375f84a7618e2ddd846126d33417c3ba9ee946d00802142a4b2ee6763bdc2e57ae39aeb9868a886cef3f2ea55c2217d5dd8f98ad3ba772ebd3b69aa22ee7df84e349321a53c1e436814083f8c1aad1dae33b5d7919b"]}, @nested={0xac, 0x57, [@generic="a6463bd7a2315e35da00fe5aa85600546e0f7ed378caecac71fc328c92ee0426edb03966e15be931278e3fe4e4c0f347f49eb15db2e4c41dafaef9f26b4ea187bf7a64c68b7ac9ae52446f316390d78a6d7905582c22f7c1054a2dcf09028761cfaf0ec97ffa613c6b3c0e1103b53f259e225fe7baef29146bf4f78062518f325da5304c94d3f127f756e4c840261b6f91b5d8", @typed={0x14, 0x93, @ipv6=@local}]}]}, 0x3c0}, 0x1, 0x0, 0x0, 0x400c000}, 0x40040)
clock_gettime(0x0, &(0x7f0000000480)={<r5=>0x0, <r6=>0x0})
ioctl$TIOCGPTPEER(r3, 0x5441, 0x0)
socket$inet(0x2, 0xa, 0x4)
utimes(&(0x7f0000000300)='./file0\x00', &(0x7f00000004c0)={{r5, r6/1000+30000}, {0x0, 0x2710}})

14:56:20 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  454.682861] audit: type=1400 audit(1539442580.666:76): avc:  denied  { getopt } for  pid=15969 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  454.685386] syz-executor2 uses obsolete (PF_INET,SOCK_PACKET)
14:56:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000000), &(0x7f0000000040)=0x40)
sched_yield()

14:56:20 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:20 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  454.954451] binder: BINDER_SET_CONTEXT_MGR already set
[  454.961725] binder: 15948:15986 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  454.976520] binder: 15948:15985 ioctl 40046207 0 returned -16
14:56:21 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xff00, 0x0, &(0x7f00000001c0)})

14:56:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/load\x00', 0x2, 0x0)
openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/load\x00', 0x2, 0x0)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x0, 0x0)
ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r1, 0x4010ae74, &(0x7f0000000140)={0x0, 0x4, 0x6000000})
socket$bt_hidp(0x1f, 0x3, 0x6)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1400060000000800000000000000801000000000b60008000000000000c3c9b836085ecd23d731f25cccb80128f8e6e7e1da2700802408a30e228777a22aab5cf8"], 0x14}}, 0x0)

14:56:21 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  455.111109] Unknown ioctl 1074835060
[  455.136261] Unknown ioctl 1074835060
14:56:21 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  455.219469] binder: 15991:15997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x1}}, 0x0)
r1 = accept(r0, &(0x7f0000000040), &(0x7f0000000140)=0x80)
ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f00000001c0)={0x7})

14:56:21 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x4000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:21 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x5}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0xa}}, 0x0)

14:56:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4000)
ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000040))
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:21 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:21 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
r2 = gettid()
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0x0, &(0x7f0000000100)={&(0x7f0000002840)={0x12, 0x28, 0x829, 0x0, 0x0, {0x1000000004}, [@nested={0x0, 0xf, [@typed={0x0, 0x46, @uid=r1}]}, @nested={0x0, 0x82, [@generic="2f036cd4ca014b6ae26faac4f6d51d193e42b7600df3fb0a02e297563a53565ddcfb267a35aae17a87b80c9418c334437222e3c518160d049e26d0ee3b2180c1ea8894f645aa8a1042c17dfe8548ecaf686b31e84e26306de977593a6fd7127c920874959966f4d28f857422fc893cd6c8dc38f7fb0c7f7a3a052ee877e02af5330ffeb1f67a61346f23d1844f153acf6deb4bf271207ef17c61f560742c6c0bab1666f34b73aab9aa1305849eb9dbe3fad90a632770b367367accfd9e708cfcab4705bded03d835b42b5eee427b60f9b3689376de68e7d83e06668e67bf4df641cc8cf6f108ffd97851c5"]}, @nested={0x0, 0x25, [@generic="949b6e54e2f44f0d95dec37169ad478d92bc47f4d97658b83d1e4f96839283fb0b9d5a85e934c952ca3f110e1680fcc70703c8b4ce9db2769550f1f553d1d3d5a6ec845a8728acf51e53010a378ba759fa8cc2499fd4e9bb8b6c26ba6b20cdba560e0ff1f909acc985cbdf61c629040a46444d2c599918b8de5c41aac8d3692952f5c5270996a7f8327b1b2ee1f986ab16995536151e44b0b97565b8357ea4621dc190db4cbdb35f28b1abb222265b63cc6f1ac3cc302ea8646cb172a9f813791c7caea01115e16617a8110f5edc13f84a8e7396948fc323a26698f00c56074a7dbea505ccbaa8d474c1bc913465336d257082589048d5cfc3de77fd02bbfea81aa7b74cd281c872550a9e791718a6e3950d96f029030a325c04ec3b29804185bc0159a487e15893644f02bdb7d1939f3d9e77d7f5d772267c75d0651e5c8c662f571a96272512f6c67879f3a87b84f6ddcbd5c0fb9fa9705ba15dafeaa9bc2e3827beb635cfd75690566d71254d90787e4de32d0b374b632a92bfdb6cc80c9b608198a38935943e33130622244f8b76be6bb9fa6a7bb98bbe4a9229338020569951bad5f7ffa6d8a7ff1fefc8773f2261a30a7c8bb528e54777d8dc200b9eb59d3c472c405e38a23dfed2a544387d879c1906eb77daf11a5e12b4908a99e142e0c26f9d8cc79fc1d498e1fa247c79d9cfcdd3dfd439a5f4c7e5e23b83b1c728cd9a9dee643c5f3cc30e5221b6accf042db961922fcc5bd2d67c7b52e04e9373e1347e23edd54a0fef4a07c471deaca073fe7db99e3a49ec0943b8ea96f5d7f92da55ec4cd36a4fe1d6e7ecf3e96ae516fc711c1a5544dfd1c6957fd3335e418924b1fb8b54bad3f4e1f13c75d31374eea7f1b982d8d881575dfedf003a9499b15d9d2cc61d58a16a33ba1d55b6990139f283666413cac298f25085af3f825326242c541231671d7dfbf55c9b4dbda1ae35c9b5aaae1bb3245cdb98a0f9632963070940485387faeb026d99e052416e5faeb68a1c5581716ff7fa89a79ae62d07c61410f821fd324957a41968a1044f8dc35f884bcd078593739511678c9de979a60a8209d8898cea573980562df149398e85d691e92e5c4a87481fb1ac926ec80db5a72a81133727ae78bd92ff446de0255ca13b2b0f8ed75883a141b78282a5e19034a73470fbdaec6d5ed50c963fd6ab0feef0da30667dc946b808b3c3fc8f82713e3426dc6a208bae26f15da197a26293c49bbbf7d09433a5b3c489eb7f4504424a2798521ec65789da4c29748873a8cb0c8a3d3fb078b74a0bf32e8d0bf6bbabe5e8c533373a20818b1d577ef02fd3802c1e0cc86cd793c6f3f7370091242a212d12a81374b89b23edfd89f0eb1e3139da03bd19ca9416f02456711c07667928ff2d75a974b2a06a1cde90524203b355cab8b3baa916e28a37417aa67de4a970bef8363a81f585629198eb7eb3f3ba5dc34d6c66de0467e4fb9100095b2d0e0149dc7573523c27b1ac6349851c20686c7d14d9a2b92842f781672103727a071f256db5272cd8556825f909551f8f732f9d883193bd6a39001589e17f23197079f632b6ce0ca762eb5222d5b416d8159b943b09d409c1e830dc3bea94dfaaea44c291e06ce6c544bffcc1bf53e2bf2cefdc2ddc3712a2f1e62339a9991762c98517eff48d218750a44de56e0393f877c7b64b2d9504fdcfa054ce6ba90814d1cf0b70c8e0cd5ec8d04cc71aabff4925e3a3f5eb297ad2a76a34289223a238ab6e0fe75c6e73fe4e3455daef725609f9df9d02f83842670336094c50f37876201767fc2fc138a51c3f1584ff1c54b3ae6f2b5d03e96eeec12e138afc14d1bb0cfa9616c55741e061f1c54dd27e68f9d3881daf5df6e34a26a1593749669ce24479549f020bec10dc6c50226b709145c98f6af2653aba907d76dfb286e2dec589f5296601ce8e1493c956338b2ab8a19f471bef61131883ef72ad0eb5448c148dbcc6255e30fba84aa5d3cb704874f5078b8ffd917f344f58e601a44431f9d44f618710aec801ff0050bb2fcfd97fb272b875e2206afaface18bcf1b96a932679b60bed1787b590abf691b27ff34b6aa8966ab778998500f47c94c6a289e1038b601b4c4809ffd25c81a65d9d1a974b03a7e84d270cd72b384a278457eb7901a5efb862362f7272f88e5360cb41135bf65c2574c49c98cc6c00365c9590307ed4db71d36088a1fa02bf2bad8be72312f4d6fe53208feb68e096483669e9e4d212c2b58358c2a983b4338ff9898b7a50480f220849bb22ce9b13addac8e9654ac67887a12cf73040030f0fcb313ae689134d3295dcdfc2e5f98f5a664cd657b6b2e9238152b34f30459bd5e683d164e480fad1afc807694eafcc0d04def2b27c142cf93514ce4799b78eef0af963c16cf3dce9c8b45c324b0f25da9c9ef2e2e02c68eb3cb02d026de6203b82b5c032a8c21de105c12159add188327c474fae25bf6b384b246f6ec9c0e14e442a95391df3679de7736aacf1b87fbb4ff6a48d60d01b97ecca589437df763f9587fbe3e0d96c2ae5f74b2d42135d5ccf09d355f52af1dcfe6581eb619cb8c7410894e9666288c16cfceb6b595446d7bdc12e1fce70f4ce5ab1a47e299d366127b8bfe3deb1bfd5adcb9b39acc9cd8fd0fd01f1aa67bffb51d972503efdb098ace72d9d13a9e1c59b9a8bd5f16e269a0be002f5e373a96407ed2eb034d7bedd3ce4a5c02b4ec0887178460d65e1aec31f5d10b3b95de589e3aba42835ab0ffe788570388c0b7f1f6e6fdf5ec500973175fdc8294b622d42eb973270d614655955c747a4723748484c4fc8b0f1e0833ef0c741e4c06588334f46ccc9a453b543a2c4cc44a5b14f68c9ca58bec7bfc29582861469887f8a883cbf8559bd4273af8b296666f019560db857c54362408c77e9001b125d96d559426dbcebc938a50fccb2454e0e9b85b94597ea82efee318f79dae9a874d67dc51966fccdb7db0aa464c8687923766931f55788dfb673c4cac91321c189be6a121bdd3e1e323b1d2e4b12105de7f69d24bfee724ecc3f241d3e4d27ac61ef1bb536143c75e8b089c415e30325eaca71fc9487d887a0cb1ff54716c987e2fdf453e14421c9b1a961985caad760fbc88fedd39ece72c34958dab761eabafef493204c65a01f61c4006262b0d4414c98a4b31fcb6a186a556edb963c1efe575b5ac9aaff9f08f68db679b2c23c2665cb4727fb56a01b697060ba12a5873858d2aa747d8811e26646aecd9ee657716d6559533c98f1c058d32d003e7e1c568358f482bdd56a2329927c0f3db942c3d46b87eb1a63c76abd417b11571c607b0d79c3d0dda4f6b453d12c85aa1f14079bec6465387403ee7637865a9b1955c9593f0e560c4dfbc0af3cb35a42c4f712aaf5e9401956fa70218f87dc382e780578e9c39b9a41d9d3eb75067515c3268e0efaa088b2218f85da3f8847954402d196df98ccbe39060214d73c47adf6fa9839a2d3a21f8c8dce838f2932955e9c71d8abb3d1c755eefd6083e205b1e4fefe54e0ca2ebac84ba18d886e1c4275a6c7c4f60caca03e8baee029329bb04c0c4a3d17e3dc41e10cf4ea9550d5d6d375e5844b552ad3af7ee5c6696ed94f82de0343d7f208e44ce6d6e30d8814bb671fa2e38aa844ea6f09c7d4be2c72c786129e9dcba140d286866c03bcc16cd67f9e03396c9ec721e73d7bce62951de61351162c4cd29d9b3653ce741666af1bbe88ac771664a124bdcdc120e9e71174017045e2af3cc6adc1915e012bb4ac6a6dd744a9804f3bbdc632c3b8c69f549e8d6c86a10ea3192384d4b9b21cf470500f6bab547cbfc9efaeef4750d4d3ed0ffdcd364800119e244708cc75e9a2055acfc88456a3b4ef7f5d9abff9a0ad7454a5bc846865d073c03994ab3c94911042d98160ed70a5f042f74e2452175c740f55ab819246e2912478c62c79f01e79b279c3ff48316bd52063bace9e5c3dad70ae4471ae043928b9a212322f1f44264b3a4ddd07e7083e6e846c58aaf37ffac59fb85c3b884dc8105477742d4399c2bee67469e9f8955c30618f8ce9ca26743f02a603de70949a1dd1f2a6ec2f2cb7c36d5bb9e8d6b15025ad18ca1512d3f595633fe601d069914a168e26944dfa159f906803aee731fa9c07f4bae08d3af255ad31bbb0316b699f8530f00523e7e660fef86a0074df80be2a49288adea29e9f64070787c8e1f83df39d657ee73f7f0655c7166556561ddc2007b7f92943f4da41d2637a4fe3ce3669ddbc3f717cd592dcbb357e3bf16ac59a1d80203319a6e37967905b8df95821c27d1863da5ef1b8122732612b1390da3a7aeb03a647bc70bd11fd921be38b51ae324e4dc79ec30c1d101d1d61e5f08ea89f82b60114f60b3a2892bdc215b306aa25e9e1091fb2707c678d424824ee06abf3679d5fef4a0ebb20b181ddd4e74d4d667a124aaffd57a4f82a4f23ab68399cb7b9104b086c4a9160af91eadf95ad1c740bd79d379f5cb5061370ba2553f043de62e4c0c0c19ba22ef5df502814712263f867b1ea1171f3b06b185f089d40dcf0ff52aa41ce09c21524a6d3126ab711e8bd3ef18dbe5d18107e1dec6a06b60bb4be5f5608b37076abb9c5a21d03df7d7e08d3bdc5ae52a1968be3c97ba194793d9682cec60b530f635c34114524ff9a53cfad14b369a65f14bc1d0b57d9070119ddfd37c76eef75486f4282b947e7e2f6e0c4b5bb928c4931689146fb52e8ec5e2beefb4be368b8918882ede5a63a2343dc27572167df9cab161353c258ba44de77f14d7d1f081c0df9c434e95956ccd86d67bbd991c3c2aa68f2fda2f55b081c04c65ff810ab9c16a63e785c550a4bdee6d854614396886e68869a294e2a09652eff47980d3f1511419bbe7235a877b7fbb67e837fa8101c18fe74ac687600af5dc29e26292417f78eebbce9267f4373dd2e8f52153b557c0dfb58333807dfdbfdd012e723218d0e125e777da42d3422590c497b9843e88a4a90f7acb91bd4286e861ea02b5b946d56cd5f230b36c56942ca6ab5370a5b6963d113a2034f38c2eeae4fb342ddad569c74ff0385dc946688c53cb6cdb4b69badb5a8909567ef9af01a08aa85e46eacbba8851531ccc6a89dad6bc0dec013fe1fc48458ab4047a3741f30fe04d1372cf6940cbbe42b376d4252503f35213f5e7f14e7d5b393c1b7ec13af685a4ed5b04c84d68904938d4659cc5522f43dcba934181478dafda9de94e7fd4a6c8dcf2b2c2a9c5d2ff85ff356280f0a088996926389c0ac78e19bdf555b95c8923ac8c1ade6c35bf9a5ec7ac1a8629b8dde1c4236a2872522b3270c841826eb9ca69c051de8cafdd0548bdbb39b07b243e837907ecc73db7df80ba71729cd0b174a62de599ab90c2deb8fcc90207020221f0c0f85a5c5fc63d827c4cbed1c38bef91f700036e37e692527e601d03c0e006afe2b6478ef05b9918152b5eedde037446060515fd2ac7002e5e87eadefb70d378afa90752426a9bafa6d2b5c737723ee2370223119a94845a4174088c2aa9453e5e33a01fbe5c2e535155a8a19bf2eaa799e90f1de2fbda68ab27c91df31f493804e4193703971e0f1b9354508488bbcdf442c21fdcab2fe4185f5ec095529f928d53e7ffcf51774d6c7f493a52e1224878056a87329f345ba09370135378c54e531c4ab99b8b6f1b1e1412190833719f4c280befeec2f7e820dd4d8897a822515049bb8021927e9c9aadafb2314f158f9793c3d3eb973e5b0075d95ad4ca327667bdcc", @generic="22e9aed8f3e5699444a168afb328eec6bb75c04e34b3f216", @typed={0x0, 0x6d, @uid=r1}, @typed={0x0, 0x88, @ipv4=@multicast2}, @typed={0x0, 0x5b, @fd=r0}, @typed={0x0, 0x5, @str='keyringem0\x00'}, @typed={0x0, 0x7e, @u64=0x101}, @typed={0x0, 0x1f, @str='\x00'}]}, @typed={0x0, 0x18, @u64=0x7}, @typed={0x0, 0x4e}, @nested={0x0, 0x32, [@typed={0x0, 0x1d, @pid=r2}, @generic="87652d113fcaf9013d00b8158dc901170c468be9eae8ee79e45f73ca1343d2ec821de048d18286d9e769ee33162cd2cbbb99ffd236c06b62bb14bb"]}, @typed={0x0, 0x5e, @ipv6=@local}]}, 0xa9}}, 0x0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00')
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2100880}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x2c, r3, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004010}, 0x20000000)

[  455.997891] binder: BINDER_SET_CONTEXT_MGR already set
[  456.041407] binder: 15991:16025 ioctl 40046207 0 returned -16
[  456.041520] binder: 15991:16028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:22 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4800, 0x0, &(0x7f00000001c0)})

14:56:22 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:22 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x4000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = accept4(r0, &(0x7f0000000040)=@vsock={0x28, 0x0, 0x0, @reserved}, &(0x7f0000000140)=0x80, 0x80800)
setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f00000001c0)=0x100000000, 0xfffffffffffffea3)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="141000002800290800000000000000000c000000"], 0x14}}, 0x0)
ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000))

[  456.217670] binder: 16041:16043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2c0001, 0x0)
ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000040)=0x20001)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000140)={<r2=>0x0, 0x8d2}, &(0x7f00000001c0)=0xfffffffffffffe03)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000240)={r2, 0xfc4e}, 0x8)
ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000080)={'bridge_slave_0\x00', 0x20})
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:22 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x5}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0x8}}, 0x14}}, 0x0)
r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7f, 0x81)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x280}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x64, r2, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x80000000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x101}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x4}, 0x40)

14:56:22 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="14fe716a280229080000003900003e467571363b"], 0x14}}, 0x0)

14:56:22 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
ftruncate(r0, 0xff)

14:56:22 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  457.063301] binder: BINDER_SET_CONTEXT_MGR already set
[  457.105956] binder: 16041:16075 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  457.122538] binder: 16041:16074 ioctl 40046207 0 returned -16
14:56:23 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6c00, 0x0, &(0x7f00000001c0)})

14:56:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$FICLONE(r0, 0x40049409, r0)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:23 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xffffffbf}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:23 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x100)
getsockopt$inet6_int(r1, 0x29, 0x3c, &(0x7f0000000040), &(0x7f0000000080)=0x4)
r2 = add_key(&(0x7f0000000140)='big_key\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9)
keyctl$get_keyring_id(0x0, r2, 0x8)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="145000002800a916f1a11e0c00260bab5483318c8c555a86e500001da5133208f7ec062c06508073487669fd06b937920255fa1cef84359646900f0900e498d4a5fbd2ec5e8a20a92337d6329eba6b58f09c3c565376e2968b65fcf0279435545289e679a009095fdeeaac8094387d7131e217a3ca7876d018a882a764600980dedadd8db35efa47fa4fbae5e3b6df5bb76d4fcb9505097edc31d9bd99eaab73354b762d557ca020edf5f8bf0c213b8a7b713319c41c6eab660115dce28b23dae3cb36efbfe7366444a558abedcc9e308da7b021f0b0c08c9745e130523655439e0095c89d2afe7bf6a231df530275430dd90571478bbcd27c93dbd0f3163779264e6046a8cb01590293577985062a1e21cf65b9138a600000000000"], 0x14}}, 0x0)

[  457.279989] binder: 16083:16086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:23 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:23 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
fdatasync(r0)

14:56:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="14008a4f718f2908000000000000ebff0c000000"], 0x14}}, 0x0)
fcntl$getownex(r0, 0x10, &(0x7f0000000240)={0x0, <r1=>0x0})
syz_open_procfs(r1, &(0x7f0000000040)='attr\x00')

14:56:24 executing program 2:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400008fa59fc6a1d6b028000000000003000000"], 0x14}}, 0x0)

[  458.090787] binder: BINDER_SET_CONTEXT_MGR already set
14:56:24 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x8000a0ffffffff}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  458.121719] binder: 16083:16112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  458.129447] binder: 16083:16111 ioctl 40046207 0 returned -16
14:56:24 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:24 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x4, 0x0, &(0x7f00000001c0)})

14:56:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0xb89, 0x141400)
getpeername$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast2}, &(0x7f0000000080)=0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:24 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xffffffbf}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  458.433424] binder: 16127:16130 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:24 executing program 2:
r0 = request_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x0)
keyctl$read(0xb, r0, &(0x7f00000001c0)=""/103, 0x67)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000002800290800000000000000000c0000009809d1f5293a08baf85937e391f4074c24d8c45001a1c2cc54418b0190dd8c090d9e35c01dccb7c81abc161f05c773614a4cca74ddb4dcf2f7b9be16ca15d95136fc87ff79abfff0c4b13b711070e9f0fb5b05100cee075477e04454ce3fe4a590f8459c92f6e94aa8a3b73d1d5ad6bb62036aa86abd4ca03009516ec1dec3203c5f39dcc553f584ee429af9644733db1717bac804f7a4"], 0x14}}, 0x0)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x7fe, 0x0)
ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6)

14:56:24 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="14424c0000000000000000"], 0x14}}, 0x0)

14:56:25 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:25 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xea01000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:25 executing program 2:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x20000, 0x0)
ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000380)=0x9)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
r2 = dup3(r1, r1, 0x80000)
fchmodat(r2, &(0x7f0000000000)='./file0\x00', 0x2)
setsockopt$inet_buf(r2, 0x0, 0x29, &(0x7f0000000240)="05333c54d97fc41ea16c9f20f5b8fa457a90ec4839a98d6210328d39a2d3e1e73c8c7cd91951d42d26ba3ae50102a3a6296385aa639593236aa86e1742344130c67f6e851d4c98893b171be5632b57cd806771a4acc65bcfa5c18e22af84510741c3e7033bd086508ae519ac4f1525a028d745c7b1d890fc08ba3fc8830fafd259270492d4cf466bbe26a20d94dd83fb7766c57ebac6371a2b04da9dd1c423b2b0076f8ada8733333e978f6dae59c83cb1c27314eed7fd2f9ac39443c0fb28b3ea7420d7ec1b13a74b883747aa8ac89cb8bde06f025bc2627dda81e7014393b5a3fe65366d5757fe0fa4df8eefebbd5dcddc878d1f114dd5bfb8376d91", 0xfd)
r3 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb)
r4 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc)
keyctl$negate(0xd, r3, 0x8, r4)

[  459.251769] binder: BINDER_SET_CONTEXT_MGR already set
[  459.283642] binder: 16127:16155 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  459.291960] binder: 16127:16151 ioctl 40046207 0 returned -16
14:56:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000280029080000003f0000000000000000"], 0x14}}, 0x0)
socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000))

14:56:25 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xfdfdffff00000000, 0x0, &(0x7f00000001c0)})

[  459.499377] binder: 16160:16162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:25 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:25 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:25 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="a15b4725c9dcfb92000000000000000000ff7f00"], 0x14}}, 0x0)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00')
getpeername$packet(0xffffffffffffff9c, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000001c0)=0x14)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000380)={<r3=>0x0, @rand_addr, @broadcast}, &(0x7f00000003c0)=0xc)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000004c0)={<r4=>0x0, @loopback, @remote}, &(0x7f0000000500)=0xc)
accept4$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14, 0x80800)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000700)=@ll={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000780)=""/253, 0xfd}, {&(0x7f0000000880)=""/186, 0xba}, {&(0x7f0000000940)=""/29, 0x1d}, {&(0x7f0000000980)=""/168, 0xa8}, {&(0x7f0000000a40)=""/181, 0xb5}, {&(0x7f0000000b00)=""/255, 0xff}], 0x6, &(0x7f0000000c80)=""/148, 0x94, 0x9}, 0x141)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000d80)={@local, <r7=>0x0}, &(0x7f0000000dc0)=0x14)
getsockname$packet(0xffffffffffffffff, &(0x7f00000021c0)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000002200)=0x14)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000022c0)={'team0\x00', <r9=>0x0})
r10 = accept(r0, &(0x7f0000002300)=@hci={0x1f, <r11=>0x0}, &(0x7f0000002380)=0x80)
getpeername(r0, &(0x7f00000023c0)=@can={0x1d, <r12=>0x0}, &(0x7f0000002440)=0x80)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000003700)={@mcast1, <r13=>0x0}, &(0x7f0000003740)=0x14)
getpeername$packet(0xffffffffffffffff, &(0x7f0000003780)={0x11, 0x0, <r14=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000037c0)=0x14)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r10, 0x84, 0xa, &(0x7f0000000080)={0xb2, 0x20, 0x20a, 0x4, 0x7f, 0x20, 0x4, 0x5, <r15=>0x0}, &(0x7f0000000240)=0x20)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r10, 0x84, 0x71, &(0x7f0000000280)={r15, 0x6}, &(0x7f00000002c0)=0x8)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003800)={'team0\x00', <r16=>0x0})
ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000003940)=@req={0x28, &(0x7f0000003900)={'bridge_slave_1\x00', @ifru_addrs=@xdp={0x2c, 0x5, <r17=>0x0, 0x25}}})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000039c0)={'dummy0\x00', <r18=>0x0})
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003a00)={'team0\x00', <r19=>0x0})
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000003c00)={<r20=>0x0, @rand_addr, @local}, &(0x7f0000003c40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000003c80)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000003d80)=0xe8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'rond_lav\x00', <r22=>0x0})
sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f00000045c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000004580)={&(0x7f0000003e00)={0x764, r1, 0x700, 0x70bd2c, 0x25dfdbfe, {}, [{{0x8, 0x1, r2}, {0x128, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffff569}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x260, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x40}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffd}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x80000000}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xf3b9}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x7c, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8, 0x1, r11}, {0xf4, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x10001, 0xaf, 0x20, 0x3}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}]}}, {{0x8, 0x1, r14}, {0x170, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r16}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r17}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x101}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x19f0800000}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r20}, {0xb8, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r22}}}]}}]}, 0x764}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000)

14:56:26 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x80ffffff00000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:26 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:26 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:26 executing program 2:
recvmmsg(0xffffffffffffffff, &(0x7f0000003280)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x7f}, 0xffffffffffffffff}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/175, 0xaf}, {&(0x7f0000001300)=""/236, 0xec}, {&(0x7f0000000140)=""/60, 0x3c}], 0x4, 0x0, 0x0, 0x96}, 0xfffffffffffffff8}, {{&(0x7f0000001400)=@pppol2tpv3={0x18, 0x1, {0x0, <r0=>0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001480)=""/67, 0x43}, {&(0x7f0000001500)=""/253, 0xfd}, {&(0x7f0000001600)=""/217, 0xd9}, {&(0x7f0000001700)=""/209, 0xd1}], 0x4, &(0x7f0000001840)=""/149, 0x95, 0x4}, 0x8}, {{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000001900)=""/8, 0x8}, {&(0x7f0000001940)=""/168, 0xa8}, {&(0x7f0000001a00)=""/50, 0x32}], 0x3, 0x0, 0x0, 0x6}, 0x7f}, {{&(0x7f0000001a80)=@can, 0x80, &(0x7f0000002000)=[{&(0x7f0000001b00)=""/10, 0xa}, {&(0x7f0000001b40)=""/56, 0x38}, {&(0x7f0000001b80)}, {&(0x7f0000001bc0)=""/13, 0xd}, {&(0x7f0000001c00)=""/217, 0xd9}, {&(0x7f0000001d00)=""/226, 0xe2}, {&(0x7f0000001e00)=""/181, 0xb5}, {&(0x7f0000001ec0)=""/133, 0x85}, {&(0x7f0000001f80)=""/23, 0x17}, {&(0x7f0000001fc0)=""/5, 0x5}], 0xa, &(0x7f00000020c0), 0x0, 0xf9a}, 0x3}, {{0x0, 0x0, &(0x7f0000003180)=[{&(0x7f0000002100)=""/4096, 0x1000}, {&(0x7f0000003100)=""/54, 0x36}, {&(0x7f0000003140)=""/62, 0x3e}], 0x3, &(0x7f00000031c0)=""/171, 0xab, 0x1f}, 0x1}], 0x6, 0x20, &(0x7f0000003400)={0x0, 0x1c9c380})
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000003480)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000003580)={&(0x7f0000003440), 0xc, &(0x7f0000003540)={&(0x7f00000034c0)={0x58, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3f}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2966957e}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x12}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4080}, 0x85)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  460.327862] binder: 16160:16194 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  460.335855] binder: BINDER_SET_CONTEXT_MGR already set
[  460.391665] binder: 16160:16193 ioctl 40046207 0 returned -16
14:56:26 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000290800000020004000010c000000"], 0x14}}, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x4000, 0x0)
setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000080)=0x6, 0x4)
r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x20000)
write$UHID_INPUT(r2, &(0x7f0000000240)={0x8, "b43f5765a6242e3a05dea896e91ceb09260e3801a89fe035874609727a169a08aae563272eb471ffc322afbebb4e53c4fd760ba1f79ea53ec3a76d06e56891928e689792197f7c2cac887ce8133e077a215793a8fe7f81ecc966f7708dbe24be714a38b878a36405894a6940a7988530a5595b636f5b28b51aa80221ae6fdf0deed1b7b02eb1e3f4ed33be7d47bef1c7286cccba47b411aa9a5b99d15bf1cb17b65e59338132cc3789d2af559421c298bda1033efca5bd740dd4f5b36a9f5589f425cce64f075d41a26497a6f2d8078f19a323e80f0c74105eb98f7bdde716f153e1bee47aea84de7ea4cfe6b813247cb2a6f95536db8fea99c7399e0796da22a9bba6f34619b9467b689f4c5d818027f690cb38c799243bf20ee0fdf5dd7156bfdd5ca65944ec7d5d2be10af4ca39a6e8156be06cde6f3bec4eb9eb716886dec20140e7bb9e283dc8610510870a48828ad2d4be900a61568aeb5a99aec9d4bcd1bdb7ce7216ceaa5b5980f17808e7cdc7d87df25f2895489a592617025926464d07c3817f7a024eed20da3b06257d0cc5c75edc93dddf988e46b8bcf35e3b49cc8a38c3141665dbc6d0ef0b9847fd955dbf6c640a9740816daecaedf4f8836d2ab6323a823b6e4161b235f9c4df3c9fdbcc51828bc6ed9c34e2337e9dac4521b7406bf606bdb74e43b9aad994a59019d7c95fd9761dfc505b2b58a2234f0b1cdf6b8e91ab52f50720fc8ac53d328be28e688a3adae455f4db3996ebd444407d75c4142a1826716014e2decaa1c7d3e3d064fb6252d07ce58550f2b75d26a4f80171fd6738b0e4e1c38341bb1f68f04ef99e90b55b3f561413cac2ca47b96dfdc1e1377ae3bf446635328144b59ad2faca0abe606d534b55f065ccfa07131091b32bffaba7d028586b4917e166561d23bc58a8ba1f24b8c5f65b27bfa497b70b745d59775c0f0a8c210a2eccfbfad95ca15f32364296022e41bd407ccabd056fe09678e4076f9dc9cbd7ef72867a2928c68619a196abf089e963d4e469a4ec2a71927d80346ebbdacff3607b3d8f736d8d83fbb3ab176852aadd8b06cb5fbd477830fce10c425486230a80ecc4e5e7c9bde2a98b3768c603dc15aff46592bb7f075b4fd9413825f85873df88c4dbd35a2098ac24378d37d019a45ebcb1b8b927c48f49754cd6aefb895437abca81a2569efac73443c89a7da8fc214951fa8a9a0aa091d6cf1585d17db217204cc7e0638d8d19fe1308fa37751530762127f092d827b018a55ad0a981d26fc1c541baf9a61e0b6b8a160b14a624358949ec34e025fd3f645948618126fc6baec9ec1941dd481cea82be6694777ca3dd95cfb7aa1a592ea44c11405e88c2aeb984b18acd475d88d70d9db83723f1eef1cbacc076308a07981c98fadea9c49eda09e6b0b2f1cf6f105e1307492187b054da78d940f7c5460fc910f32e2299e8234dc9f51a07e49407784cc4c235edf874e54753127ff01d2cc7a6aa28b5110f74d3a132964c59dedba02fd45ada8cf27d3509fd8b9a8c8eb3e2efdb7a89c37ef26241d190f02369bf9249270a26e1f75afad69e81c22d8c738738cfba7a33c25e7bdcdd190294da6cba250a600a149eeb648c455528a1b7322585680e1954dfd13ef40ac1f7d38903e8213f55f97389cde76a39bb6aa486441c6ff7ce98e8df54f1393a2e7eb5b39ba3af5d744ce9c7b26836e9db2214c3ffa9c7259bc6f9c0597767ca81b4d8ba9bf7976731c454bdb6cc95423df947092fa736f523803ad35448e8d07dcfd94426bcd45ef13ad0844372c1f225104b47cb20699f29534f53ab4fb3d57ba029fb89a5cc3e34ec6215b2e05338d5b07fc99c7715159099245f7eef0f6f1a989891b3d8b72f948b89f67918c0cca329c9d9124a5b0aa34d3b072f0ca8768a0e95403acb4a41865715ca49521f8949c0ed047502e7d04a15a6cebb3fe29f5c646cb8c3dc4e3cacd02a2727f0375ce474526e1ba4e01d63d3ea9d62c738e666edd5c6efbf5c5681b377109089f71bce514049d6da971cc8aa311e544e89c0d8b531d8c90cb6eca0cab932314f7cd445ce108b82b12980da276409137a489a76683c13d707a3fe9ab0f770e18068faa3a865f15ff5c841e803331582f7868ee95c05b29346b34a9c47b6c31c407dc8f57a0f3d9d6e1e5685eda57f4e2f8c03d06e2c35c98a86fd17a5f72de97a065defd4cece489ae62bc6f69b1b99646b217f323856d6392f4c388287162a2bb086a0a4a031ad4cd396d9592a64005fc972bd7399d9382651a42b2bfd8fe1a8e5e96e4f55a50a4abe79631f403818134739902d55f57dc1c6a905370d1bb40393f51e4c819980698676f2bde09efbc923cea93e532e0e4b783bf8f0c567d26bc4c381f27c89a8de9bd6df45316a72d25b870cf2ba00dc2001a243aaa28b192aec0b830541a55f02dc7167d38c18ad0e2c95d6daa87c46a7bc898befc54f6e9fbf9ec318206e385d6fb217ef8fc8aed68b2af1773268da81341e3a5b8d00fded3141f88de249cf023e82e385270ab5567bab47aa2daae14ccb93a36eb458e785196726e5322cdf90af22c4106651a550458712c88f6ac6e00117ef1bb352e82ea7a81ac63b68fe0c2f53cd7355dc5f12fb2d5579e8c6ee82abc4d0a9dd6dd6c152ef8209ba64faa1c67bf87b7fa9df957d608a974bde4bd688f366c634f3186b4b1cea0ff7f26d92d756422a978c0ac373ad8db7de357137991b017cb459b7bb95c6f7721865786a551b8933f7f5737be24ed21633b655f320212ef40f7bbc925ba548faf72f02c3f04cb7e9795ecbfcc9496fefbe0581ad3e884291fbb408e46b110a2948c42027c51f5c758c2716a686258b99de102d95b3f1668f002052a5f15a7b32c00842729efdc86b7ae24f87ae09f72a66ab5585efdf4c9cb7585a322ac1795836b05c0acda6ba0778c8d32f208fd062f80933838e49d3bb8047d20d4be83077b9ef608e21ea1b233136496fbd90051f79cfaeb157cc9a8337721cdcdbf0a865b786350dd930b276292c9d63c5225daf3f84ee809fdd21efa96823e5f26c355966947931014fea02e2ce57838dcb4f2366cd2c9cdf0fd9ca41c1b7bb4913512ee98b8245ce72742be0b4b9802e5339904c508cca0f814686c3d99d5965509e27bc3d01146c83406e2d278e03cbecd39ef074f0c86df683c5052d615ef1e895f1893e6f072331462230f67e2bb3144f5e58570f9962bd0f22dc5f93db6a0718082286eec96b933697f972f2ae2cfe4c35329d284414e1a86af7940c3c92310f39cfc6ad31f756b2d9b4656686c8019b22d47d57189459968056e66893cde3a8f1d13167a335a63963842e1d5d383d5f62e0937095ac5c46a9232e247bb0b61ee76849d1ec333a52c18eecc99888239bd50f98d301a07c9e67cf10b1b6cbeb078fdb1e149da364ed87414eb9696c0435c4c32d747b49f16b9e54cafdfe2ca7928b8b64da5befad832ea6a0d4b3e89f8d3af5d70e2d099f1c5299b7760b6fb15cf4f546f2524507fdc530a26e1bbaefe7ea0607138907d34a75614693da20b6fbca905d06c81fb0211a5210f0d50b7fa07327fb76082325adfa7be8b113f2ab8667c3d0c265b4ebf1071750da752a3c1e4bbf78790eea99884613b6054e5375f9436434601990cbcb21c8c290d6850221cd3e5174ecba39e8ae8ebd4ad297d22be4e6f5a41d38f0ce22a86d8deeb8597d8701ffc61a949b363983d7d30fb7b36f206a22050f9375c8c18b73b5d284a8e08493becec1cb80d70a1ae81ff459027bd2866ca3a0a85b83172fa240d1469b4d00990fa1a3e776206dce135c04519d7ceeb424bc966564149cd59d39ba8e31c70c5a3a1632288a30baa0c37db0a4900444c02ae4e75ebc15457e361a3b2ecd609b78e4c7912f66f7a62e53886188ef484e7f7f3815d9f2d52c44b9c920a570d96197bcfae6d8f87a62dc0acb3ae85dad89ffa940447b97518dae3468e0672c3cd3b84f9ad1e6fb72b5e1b4a93fc5c963da89c08ce6922b08b56ea2bad13a2613e9b755fdce0f1491d14e2a2182bf1af4aa0cad58971d005b19a40ce9fde6e730833cf58e06da4713ab813b49f7f6d162a00df0c832adcb3330ac7685000e04e8a1bd93671af13be0bf5598af480394e1b04a41efc6187e5a8b6f816fe7f5f424504fde8537f93edbdafd97350eb5ee8d1e3200b2d74a21d9a59cec719441b0ff5c8224b968f2ab0e37cbf919ea70ac192f552c274a6c7a4cbfa76a5b05d33f6614dd932b8564fd23e45530ece626355d3cba8d826bf61ced39f5e7bcf466bdb40c7bf3fb8106449029f642b7f6c838fb65c67218e9935b272102b0bdb4d97597a2610dd749e398e9ea452440d891c320311aaaa2e0d9e4c1a25750d0632fadb46ae29c4a93b9dca169fb017cdb8736f0a447be1e1d7e302fe3e13fff2d015f8e1ba582b67bbdcafad7015620dba86c4ff453fe5b43f2cb4e2afb5cb07333151d221887ffb2cc351247e6b1c4d87607484dd61eacf7e5bd5ca882e66f344a24611f01be2da9ff002de849ba5307ba21d90a46f3fbbd28c86084488a86ee6833768e1df91b4773805a5d7c70fc2948b1d16a7f88344ddeba6c9aab80cb9e925131acee24edf3cb448566a8c65eb5074f11ed818034d3e0e8145287960133817435f64b5b306ae1168abc4c52ec0e92e2ab6831378a60e61ae165c730fc46288f44569fdca44174c416c8e57f616145deba58cd46f53605f9dd6820605f6ea5f15f9816e13cd146d18beff6e0b1585378fb33e91ab223868f09e522c522224b6098876041a4f616f9930bedac79e88bafe98dc5e5c732130e58a90b6a378707e4400744eed0423f64812fdfa59c753c97f0a6e2a46e91ded5eb80e9a082fffe89f100a3d4ecbb0b778eaad3a4682e4e3fcf6ecd5a564baa5b1ad1f532b739eeeba51500d4fad5043c73e2bf91817cc0cad3837fe62cc913a7b006d301710a2d31528efde6a22588be7ac2335ac9cf3273027bedddea057125cff4e817ae53aa2ba060cb06b82e12bcc211eabca4b7220f9368f7fe337b8bbbbc27a9bde62dbf923f2e8deba07c0cf552ac5fe01a6df341bf9982c72710bcc083bd32408535a1acf297ecf9cb593329de33980d4686a4022e1925994d32ee340a81d7b3d4181507847627e59cb86816b80027dabbea5a46c65efa792b37513e1b96bcab61535d22514a9b9d2fabcafdf89ecd4c43c84b28165ab1e7cea9260007d980af08cc23f001d2432d38286e7f3ee681657b0935ee2d38bfc2f16bec3b5a6fead2d16a8edd5a74f084d61416a4321b28160e60a63de0f9135b18eca153666f3f7004b592ddeceb0b7e99f8fe25ee97b898dae712767f29adaade88e2e567fda9a28e14f39393043a1b87ea069f0e19ae3b1e68758336e654c6c3e1f772400b9c70aa0cea989eb1611245a6fbe6193897a5e72fde90fcbeb7c1387e37798ffd2d2a7eadbf24edadbe70baf25441272c8490f68c84b399731721cdab41477b65c99a40c8fadaf9797556032e4979f157d3c3c167fac16fb5aeb14683d3497c80302420e3799e9d663b9eba9ffc670600151d0ca631187b1e9090d335a5a76518fe2dbae9baabc02d3cedb8157bb1f0fdb931085b441e24ebedf550beb7776561aba487c76acd768e7963b808658046481c63ba5c19776a205ab8b6e9226f4d3e865f9d1645e74524e7e39d575122834614dce6414c8284cf90791077cde9a5d8383a97d871037623fd9a66e9ff71903aa112d1dd53c301", 0x1000}, 0x1006)

14:56:26 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x68, 0x0, &(0x7f00000001c0)})

14:56:26 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xffffffbf}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:26 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x900000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:27 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  461.040328] binder: 16213:16216 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
pipe(&(0x7f0000000000))

14:56:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="14040000280029080000000000000000311ffaa5"], 0x14}}, 0x0)

14:56:27 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:27 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:27 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2b}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400003ece7632042bfcbd00000000000c000000"], 0x14}}, 0x0)
fcntl$getflags(r0, 0x3)

14:56:27 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x3f, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

[  461.809709] binder: BINDER_SET_CONTEXT_MGR already set
[  461.815748] binder: 16213:16252 ioctl 40046207 0 returned -16
[  461.816050] binder: 16213:16253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:27 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7400000000000000, 0x0, &(0x7f00000001c0)})

14:56:27 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:27 executing program 2:
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000540)=""/175)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x7f, 0x7, 0xa000}, 0x4)
sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000028002908000000000000f2ff0b000000"], 0x14}}, 0x0)

14:56:27 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xa0008000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  461.974502] binder: 16256:16258 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:28 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$inet6(0xa, 0x5, 0x7)
sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34003}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x28, 0x829, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)

14:56:28 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:28 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2b}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:28 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:28 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:28 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xfdfdffff, 0x0, &(0x7f00000001c0)})

[  462.776817] binder: BINDER_SET_CONTEXT_MGR already set
[  462.782582] binder: 16256:16287 ioctl 40046207 0 returned -16
[  462.788895] binder: 16256:16288 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  462.968323] binder: 16295:16296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:29 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xfffffdef}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:29 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x40000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:29 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:29 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:29 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:29 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  463.777869] binder: 16295:16314 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  463.785785] binder: BINDER_SET_CONTEXT_MGR already set
14:56:29 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0xff0000, 0x0, &(0x7f00000001c0)})

[  463.859005] binder: 16295:16313 ioctl 40046207 0 returned -16
14:56:30 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:30 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xa00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:30 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  464.092677] binder: 16323:16325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:30 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x0)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:30 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:30 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:30 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x0, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:30 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x0)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  464.898477] binder: BINDER_SET_CONTEXT_MGR already set
[  464.910166] binder: 16323:16354 ioctl 40046207 0 returned -16
[  464.913632] binder: 16323:16355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:30 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r1 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r1, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x48000000, 0x0, &(0x7f00000001c0)})

14:56:31 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xea01}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  465.174475] binder: 16364:16368 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:31 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xa00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1500000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:31 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  465.930502] binder: BINDER_SET_CONTEXT_MGR already set
[  465.956377] binder: 16364:16391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  465.964614] binder: 16364:16390 ioctl 40046207 0 returned -16
14:56:32 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x2000, 0x0, &(0x7f00000001c0)})

[  466.370406] binder: 16400:16401 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:32 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:32 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:32 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:32 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:32 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x25}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:32 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:33 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  467.153621] binder: BINDER_SET_CONTEXT_MGR already set
[  467.184066] binder: 16400:16423 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  467.192491] binder: 16400:16422 ioctl 40046207 0 returned -16
14:56:33 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x300, 0x0, &(0x7f00000001c0)})

14:56:33 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:33 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:33 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x4c000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:33 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  467.649460] binder: 16430:16432 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:33 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:33 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:34 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  468.399776] binder: BINDER_SET_CONTEXT_MGR already set
[  468.405586] binder: 16430:16434 ioctl 40046207 0 returned -16
[  468.412723] binder: 16430:16457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:34 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x25000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:34 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0xeffdffff00000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:34 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x7a, 0x0, &(0x7f00000001c0)})

14:56:34 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  468.760683] binder: 16464:16467 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:34 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:34 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:35 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x4c000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:35 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:35 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:35 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x100000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  469.596766] binder: BINDER_SET_CONTEXT_MGR already set
[  469.638567] binder: 16464:16486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  469.646637] binder: 16464:16485 ioctl 40046207 0 returned -16
14:56:35 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:35 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x6800000000000000, 0x0, &(0x7f00000001c0)})

14:56:35 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  469.890244] binder: 16498:16500 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:36 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:36 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x4c000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:36 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:36 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xeffdffff}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  470.710647] binder: BINDER_SET_CONTEXT_MGR already set
[  470.782273] binder: 16498:16515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  470.790189] binder: 16498:16514 ioctl 40046207 0 returned -16
14:56:36 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x700000000000000, 0x0, &(0x7f00000001c0)})

14:56:37 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  471.220876] binder: 16523:16526 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:37 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x600}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xc0ffffff00000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xeffdffff}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:37 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  472.040164] binder: BINDER_SET_CONTEXT_MGR already set
14:56:38 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  472.072654] binder: 16523:16561 ioctl 40046207 0 returned -16
[  472.073644] binder: 16523:16562 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:38 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x300000000000000, 0x0, &(0x7f00000001c0)})

14:56:38 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  472.282737] binder: 16565:16567 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:38 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x600}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:38 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xe803000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:38 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:38 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  473.084078] binder: BINDER_SET_CONTEXT_MGR already set
[  473.146864] binder: 16565:16591 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  473.156195] binder: 16565:16590 ioctl 40046207 0 returned -16
14:56:39 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x600}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:39 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x6000000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:39 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:39 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x68000000, 0x0, &(0x7f00000001c0)})

14:56:39 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  473.539054] binder: 16599:16602 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:39 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xc0ffffff00000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:39 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:39 executing program 5:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:40 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  474.291118] binder: BINDER_SET_CONTEXT_MGR already set
[  474.296772] binder: 16599:16606 ioctl 40046207 0 returned -16
[  474.303562] binder: 16599:16623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:40 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x27000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:40 executing program 5:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:40 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x1000000, &(0x7f00000001c0)})

14:56:40 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x6000000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:40 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  474.679652] binder: 16635:16636 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  474.783872] binder: BINDER_SET_CONTEXT_MGR already set
[  474.831365] binder: 16635:16640 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  474.839330] binder: 16635:16636 ioctl 40046207 0 returned -16
14:56:41 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x2, &(0x7f00000001c0)})

14:56:41 executing program 5:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:41 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:41 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  475.242477] binder: 16647:16650 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:41 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x5000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  475.351549] binder: BINDER_SET_CONTEXT_MGR already set
[  475.412512] binder: 16647:16650 ioctl 40046207 0 returned -16
14:56:41 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6c, &(0x7f00000001c0)})

14:56:41 executing program 5:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:41 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  475.562787] binder: BINDER_SET_CONTEXT_MGR already set
[  475.570627] binder: 16663:16665 ioctl 40046207 0 returned -16
14:56:41 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x500000000000000, &(0x7f00000001c0)})

14:56:41 executing program 5:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:41 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  475.798006] binder: BINDER_SET_CONTEXT_MGR already set
[  475.830082] binder_thread_write: 4 callbacks suppressed
[  475.830097] binder: 16672:16674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  475.844070] binder: 16672:16673 ioctl 40046207 0 returned -16
14:56:41 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6000000000000000, &(0x7f00000001c0)})

14:56:42 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  476.126912] binder: 16682:16683 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:42 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  476.262672] binder: BINDER_SET_CONTEXT_MGR already set
[  476.289273] binder: 16682:16689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  476.297209] binder: 16682:16683 ioctl 40046207 0 returned -16
14:56:42 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xff00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:42 executing program 5:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:42 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6c00000000000000, &(0x7f00000001c0)})

14:56:42 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:42 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  476.545659] binder: 16700:16702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  476.614947] binder: BINDER_SET_CONTEXT_MGR already set
[  476.659166] binder: 16700:16707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  476.667780] binder: 16700:16702 ioctl 40046207 0 returned -16
14:56:42 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xa0008000, &(0x7f00000001c0)})

14:56:42 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  477.062814] binder: 16712:16714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:43 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  477.243099] binder: BINDER_SET_CONTEXT_MGR already set
[  477.277780] binder: 16712:16719 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  477.285439] binder: 16712:16714 ioctl 40046207 0 returned -16
14:56:43 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:43 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xc}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:43 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6000000, &(0x7f00000001c0)})

14:56:43 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:43 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  477.500959] binder: 16729:16732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  477.576674] binder: BINDER_SET_CONTEXT_MGR already set
[  477.582267] binder: 16729:16732 ioctl 40046207 0 returned -16
[  477.584535] binder: 16729:16734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:43 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x3000000, &(0x7f00000001c0)})

[  478.003137] binder: 16741:16742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:44 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:44 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  478.131990] binder: BINDER_SET_CONTEXT_MGR already set
14:56:44 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  478.218220] binder: 16741:16746 ioctl 40046207 0 returned -16
14:56:44 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x2000, &(0x7f00000001c0)})

14:56:44 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:44 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x10000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  478.526108] binder: BINDER_SET_CONTEXT_MGR already set
[  478.547306] binder: 16758:16762 ioctl 40046207 0 returned -16
14:56:44 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:44 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:44 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xfffffdfd, &(0x7f00000001c0)})

[  478.995081] binder: BINDER_SET_CONTEXT_MGR already set
14:56:45 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7a, &(0x7f00000001c0)})

14:56:45 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  479.042497] binder: 16772:16775 ioctl 40046207 0 returned -16
[  479.241729] binder: BINDER_SET_CONTEXT_MGR already set
14:56:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:45 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  479.310691] binder: 16783:16784 ioctl 40046207 0 returned -16
14:56:45 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x2000000000000000, &(0x7f00000001c0)})

14:56:45 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x700}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:45 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  479.630384] binder: BINDER_SET_CONTEXT_MGR already set
14:56:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  479.682415] binder: 16800:16803 ioctl 40046207 0 returned -16
14:56:45 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x20000000, &(0x7f00000001c0)})

14:56:46 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:46 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:46 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:46 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  480.163138] binder: 16811:16812 Acquire 1 refcount change on invalid ref 0 ret -22
14:56:46 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6c000000, &(0x7f00000001c0)})

14:56:46 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:46 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1100}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:46 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  480.566875] binder: BINDER_SET_CONTEXT_MGR already set
[  480.599437] binder: 16832:16833 ioctl 40046207 0 returned -16
14:56:46 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x300, &(0x7f00000001c0)})

[  481.004325] binder_thread_write: 13 callbacks suppressed
[  481.004339] binder: 16845:16846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:47 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  481.116175] binder: BINDER_SET_CONTEXT_MGR already set
14:56:47 executing program 2:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  481.139936] binder: 16845:16848 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  481.148352] binder: 16845:16846 ioctl 40046207 0 returned -16
14:56:47 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6800000000000000, &(0x7f00000001c0)})

14:56:47 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:47 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  481.563629] binder: 16859:16860 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  481.594201] binder: BINDER_SET_CONTEXT_MGR already set
[  481.599544] binder: 16859:16860 ioctl 40046207 0 returned -16
14:56:47 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1100000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  481.608212] binder: 16859:16863 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:47 executing program 2:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:47 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xffffff7f00000000, &(0x7f00000001c0)})

[  481.927069] binder: 16875:16877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:47 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(0xffffffffffffffff, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:48 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  482.027715] binder: BINDER_SET_CONTEXT_MGR already set
[  482.033505] binder: 16875:16877 ioctl 40046207 0 returned -16
[  482.045878] binder: 16875:16878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:48 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7a00000000000000, &(0x7f00000001c0)})

14:56:48 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:48 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  482.224375] binder: 16887:16888 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  482.262448] binder: BINDER_SET_CONTEXT_MGR already set
[  482.277451] binder: 16887:16891 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  482.286375] binder: 16887:16888 ioctl 40046207 0 returned -16
14:56:48 executing program 2:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:48 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x8000a0, &(0x7f00000001c0)})

[  482.636498] binder: 16903:16904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:48 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x400300}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  482.703458] binder: BINDER_SET_CONTEXT_MGR already set
[  482.708966] binder: 16903:16904 ioctl 40046207 0 returned -16
[  482.714386] binder: 16903:16905 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:48 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:48 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x8000a0ffffffff, &(0x7f00000001c0)})

14:56:49 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:49 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  483.097716] binder: BINDER_SET_CONTEXT_MGR already set
[  483.104031] binder: 16913:16917 ioctl 40046207 0 returned -16
14:56:49 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xa0ff0000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:49 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4000000, &(0x7f00000001c0)})

14:56:49 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:49 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  483.256263] binder: BINDER_SET_CONTEXT_MGR already set
[  483.276190] binder: 16923:16927 ioctl 40046207 0 returned -16
14:56:49 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x600, &(0x7f00000001c0)})

[  483.607021] binder: BINDER_SET_CONTEXT_MGR already set
[  483.673745] binder: 16937:16939 ioctl 40046207 0 returned -16
14:56:49 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7a00, &(0x7f00000001c0)})

14:56:49 executing program 2:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:49 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x400300}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  483.906829] binder: BINDER_SET_CONTEXT_MGR already set
[  483.942958] binder: 16942:16943 ioctl 40046207 0 returned -16
14:56:50 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7, &(0x7f00000001c0)})

14:56:50 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1500}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:50 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:50 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  484.161133] binder: BINDER_SET_CONTEXT_MGR already set
[  484.166751] binder: 16953:16954 ioctl 40046207 0 returned -16
14:56:50 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4c000000, &(0x7f00000001c0)})

14:56:50 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  484.468110] binder: BINDER_SET_CONTEXT_MGR already set
[  484.511863] binder: 16967:16968 ioctl 40046207 0 returned -16
14:56:50 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x500, &(0x7f00000001c0)})

14:56:50 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x200000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:50 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:50 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x400300}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  484.901554] binder: BINDER_SET_CONTEXT_MGR already set
[  484.907101] binder: 16975:16976 ioctl 40046207 0 returned -16
14:56:51 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x60, &(0x7f00000001c0)})

14:56:51 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x3, &(0x7f00000001c0)})

14:56:51 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  485.426990] binder: BINDER_SET_CONTEXT_MGR already set
[  485.461460] binder: 17004:17007 ioctl 40046207 0 returned -16
14:56:51 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x74000000, &(0x7f00000001c0)})

14:56:51 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  485.747779] binder: BINDER_SET_CONTEXT_MGR already set
[  485.783722] binder: 17015:17018 ioctl 40046207 0 returned -16
14:56:51 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x700000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x600000000000000, &(0x7f00000001c0)})

14:56:51 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x400300}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:51 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  485.959921] binder: BINDER_SET_CONTEXT_MGR already set
[  485.994100] binder: 17031:17038 ioctl 40046207 0 returned -16
14:56:52 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4800, &(0x7f00000001c0)})

[  486.237489] binder_thread_write: 22 callbacks suppressed
[  486.237504] binder: 17044:17045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  486.322483] binder: BINDER_SET_CONTEXT_MGR already set
14:56:52 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  486.364108] binder: 17044:17046 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  486.373958] binder: 17044:17045 ioctl 40046207 0 returned -16
14:56:52 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xff00, &(0x7f00000001c0)})

14:56:52 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  486.741110] binder: 17052:17053 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  486.776605] binder: BINDER_SET_CONTEXT_MGR already set
14:56:52 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  486.814669] binder: 17052:17053 ioctl 40046207 0 returned -16
[  486.814736] binder: 17052:17054 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:52 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:52 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:52 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:52 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xfdfdffff00000000, &(0x7f00000001c0)})

[  487.066804] binder: 17072:17075 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  487.134186] binder: BINDER_SET_CONTEXT_MGR already set
[  487.150531] binder: 17072:17075 ioctl 40046207 0 returned -16
[  487.157314] binder: 17072:17076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:53 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xffffff7f, &(0x7f00000001c0)})

14:56:53 executing program 1:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  487.382407] binder: 17078:17079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  487.415746] binder: BINDER_SET_CONTEXT_MGR already set
[  487.426600] binder: 17078:17080 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  487.434417] binder: 17078:17079 ioctl 40046207 0 returned -16
14:56:53 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4c00, &(0x7f00000001c0)})

14:56:53 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:53 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1500}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  487.739071] binder: 17087:17089 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  487.808886] binder: BINDER_SET_CONTEXT_MGR already set
[  487.842996] binder: 17087:17092 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  487.856680] binder: 17087:17089 ioctl 40046207 0 returned -16
14:56:53 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:53 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xea010000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:54 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:54 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xff0000, &(0x7f00000001c0)})

[  488.165283] binder: BINDER_SET_CONTEXT_MGR already set
[  488.172644] binder: 17104:17105 ioctl 40046207 0 returned -16
14:56:54 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:54 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6000, &(0x7f00000001c0)})

14:56:54 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  488.447826] binder: BINDER_SET_CONTEXT_MGR already set
[  488.462228] binder: 17115:17116 ioctl 40046207 0 returned -16
14:56:54 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6800, &(0x7f00000001c0)})

14:56:54 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  488.799904] binder: BINDER_SET_CONTEXT_MGR already set
14:56:54 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:54 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x100000000000000, &(0x7f00000001c0)})

[  488.840822] binder: 17121:17123 ioctl 40046207 0 returned -16
14:56:54 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:54 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  489.046879] binder: BINDER_SET_CONTEXT_MGR already set
14:56:55 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x44000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  489.125405] binder: 17133:17137 ioctl 40046207 0 returned -16
14:56:55 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:55 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x200000000000000, &(0x7f00000001c0)})

14:56:55 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:55 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  489.566886] binder: BINDER_SET_CONTEXT_MGR already set
[  489.601327] binder: 17149:17153 ioctl 40046207 0 returned -16
14:56:55 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:55 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:55 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:55 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x68000000, &(0x7f00000001c0)})

14:56:55 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  490.004383] binder: BINDER_SET_CONTEXT_MGR already set
[  490.011081] binder: 17169:17172 ioctl 40046207 0 returned -16
14:56:56 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1f00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:56 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xfdfdffff, &(0x7f00000001c0)})

14:56:56 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  490.282767] binder: BINDER_SET_CONTEXT_MGR already set
[  490.288322] binder: 17184:17187 ioctl 40046207 0 returned -16
14:56:56 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:56 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x700, &(0x7f00000001c0)})

14:56:56 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:56 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:56 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  490.582504] binder: BINDER_SET_CONTEXT_MGR already set
[  490.618396] binder: 17197:17200 ioctl 40046207 0 returned -16
14:56:56 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:56 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:56 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4c, &(0x7f00000001c0)})

[  491.012802] binder: BINDER_SET_CONTEXT_MGR already set
[  491.067630] binder: 17211:17214 ioctl 40046207 0 returned -16
14:56:57 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2900}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:57 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:57 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:57 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x48, &(0x7f00000001c0)})

14:56:57 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  491.355263] binder_thread_write: 18 callbacks suppressed
[  491.355277] binder: 17230:17232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  491.545187] binder: BINDER_SET_CONTEXT_MGR already set
[  491.586362] binder: 17230:17237 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  491.595039] binder: 17230:17232 ioctl 40046207 0 returned -16
14:56:57 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:56:57 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x700000000000000, &(0x7f00000001c0)})

14:56:57 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:57 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x8}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:58 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  492.056465] binder: 17247:17248 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:58 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  492.098912] binder: BINDER_SET_CONTEXT_MGR already set
[  492.105089] binder: 17247:17248 ioctl 40046207 0 returned -16
[  492.111076] binder: 17247:17253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:58 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:58 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7000000, &(0x7f00000001c0)})

14:56:58 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:56:58 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  492.391170] binder: 17267:17268 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  492.464716] binder: BINDER_SET_CONTEXT_MGR already set
[  492.507132] binder: 17267:17274 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  492.517503] binder: 17267:17268 ioctl 40046207 0 returned -16
14:56:58 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x5, &(0x7f00000001c0)})

14:56:58 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:58 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:58 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xf}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:58 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:58 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  492.964939] binder: 17282:17285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  492.974570] binder: BINDER_SET_CONTEXT_MGR already set
[  492.980551] binder: 17282:17285 ioctl 40046207 0 returned -16
[  492.989476] binder: 17282:17287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:56:59 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4800000000000000, &(0x7f00000001c0)})

14:56:59 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:59 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  493.249904] binder: 17302:17306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  493.339112] binder: BINDER_SET_CONTEXT_MGR already set
[  493.390113] binder: 17302:17311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  493.398905] binder: 17302:17306 ioctl 40046207 0 returned -16
14:56:59 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x300000000000000, &(0x7f00000001c0)})

14:56:59 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  493.795894] binder: BINDER_SET_CONTEXT_MGR already set
[  493.841855] binder: 17316:17318 ioctl 40046207 0 returned -16
14:56:59 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:56:59 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x48000000, &(0x7f00000001c0)})

14:57:00 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xb00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:00 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:00 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:57:00 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  494.082283] binder: BINDER_SET_CONTEXT_MGR already set
[  494.088753] binder: 17330:17331 ioctl 40046207 0 returned -16
14:57:00 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x74, &(0x7f00000001c0)})

14:57:00 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:00 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  494.351584] binder: BINDER_SET_CONTEXT_MGR already set
[  494.416963] binder: 17350:17353 ioctl 40046207 0 returned -16
14:57:00 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:00 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7400000000000000, &(0x7f00000001c0)})

14:57:00 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000), 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  494.775596] binder: BINDER_SET_CONTEXT_MGR already set
[  494.791912] binder: 17365:17369 ioctl 40046207 0 returned -16
14:57:00 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:57:00 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:00 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x26000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:00 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x400000000000000, &(0x7f00000001c0)})

14:57:00 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  494.986574] binder: BINDER_SET_CONTEXT_MGR already set
[  495.036595] binder: 17376:17380 ioctl 40046207 0 returned -16
14:57:01 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4c00000000000000, &(0x7f00000001c0)})

14:57:01 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x68, &(0x7f00000001c0)})

[  495.327664] binder: BINDER_SET_CONTEXT_MGR already set
[  495.334288] binder: 17392:17393 ioctl 40046207 0 returned -16
14:57:01 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:01 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:01 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x44000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  495.523635] binder: BINDER_SET_CONTEXT_MGR already set
[  495.551098] binder: 17396:17402 ioctl 40046207 0 returned -16
14:57:01 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x60000000, &(0x7f00000001c0)})

14:57:01 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:57:01 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x23000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:01 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  495.950483] binder: BINDER_SET_CONTEXT_MGR already set
[  495.991467] binder: 17413:17419 ioctl 40046207 0 returned -16
14:57:02 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7a000000, &(0x7f00000001c0)})

14:57:02 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xe803}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:02 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  496.374591] binder_thread_write: 15 callbacks suppressed
[  496.374605] binder: 17427:17429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:02 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x7400, &(0x7f00000001c0)})

[  496.459510] binder: 17427:17432 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  496.635425] binder: 17436:17437 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:02 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  496.752147] binder: BINDER_SET_CONTEXT_MGR already set
14:57:02 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  496.817257] binder: 17436:17438 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  496.832763] binder: 17436:17437 ioctl 40046207 0 returned -16
14:57:03 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:03 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xffffffffa0008000, &(0x7f00000001c0)})

14:57:03 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:03 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  497.157476] binder: 17450:17451 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  497.172197] binder: BINDER_SET_CONTEXT_MGR already set
[  497.177515] binder: 17450:17451 ioctl 40046207 0 returned -16
[  497.184599] binder: 17450:17452 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:03 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0xff000000000000, &(0x7f00000001c0)})

14:57:03 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  497.532037] binder: 17464:17466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  497.671615] binder: BINDER_SET_CONTEXT_MGR already set
14:57:03 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  497.729175] binder: 17464:17468 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  497.737297] binder: 17464:17466 ioctl 40046207 0 returned -16
14:57:03 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:03 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:03 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x2000000, &(0x7f00000001c0)})

14:57:04 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  498.110637] binder: 17485:17486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  498.134352] binder: BINDER_SET_CONTEXT_MGR already set
[  498.148753] binder: 17485:17487 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:04 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x0, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x3e8}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  498.163225] binder: 17485:17486 ioctl 40046207 0 returned -16
14:57:04 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x5000000, &(0x7f00000001c0)})

14:57:04 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x4, &(0x7f00000001c0)})

[  498.320435] binder: BINDER_SET_CONTEXT_MGR already set
[  498.326234] binder: 17497:17501 ioctl 40046207 0 returned -16
14:57:04 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x0)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  498.453690] binder: BINDER_SET_CONTEXT_MGR already set
[  498.473768] binder: 17510:17511 ioctl 40046207 0 returned -16
14:57:04 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
socket$inet6(0xa, 0x6, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6, &(0x7f00000001c0)})

14:57:04 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  498.801629] binder: BINDER_SET_CONTEXT_MGR already set
14:57:04 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(0xffffffffffffffff, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x6c00, &(0x7f00000001c0)})

[  498.868311] binder: 17523:17526 ioctl 40046207 0 returned -16
14:57:04 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2b000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:04 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0)
ioctl$TIOCLINUX4(r2, 0x541c, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  499.003870] binder: BINDER_SET_CONTEXT_MGR already set
[  499.009390] binder: 17538:17540 ioctl 40046207 0 returned -16
14:57:05 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  499.297100] binder: BINDER_SET_CONTEXT_MGR already set
[  499.341347] binder: 17551:17558 ioctl 40046207 0 returned -16
14:57:05 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:57:05 executing program 0:
r0 = socket$inet6(0xa, 0x80007, 0x1fd)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:05 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x60000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  499.680189] binder: BINDER_SET_CONTEXT_MGR already set
[  499.685719] binder: 17564:17575 ioctl 40046207 0 returned -16
14:57:05 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:05 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:05 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  499.939161] binder: BINDER_SET_CONTEXT_MGR already set
[  499.983588] binder: 17586:17592 ioctl 40046207 0 returned -16
14:57:06 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0xa00)
getsockname$unix(r1, &(0x7f0000000080), &(0x7f0000000140)=0x6e)
r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:06 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  500.274269] binder: BINDER_SET_CONTEXT_MGR already set
[  500.333478] binder: 17597:17600 ioctl 40046207 0 returned -16
14:57:06 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:06 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x4c}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:57:06 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="811ec09bd2f5f733fd8358730c4000ffec369aaff4ae7e64758e812ab30bc77fe0db27708c704453e735611a5c403b4c03098564c538fd6cb9209751cea926e799bcd00f5c2a3010c008adcf14a018b98931f8ab8a8b2741af02123930e672bcbb148719cdc94c6bae2da7446fd22e17fe24491c8d0bec54a5c2e399a77946d287190fd4c2433328971a6b54259d485422466d809ae2a25c594d9d815039ff0df3ed88fbd4a03cda5a3d0fb0ddbe2d4ada148af9671c5c3238ef87d73e3244173d590b617d6ee482c7ab71f5e2d8cd96c18fd9618ff6aec23d9e9148a2749ac1a99e23b6faf87e47bac7ef76ed2a1cfa3ff979"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:06 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

14:57:06 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:06 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x8dffffff}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  500.662851] binder: 17610:17614 unknown command -1681908095
[  500.746642] binder: 17610:17614 ioctl c0306201 20000000 returned -22
14:57:06 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}], 0x1, 0x0)

[  500.822892] binder: BINDER_SET_CONTEXT_MGR already set
[  500.823291] binder: 17610:17623 unknown command -1681908095
[  500.855623] binder: 17610:17614 ioctl 40046207 0 returned -16
14:57:06 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  500.907536] binder: 17610:17623 ioctl c0306201 20000000 returned -22
14:57:07 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000003, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x28000, 0x0)
ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000080)='/dev/binder#\x00')
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'dummy0\x00', &(0x7f0000000140)=@ethtool_rxnfc={0x31, 0x17, 0x7f, {0x1f, @sctp_ip4_spec={@empty, @dev={0xac, 0x14, 0x14, 0x1b}, 0x4e21, 0x4e22, 0x4}, {"fece", @broadcast, 0x8, 0x4, [0x20, 0x5]}, @esp_ip4_spec={@dev={0xac, 0x14, 0x14, 0x1a}, @multicast2, 0x5, 0x324}, {"28f8", @dev={[], 0xc}, 0x3, 0x9, [0x7]}, 0x3, 0x400}, 0x3, [0x3, 0x7ff, 0x0]}})

14:57:07 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:07 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:57:07 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0xe00}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  501.509762] binder: BINDER_SET_CONTEXT_MGR already set
[  501.515381] binder: 17633:17637 ioctl 40046207 0 returned -16
[  501.538342] binder_thread_write: 16 callbacks suppressed
[  501.538356] binder: 17633:17648 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:07 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:07 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0)
ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40046602, &(0x7f00000002c0))
write$P9_RSTAT(0xffffffffffffffff, &(0x7f0000000140)={0x54, 0x7d, 0x0, {0x0, 0x4d, 0x0, 0x6, {0x8, 0x0, 0x2}, 0x80000, 0x0, 0x1, 0x5a, 0x0, "", 0xd, './cgroup.net\x00', 0x201, "", 0xd, "2e2f6367727f75702e6e12f8c3"}}, 0x54)
write$binfmt_elf32(r1, &(0x7f00000000c0)=ANY=[@ANYRESHEX], 0xffffffffffffff86)
ioctl$EXT4_IOC_SETFLAGS(r1, 0x40046602, &(0x7f0000000100)=0x400080000)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x3, 0x0, 0x5, 0x78, 0x9a6, 0x1, 0x8}, 0x0)

14:57:07 executing program 0:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
pipe(&(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000080)={0x8000, 0xcdf})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:07 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

14:57:07 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2300000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:07 executing program 5:
clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000080))
mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0)
execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000000500))
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00')
pread64(r0, &(0x7f0000000200), 0x0, 0x0)
execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200), &(0x7f0000000340))
lseek(r0, 0x0, 0x0)
open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0)

[  501.951851] binder: BINDER_SET_CONTEXT_MGR already set
14:57:08 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  502.013148] binder: 17664:17668 ioctl 40046207 0 returned -16
14:57:08 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x1, 0x0)

[  502.073664] binder: BINDER_SET_CONTEXT_MGR already set
[  502.079290] binder: 17664:17673 ioctl 40046207 0 returned -16
[  502.108681] binder: BINDER_SET_CONTEXT_MGR already set
[  502.117646] binder: 17664:17668 ioctl 40046207 0 returned -16
14:57:08 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x40000, 0x0)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000080)={0x53, 0x100000000, 0x0, {0x3, 0x1e4}, {0x4, 0x10000000005}, @cond=[{0x7, 0x80000001, 0x3, 0x0, 0x81}, {0x1, 0x4, 0x3, 0x0, 0x0, 0xff}]})
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:08 executing program 5:
clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load\x00', 0x2, 0x0)
write$selinux_load(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757816000000000000000002ab00008257004000000000e9ffddec060000003c3a9ee2c62c1242ec004000000000"], 0x3c)

14:57:08 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  502.476911] binder: 17691:17692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:08 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x100000001)
r0 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r0, 0x20000000)
r1 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2500}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

[  502.627349] binder: BINDER_SET_CONTEXT_MGR already set
[  502.634213] SELinux: ebitmap: start bit 0 comes after start bit -1640350720
[  502.680599] binder: 17691:17700 ioctl 40046207 0 returned -16
[  502.680700] binder: 17691:17703 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  502.704173] SELinux: failed to load policy
[  502.717902] SELinux: ebitmap: start bit 0 comes after start bit -1640350720
14:57:08 executing program 0:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80, 0x0)
getdents(r0, &(0x7f0000000080)=""/46, 0x2e)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
r2 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000000, 0x10, r0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000480)=0x7)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000240)={<r3=>0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000002c0)={<r4=>0x0})
r5 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xc, 0x40010, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {{0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x58, 0x8, &(0x7f0000000180)=[@flat={0x77622a85, 0x100, r2, 0x2}, @fd={0x66642a85, 0x0, r1, 0x0, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f0000000140), 0x1, 0x4, 0x2e}], &(0x7f0000000200)=[0x78]}}}, @increfs_done={0x40106308, r3}, @acquire_done={0x40106309, r4, 0x3}, @acquire_done={0x40106309, r5, 0x2}, @exit_looper], 0x5e, 0x0, &(0x7f00000003c0)="37afbd725a24afd244de6d9b6434cefad89fc667b3d4d492ce6519a96e8f41e198df2de73c8f53ea383db7198269d2cbebd67578b70ba4e55740ea549c0806f080da2d4c463bed02fa0cf311d7861ed3d6444380c0da839b9fb194d6068a"})
openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r6 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})

[  502.735229] SELinux: failed to load policy
14:57:08 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x2500000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:08 executing program 5:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x0, 0x0)
syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x0, 0x0)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000001280)={0x3})
perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x0, &(0x7f0000002880)="3e64614acd899f99277c5b4a8f47ae120d75bc1e27e13f021fa5d25e908f026a6ee1f7e3e0d01575395971915ad14bb08121bc8a644f4dc37c54fe8fa354e9434a82406b38c0255cc2233dec37b8d2fb006192096a67905afa377af914bc9122aad53c7feadc970c31b7e9c7f484c32cd2b7369e50729d2c2292d92d69128c2d6427056004f332241a07a19bb2b0169d019768435f7addcbe49f3c1a99932231b1060aaeed890cb5b26fb4bb289d908e302f2195a4a7f8a3815464612621b7a05325fc292ae88f4cb26a59b0d5a92af18b1cd05da35abfd6b81c067ec31ffc558f58be9c28712a2a620dbd619b9743266cbb0f76ece4b4ecf90bd8df09384b6b3b33d2c762419b1ddf6711334f5c4f023ecbb4227a4c57a61fb2795a695a514d3521312ea16ccdb58afc3092b55ca9fc7378538fde4031d0bf31267be6d5813e64dbc406ee956fbe5da99ef6402d92c531658c85d7aa56f1b91f4f409237f36e133e022fa1845a64bd625c61664da4f77cbf010578bc50e1fdf0a0493980102882d256bf6055a1a8eb50dda6216b7ab2d73f61982c37551e0bb71b4ab19ff4382033d13bde2e183bb22319ba0ee98258fac11b2f4c470e41c038eecb59d9ff9e5f3b2814d491782a77ba38bcbc0718a4916a3aef4953e925f75209d8c6ca2df7620cb8c785ea3bb9f1a28c25c70b52a7be5840a849aa519b29d93656ff030000633b0d2e75094d5b3317b29777b6d57650f96b049b0cd1c7c98fd9c8e9674a8757aa5e0581bef76f9a2c08", 0x22b)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000100))
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000002300)=0x5, 0x4)
write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x1ff}, 0x2)
clone(0x100, 0x0, 0xfffffffffffffffe, &(0x7f0000000300), 0xffffffffffffffff)
r1 = inotify_init1(0x0)
fcntl$setown(r1, 0x8, 0xffffffffffffffff)
fcntl$getownex(r1, 0x10, &(0x7f0000000080)={0x0, <r2=>0x0})
process_vm_readv(r2, &(0x7f0000000000)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, &(0x7f0000003600)=[{&(0x7f0000003580)=""/121, 0x79}], 0x1, 0x0)

[  502.827655] audit: type=1400 audit(1539442628.806:77): avc:  denied  { map } for  pid=17710 comm="syz-executor0" path="/dev/sequencer2" dev="devtmpfs" ino=15184 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=1
[  502.836165] binder: 17710:17712 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
14:57:08 executing program 5:
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000080)=@req3, 0x1c)
epoll_wait(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182)
r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0)
pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
sendfile(r0, r0, &(0x7f0000000000), 0x2000005)
listxattr(&(0x7f0000000380)='./file0\x00', &(0x7f00000013c0)=""/21, 0xfffffea1)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
close(r0)

[  502.900333] binder: BINDER_SET_CONTEXT_MGR already set
[  502.906049] binder: 17710:17712 ioctl 40046207 0 returned -16
14:57:08 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100), 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:09 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)={<r1=>0x0, 0x7f, 0x4, [0x4, 0x8, 0x2, 0x1]}, &(0x7f0000000380)=0x10)
setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e20, 0x6, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1f}}, 0x4}}}, 0x84)
r2 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})
getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000040)={<r3=>0x0, 0x7, 0x10000, 0x4, 0x8, 0x6, 0x10001, 0x1, {0x0, @in={{0x2, 0x4e23, @multicast1}}, 0x20d1, 0x9, 0x8, 0xb754, 0x8}}, &(0x7f0000000140)=0xb0)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={<r4=>0x0, 0xffffffffffffffe0}, &(0x7f00000001c0)=0x8)
getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000002c0)={r3, 0x1f, 0x40, 0x2, 0x7, 0x7acd1638, 0x2, 0x20, {r4, @in6={{0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, [], 0xc}, 0x6}}, 0x7, 0x0, 0x6f6f, 0x8000, 0x1000}}, &(0x7f0000000200)=0xb0)

14:57:09 executing program 2:
creat(&(0x7f0000000100)='./file0\x00', 0x0)
clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff)
perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00000400, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffffdffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f000000a000))

[  503.157844] binder: 17729:17732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  503.189161] binder: BINDER_SET_CONTEXT_MGR already set
14:57:09 executing program 5:
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x18, 0x6c48}, {0x0, "feacd0647da3772542"}}, &(0x7f0000000000)=""/71, 0x23, 0x47}, 0x20)
write(r0, &(0x7f0000000240)="12b5694b4b3b46f66fa72b51b59672ce2fc3ced80ce5afe368ada4be2887ed962dacae338020937e24edf3cb403430e6c46f421bcaa79a1f8fb4256c7a2344243c59c2437f6f87cc5c0cffaf7407fb12ef13fc81fa31a2e991cdc42923e5d2b275dd71d99ff6810f17e51d880f9105", 0x6f)
r1 = socket(0xfffffffffffffffe, 0x3, 0x100000001)
mkdir(&(0x7f0000000300)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000200))
mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000))
sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
chdir(&(0x7f0000000340)='./file0\x00')
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10000, 0x8)
chdir(&(0x7f0000000380)='./file0\x00')
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'bcsh0\x00', <r3=>0x0})
accept4$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @dev}, &(0x7f00000002c0)=0x10, 0x80000)
getresuid(&(0x7f0000000580), &(0x7f0000000600)=<r4=>0x0, &(0x7f0000000440))
setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000680)={{{@in=@loopback, @in=@remote, 0x4e23, 0x3, 0x4e20, 0x1, 0xa, 0x20, 0x20, 0x2, r3, r4}, {0x8, 0x5a, 0x0, 0x0, 0x8, 0x40, 0x2}, {0x1000, 0xe8, 0x0, 0x8001}, 0x0, 0x6e6bc0, 0x2}, {{@in6=@loopback, 0x4d2, 0x3b}, 0xa, @in=@multicast1, 0x34ff, 0x0, 0x3, 0x3, 0x0, 0x3, 0x685b}}, 0xe8)
getpid()
gettid()
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f00000005c0), 0x4)
getpid()
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000a00)={&(0x7f00000009c0)='./file0\x00'}, 0x10)
accept4$inet(r1, 0x0, &(0x7f00000003c0), 0x80800)

[  503.215488] binder: 17729:17736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  503.223219] binder: 17729:17732 ioctl 40046207 0 returned -16
[  503.256862] ==================================================================
[  503.264516] BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x7ad/0x880
[  503.271886] Read of size 4 at addr ffff8801bd07acd4 by task syz-executor2/17737
[  503.279324] 
[  503.280966] CPU: 1 PID: 17737 Comm: syz-executor2 Not tainted 4.19.0-rc7+ #60
[  503.288241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  503.297599] Call Trace:
[  503.300205]  dump_stack+0x1c4/0x2b4
[  503.303846]  ? dump_stack_print_info.cold.2+0x52/0x52
[  503.309045]  ? printk+0xa7/0xcf
[  503.312327]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[  503.317095]  print_address_description.cold.8+0x9/0x1ff
[  503.322473]  kasan_report.cold.9+0x242/0x309
[  503.326891]  ? fscache_alloc_cookie+0x7ad/0x880
[  503.331579]  __asan_report_load4_noabort+0x14/0x20
[  503.336516]  fscache_alloc_cookie+0x7ad/0x880
[  503.341031]  ? fscache_cookie_init_once+0x80/0x80
[  503.345890]  ? rpcauth_cache_shrink_scan+0x180/0x180
[  503.351008]  ? __kmalloc_track_caller+0x14a/0x750
[  503.355865]  ? kstrdup+0x39/0x70
[  503.359236]  ? nfs_alloc_client+0x383/0x760
[  503.363564]  ? nfs_get_client+0x8e8/0x14d0
[  503.367801]  ? nfs_init_server+0x357/0x1010
[  503.372123]  ? nfs_create_server+0x86/0x5f0
[  503.376446]  ? nfs_fs_mount+0x17f8/0x2f1c
[  503.380593]  ? mount_fs+0xae/0x31d
[  503.384143]  ? vfs_kern_mount.part.35+0xdc/0x4f0
[  503.388920]  ? do_mount+0x581/0x31f0
[  503.392634]  ? ksys_mount+0x12d/0x140
[  503.396915]  ? __x64_sys_mount+0xbe/0x150
[  503.401067]  ? do_syscall_64+0x1b9/0x820
[  503.405150]  __fscache_acquire_cookie+0x230/0xb60
[  503.410006]  ? fscache_cookie_put+0x880/0x880
[  503.414518]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  503.420074]  ? check_preemption_disabled+0x48/0x200
[  503.425106]  ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0
[  503.430646]  ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160
[  503.435932]  ? rcu_pm_notify+0xc0/0xc0
[  503.439830]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  503.445387]  nfs_fscache_get_client_cookie+0x463/0x600
[  503.450674]  ? nfs_readpage_from_fscache_complete+0x200/0x200
[  503.456582]  nfs_alloc_client+0x563/0x760
[  503.460744]  ? register_nfs_version+0x280/0x280
[  503.465430]  ? do_raw_spin_trylock+0x1c0/0x1c0
[  503.470038]  nfs_get_client+0x8e8/0x14d0
[  503.474110]  ? kmem_cache_alloc_trace+0x152/0x750
[  503.478955]  ? mount_fs+0xae/0x31d
[  503.482511]  ? nfs_put_client+0x30/0x30
[  503.486492]  ? nfs_alloc_server+0x5ca/0x730
[  503.490821]  ? nfs_wait_client_init_complete+0x210/0x210
[  503.496285]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  503.501828]  ? check_preemption_disabled+0x48/0x200
[  503.506846]  ? check_preemption_disabled+0x48/0x200
[  503.511877]  ? __sanitizer_cov_trace_switch+0x53/0x90
[  503.517073]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  503.522626]  nfs_init_server+0x357/0x1010
[  503.526783]  ? nfs_clone_server+0x920/0x920
[  503.531112]  ? nfs_alloc_fattr+0x48/0x1d0
[  503.535269]  ? rcu_read_lock_sched_held+0x108/0x120
[  503.540308]  nfs_create_server+0x86/0x5f0
[  503.544471]  nfs_try_mount+0x180/0xa80
[  503.548371]  ? lock_downgrade+0x900/0x900
[  503.552526]  ? nfs_request_mount.constprop.18+0x920/0x920
[  503.558073]  ? kasan_check_read+0x11/0x20
[  503.562231]  ? do_raw_spin_unlock+0xa7/0x2f0
[  503.566645]  ? do_raw_spin_trylock+0x1c0/0x1c0
[  503.571231]  ? kasan_check_write+0x14/0x20
[  503.575483]  ? do_raw_spin_lock+0xc1/0x200
[  503.579734]  ? _raw_spin_unlock+0x2c/0x50
[  503.583891]  ? find_nfs_version+0x138/0x190
[  503.588226]  nfs_fs_mount+0x17f8/0x2f1c
[  503.592214]  ? nfs_show_options+0x250/0x250
[  503.596543]  ? nfs_clone_super+0x420/0x420
[  503.600781]  ? nfs_parse_mount_options+0x2660/0x2660
[  503.605889]  ? lock_downgrade+0x900/0x900
[  503.610075]  mount_fs+0xae/0x31d
[  503.613457]  vfs_kern_mount.part.35+0xdc/0x4f0
[  503.618052]  ? may_umount+0xb0/0xb0
[  503.621683]  ? _raw_read_unlock+0x2c/0x50
[  503.625836]  ? __get_fs_type+0x97/0xc0
[  503.629730]  do_mount+0x581/0x31f0
[  503.633279]  ? copy_mount_string+0x40/0x40
[  503.637528]  ? copy_mount_options+0x5f/0x380
[  503.641942]  ? rcu_read_lock_sched_held+0x108/0x120
[  503.646967]  ? kmem_cache_alloc_trace+0x353/0x750
[  503.651816]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  503.657453]  ? _copy_from_user+0xdf/0x150
[  503.661612]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  503.667152]  ? copy_mount_options+0x288/0x380
[  503.671654]  ksys_mount+0x12d/0x140
[  503.675291]  __x64_sys_mount+0xbe/0x150
[  503.679281]  do_syscall_64+0x1b9/0x820
[  503.683179]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  503.688560]  ? syscall_return_slowpath+0x5e0/0x5e0
[  503.693493]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  503.698346]  ? trace_hardirqs_on_caller+0x310/0x310
[  503.703390]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  503.708413]  ? prepare_exit_to_usermode+0x291/0x3b0
[  503.713442]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  503.718298]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  503.723493] RIP: 0033:0x457569
[  503.726691] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  503.745597] RSP: 002b:00007f388f2ccc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  503.753313] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
[  503.760584] RDX: 0000000020000180 RSI: 0000000020000140 RDI: 00000000200001c0
[  503.767853] RBP: 000000000072bf00 R08: 000000002000a000 R09: 0000000000000000
[  503.775125] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f388f2cd6d4
[  503.782392] R13: 00000000004c289b R14: 00000000004d3c78 R15: 00000000ffffffff
[  503.789678] 
[  503.791305] Allocated by task 17737:
[  503.795046]  save_stack+0x43/0xd0
[  503.798502]  kasan_kmalloc+0xc7/0xe0
[  503.802219]  __kmalloc+0x14e/0x760
[  503.805766]  fscache_alloc_cookie+0x6f7/0x880
[  503.810263]  __fscache_acquire_cookie+0x230/0xb60
[  503.815107]  nfs_fscache_get_client_cookie+0x463/0x600
[  503.820387]  nfs_alloc_client+0x563/0x760
[  503.824538]  nfs_get_client+0x8e8/0x14d0
[  503.828607]  nfs_init_server+0x357/0x1010
[  503.832754]  nfs_create_server+0x86/0x5f0
[  503.836903]  nfs_try_mount+0x180/0xa80
[  503.840786]  nfs_fs_mount+0x17f8/0x2f1c
[  503.844775]  mount_fs+0xae/0x31d
[  503.848159]  vfs_kern_mount.part.35+0xdc/0x4f0
[  503.852745]  do_mount+0x581/0x31f0
[  503.856282]  ksys_mount+0x12d/0x140
[  503.859907]  __x64_sys_mount+0xbe/0x150
[  503.863892]  do_syscall_64+0x1b9/0x820
[  503.867781]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  503.872967] 
[  503.874593] Freed by task 16739:
[  503.877965]  save_stack+0x43/0xd0
[  503.881419]  __kasan_slab_free+0x102/0x150
[  503.885658]  kasan_slab_free+0xe/0x10
[  503.889461]  kfree+0xcf/0x230
[  503.892606]  dccp_ackvec_parsed_cleanup+0xc1/0x1e0
[  503.897539]  ccid2_hc_tx_packet_recv+0x1535/0x2767
[  503.902476]  dccp_deliver_input_to_ccids+0x203/0x280
[  503.907582]  dccp_rcv_established+0x87/0xb0
[  503.911906]  dccp_v6_do_rcv+0x9b9/0xbf0
[  503.915881]  __sk_receive_skb+0x3e5/0xec0
[  503.920032]  dccp_v6_rcv+0xf6c/0x1ce9
[  503.923836]  ip6_input_finish+0x3fc/0x1aa0
[  503.928072]  ip6_input+0xe9/0x600
[  503.931523]  ip6_rcv_finish+0x17a/0x330
[  503.935498]  ipv6_rcv+0x120/0x640
[  503.938957]  __netif_receive_skb_one_core+0x14d/0x200
[  503.944149]  __netif_receive_skb+0x2c/0x1e0
[  503.948473]  process_backlog+0x218/0x6f0
[  503.952540]  net_rx_action+0x7c5/0x1950
[  503.956521]  __do_softirq+0x30b/0xad8
[  503.960318] 
[  503.961945] The buggy address belongs to the object at ffff8801bd07acc0
[  503.961945]  which belongs to the cache kmalloc-32 of size 32
[  503.974436] The buggy address is located 20 bytes inside of
[  503.974436]  32-byte region [ffff8801bd07acc0, ffff8801bd07ace0)
[  503.986138] The buggy address belongs to the page:
[  503.991074] page:ffffea0006f41e80 count:1 mapcount:0 mapping:ffff8801da8001c0 index:0xffff8801bd07afc1
[  504.000520] flags: 0x2fffc0000000100(slab)
[  504.004772] raw: 02fffc0000000100 ffffea000764b708 ffffea0007005588 ffff8801da8001c0
[  504.012656] raw: ffff8801bd07afc1 ffff8801bd07a000 0000000100000033 0000000000000000
[  504.020527] page dumped because: kasan: bad access detected
[  504.026229] 
[  504.027847] Memory state around the buggy address:
[  504.032781]  ffff8801bd07ab80: 04 fc fc fc fc fc fc fc 01 fc fc fc fc fc fc fc
[  504.040140]  ffff8801bd07ac00: 01 fc fc fc fc fc fc fc 01 fc fc fc fc fc fc fc
[  504.047495] >ffff8801bd07ac80: 01 fc fc fc fc fc fc fc 00 00 06 fc fc fc fc fc
[  504.054847]                                                  ^
[  504.060813]  ffff8801bd07ad00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  504.068172]  ffff8801bd07ad80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  504.075524] ==================================================================
[  504.082882] Disabling lock debugging due to kernel taint
14:57:10 executing program 3:

14:57:10 executing program 1:

14:57:10 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="05630440000000000e630c4000bfe8e26e0fc97db9b728e50e3aa7aa3db05a0862864f0db25a55a6721fc557b41937923c635f2e13d33e20d07f514f7b21f30be680486ab69b1c7aae99b43c98883d23f2f34542f1dbcf87bf579b33b935ad54039c44784fc57c9fe2b2f065220a6782b3e6017b8eb4db44c5db7e159a5db39ecd886d790b4d715907bb13a3a58361cb5b3b08848caaa24db026e8fdec3f1b1b0195edc5b9ea516f767208b65ea377f847c88a44814304fdadd4661656da14b0041903a8768a9975e1ca3a65b62d30067de808b7debf8f5a318e24aeda5f5dc2b36a291202fd0c8115cc3e7faa6da50ad7b74f607b742338f493eb0e41d920d41b7660c8"], 0x0, 0x0, &(0x7f00000001c0)})

14:57:10 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x82, 0x0)
ioctl$KDMKTONE(r0, 0x4b30, 0x100000001)
syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0x6a63, 0x4)
listen(r1, 0x20000000)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0)
sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x1f00000000000000}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)

14:57:10 executing program 3:

14:57:10 executing program 1:

14:57:10 executing program 5:
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x18, 0x6c48}, {0x0, "feacd0647da3772542"}}, &(0x7f0000000000)=""/71, 0x23, 0x47}, 0x20)
write(r0, &(0x7f0000000240)="12b5694b4b3b46f66fa72b51b59672ce2fc3ced80ce5afe368ada4be2887ed962dacae338020937e24edf3cb403430e6c46f421bcaa79a1f8fb4256c7a2344243c59c2437f6f87cc5c0cffaf7407fb12ef13fc81fa31a2e991cdc42923e5d2b275dd71d99ff6810f17e51d880f9105", 0x6f)
r1 = socket(0xfffffffffffffffe, 0x3, 0x100000001)
mkdir(&(0x7f0000000300)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000200))
mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000))
sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
chdir(&(0x7f0000000340)='./file0\x00')
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10000, 0x8)
chdir(&(0x7f0000000380)='./file0\x00')
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'bcsh0\x00', <r3=>0x0})
accept4$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @dev}, &(0x7f00000002c0)=0x10, 0x80000)
getresuid(&(0x7f0000000580), &(0x7f0000000600)=<r4=>0x0, &(0x7f0000000440))
setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000680)={{{@in=@loopback, @in=@remote, 0x4e23, 0x3, 0x4e20, 0x1, 0xa, 0x20, 0x20, 0x2, r3, r4}, {0x8, 0x5a, 0x0, 0x0, 0x8, 0x40, 0x2}, {0x1000, 0xe8, 0x0, 0x8001}, 0x0, 0x6e6bc0, 0x2}, {{@in6=@loopback, 0x4d2, 0x3b}, 0xa, @in=@multicast1, 0x34ff, 0x0, 0x3, 0x3, 0x0, 0x3, 0x685b}}, 0xe8)
getpid()
gettid()
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f00000005c0), 0x4)
getpid()
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000a00)={&(0x7f00000009c0)='./file0\x00'}, 0x10)
accept4$inet(r1, 0x0, &(0x7f00000003c0), 0x80800)

[  504.248193] binder: 17752:17755 BC_REQUEST_DEATH_NOTIFICATION invalid ref -488063232
[  504.277931] binder: BINDER_SET_CONTEXT_MGR already set
[  504.288033] binder: 17752:17755 ioctl 40046207 0 returned -16
[  504.294620] binder: 17752:17761 BC_REQUEST_DEATH_NOTIFICATION invalid ref -488063232
14:57:10 executing program 1:
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x18, 0x6c48}, {0x0, "feacd0647da3772542"}}, &(0x7f0000000000)=""/71, 0x23, 0x47}, 0x20)
write(r0, &(0x7f0000000240)="12b5694b4b3b46f66fa72b51b59672ce2fc3ced80ce5afe368ada4be2887ed962dacae338020937e24edf3cb403430e6c46f421bcaa79a1f8fb4256c7a2344243c59c2437f6f87cc5c0cffaf7407fb12ef13fc81fa31a2e991cdc42923e5d2b275dd71d99ff6810f17e51d880f9105", 0x6f)
r1 = socket(0xfffffffffffffffe, 0x3, 0x100000001)
mkdir(&(0x7f0000000300)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000200))
mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000))
sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
chdir(&(0x7f0000000340)='./file0\x00')
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10000, 0x8)
chdir(&(0x7f0000000380)='./file0\x00')
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'bcsh0\x00', <r3=>0x0})
accept4$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @dev}, &(0x7f00000002c0)=0x10, 0x80000)
getresuid(&(0x7f0000000580), &(0x7f0000000600)=<r4=>0x0, &(0x7f0000000440))
setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000680)={{{@in=@loopback, @in=@remote, 0x4e23, 0x3, 0x4e20, 0x1, 0xa, 0x20, 0x20, 0x2, r3, r4}, {0x8, 0x5a, 0x0, 0x0, 0x8, 0x40, 0x2}, {0x1000, 0xe8, 0x0, 0x8001}, 0x0, 0x6e6bc0, 0x2}, {{@in6=@loopback, 0x4d2, 0x3b}, 0xa, @in=@multicast1, 0x34ff, 0x0, 0x3, 0x3, 0x0, 0x3, 0x685b}}, 0xe8)
getpid()
gettid()
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f00000005c0), 0x4)
getpid()
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000a00)={&(0x7f00000009c0)='./file0\x00'}, 0x10)
accept4$inet(r1, 0x0, &(0x7f00000003c0), 0x80800)

14:57:10 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xe, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440000000000e630c4000ff"], 0x0, 0x0, &(0x7f00000001c0)})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x24000, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r2, 0xc004ae02, &(0x7f0000000140)={0x2, [0x0, 0x0]})
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x210000, 0x0)
ioctl$KVM_REINJECT_CONTROL(r3, 0xae71, &(0x7f0000000080)={0x6})

14:57:10 executing program 3:
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x18, 0x6c48}, {0x0, "feacd0647da3772542"}}, &(0x7f0000000000)=""/71, 0x23, 0x47}, 0x20)
write(r0, &(0x7f0000000240)="12b5694b4b3b46f66fa72b51b59672ce2fc3ced80ce5afe368ada4be2887ed962dacae338020937e24edf3cb403430e6c46f421bcaa79a1f8fb4256c7a2344243c59c2437f6f87cc5c0cffaf7407fb12ef13fc81fa31a2e991cdc42923e5d2b275dd71d99ff6810f17e51d880f9105", 0x6f)
r1 = socket(0xfffffffffffffffe, 0x3, 0x100000001)
mkdir(&(0x7f0000000300)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000200))
mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000))
sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
chdir(&(0x7f0000000340)='./file0\x00')
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10000, 0x8)
chdir(&(0x7f0000000380)='./file0\x00')
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'bcsh0\x00', <r3=>0x0})
accept4$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @dev}, &(0x7f00000002c0)=0x10, 0x80000)
getresuid(&(0x7f0000000580), &(0x7f0000000600)=<r4=>0x0, &(0x7f0000000440))
setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000680)={{{@in=@loopback, @in=@remote, 0x4e23, 0x3, 0x4e20, 0x1, 0xa, 0x20, 0x20, 0x2, r3, r4}, {0x8, 0x5a, 0x0, 0x0, 0x8, 0x40, 0x2}, {0x1000, 0xe8, 0x0, 0x8001}, 0x0, 0x6e6bc0, 0x2}, {{@in6=@loopback, 0x4d2, 0x3b}, 0xa, @in=@multicast1, 0x34ff, 0x0, 0x3, 0x3, 0x0, 0x3, 0x685b}}, 0xe8)
getpid()
gettid()
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f00000005c0), 0x4)
getpid()
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000a00)={&(0x7f00000009c0)='./file0\x00'}, 0x10)
accept4$inet(r1, 0x0, &(0x7f00000003c0), 0x80800)

[  504.426011] binder: 17770:17772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  504.443834] rpcbind: RPC call returned error 22
[  504.450249] Kernel panic - not syncing: panic_on_warn set ...
[  504.450249] 
[  504.457643] CPU: 1 PID: 17737 Comm: syz-executor2 Tainted: G    B             4.19.0-rc7+ #60
[  504.466309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  504.475666] Call Trace:
[  504.478275]  dump_stack+0x1c4/0x2b4
[  504.481922]  ? dump_stack_print_info.cold.2+0x52/0x52
[  504.487134]  panic+0x238/0x4e7
[  504.490336]  ? add_taint.cold.5+0x16/0x16
[  504.494500]  ? preempt_schedule+0x4d/0x60
[  504.498660]  ? ___preempt_schedule+0x16/0x18
[  504.503085]  ? trace_hardirqs_on+0xb4/0x310
[  504.507421]  kasan_end_report+0x47/0x4f
[  504.511403]  kasan_report.cold.9+0x76/0x309
[  504.515733]  ? fscache_alloc_cookie+0x7ad/0x880
[  504.520414]  __asan_report_load4_noabort+0x14/0x20
[  504.525355]  fscache_alloc_cookie+0x7ad/0x880
[  504.529868]  ? fscache_cookie_init_once+0x80/0x80
[  504.534732]  ? rpcauth_cache_shrink_scan+0x180/0x180
[  504.539847]  ? __kmalloc_track_caller+0x14a/0x750
[  504.544707]  ? kstrdup+0x39/0x70
[  504.548082]  ? nfs_alloc_client+0x383/0x760
[  504.552411]  ? nfs_get_client+0x8e8/0x14d0
[  504.556675]  ? nfs_init_server+0x357/0x1010
[  504.561003]  ? nfs_create_server+0x86/0x5f0
[  504.565342]  ? nfs_fs_mount+0x17f8/0x2f1c
[  504.569502]  ? mount_fs+0xae/0x31d
[  504.573061]  ? vfs_kern_mount.part.35+0xdc/0x4f0
[  504.577825]  ? do_mount+0x581/0x31f0
[  504.581543]  ? ksys_mount+0x12d/0x140
[  504.585355]  ? __x64_sys_mount+0xbe/0x150
[  504.589514]  ? do_syscall_64+0x1b9/0x820
[  504.593593]  __fscache_acquire_cookie+0x230/0xb60
[  504.598451]  ? fscache_cookie_put+0x880/0x880
[  504.602957]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  504.608510]  ? check_preemption_disabled+0x48/0x200
[  504.613545]  ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0
[  504.619096]  ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160
[  504.624383]  ? rcu_pm_notify+0xc0/0xc0
[  504.628284]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  504.633860]  nfs_fscache_get_client_cookie+0x463/0x600
[  504.639153]  ? nfs_readpage_from_fscache_complete+0x200/0x200
[  504.645074]  nfs_alloc_client+0x563/0x760
[  504.649326]  ? register_nfs_version+0x280/0x280
[  504.654068]  ? do_raw_spin_trylock+0x1c0/0x1c0
[  504.658670]  nfs_get_client+0x8e8/0x14d0
[  504.662744]  ? kmem_cache_alloc_trace+0x152/0x750
[  504.667597]  ? mount_fs+0xae/0x31d
[  504.671156]  ? nfs_put_client+0x30/0x30
[  504.675141]  ? nfs_alloc_server+0x5ca/0x730
[  504.679470]  ? nfs_wait_client_init_complete+0x210/0x210
[  504.684935]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  504.690484]  ? check_preemption_disabled+0x48/0x200
[  504.695507]  ? check_preemption_disabled+0x48/0x200
[  504.700532]  ? __sanitizer_cov_trace_switch+0x53/0x90
[  504.705744]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  504.711294]  nfs_init_server+0x357/0x1010
[  504.715458]  ? nfs_clone_server+0x920/0x920
[  504.719786]  ? nfs_alloc_fattr+0x48/0x1d0
[  504.723944]  ? rcu_read_lock_sched_held+0x108/0x120
[  504.728976]  nfs_create_server+0x86/0x5f0
[  504.733143]  nfs_try_mount+0x180/0xa80
[  504.737071]  ? lock_downgrade+0x900/0x900
[  504.741233]  ? nfs_request_mount.constprop.18+0x920/0x920
[  504.743622] binder: BINDER_SET_CONTEXT_MGR already set
[  504.746799]  ? kasan_check_read+0x11/0x20
[  504.746822]  ? do_raw_spin_unlock+0xa7/0x2f0
[  504.753082] binder: 17770:17777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 65280
[  504.757055]  ? do_raw_spin_trylock+0x1c0/0x1c0
[  504.757077]  ? kasan_check_write+0x14/0x20
[  504.768549] binder: 17770:17772 ioctl 40046207 0 returned -16
[  504.768917]  ? do_raw_spin_lock+0xc1/0x200
[  504.787827]  ? _raw_spin_unlock+0x2c/0x50
[  504.791981]  ? find_nfs_version+0x138/0x190
[  504.796311]  nfs_fs_mount+0x17f8/0x2f1c
[  504.800303]  ? nfs_show_options+0x250/0x250
[  504.804659]  ? nfs_clone_super+0x420/0x420
[  504.808901]  ? nfs_parse_mount_options+0x2660/0x2660
[  504.814033]  ? lock_downgrade+0x900/0x900
[  504.818195]  mount_fs+0xae/0x31d
[  504.821581]  vfs_kern_mount.part.35+0xdc/0x4f0
[  504.826176]  ? may_umount+0xb0/0xb0
[  504.829811]  ? _raw_read_unlock+0x2c/0x50
[  504.833964]  ? __get_fs_type+0x97/0xc0
[  504.837859]  do_mount+0x581/0x31f0
[  504.841407]  ? copy_mount_string+0x40/0x40
[  504.845657]  ? copy_mount_options+0x5f/0x380
[  504.850073]  ? rcu_read_lock_sched_held+0x108/0x120
[  504.855102]  ? kmem_cache_alloc_trace+0x353/0x750
[  504.859963]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  504.865513]  ? _copy_from_user+0xdf/0x150
[  504.869672]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  504.875215]  ? copy_mount_options+0x288/0x380
[  504.879723]  ksys_mount+0x12d/0x140
[  504.883350]  __x64_sys_mount+0xbe/0x150
[  504.887331]  do_syscall_64+0x1b9/0x820
[  504.891213]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  504.896577]  ? syscall_return_slowpath+0x5e0/0x5e0
[  504.901492]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  504.906323]  ? trace_hardirqs_on_caller+0x310/0x310
[  504.911342]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  504.916360]  ? prepare_exit_to_usermode+0x291/0x3b0
[  504.921364]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  504.926190]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  504.931361] RIP: 0033:0x457569
[  504.934540] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  504.953429] RSP: 002b:00007f388f2ccc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  504.961815] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
[  504.969067] RDX: 0000000020000180 RSI: 0000000020000140 RDI: 00000000200001c0
[  504.976318] RBP: 000000000072bf00 R08: 000000002000a000 R09: 0000000000000000
[  504.983571] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f388f2cd6d4
[  504.990838] R13: 00000000004c289b R14: 00000000004d3c78 R15: 00000000ffffffff
[  504.999040] Kernel Offset: disabled
[  505.002668] Rebooting in 86400 seconds..