last executing test programs: 1.419741196s ago: executing program 5 (id=6): r0 = socket(0x18, 0x3, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, 0x0) r1 = kqueue() r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_opts(r2, 0x0, 0x64, &(0x7f0000000240)="01000000", 0x4) closefrom(r1) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) ioctl$FIONREAD(r0, 0x8080691a, &(0x7f0000000100)) r3 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000100), 0x40, 0x0) ioctl$DIOCCHANGERULE(0xffffffffffffffff, 0xcd60441a, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x78e, 0x0) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) fcntl$getflags(r3, 0x3) ftruncate(0xffffffffffffffff, 0x8531) pipe(&(0x7f00000000c0)) getrusage(0x1, &(0x7f0000000000)) 1.407361034s ago: executing program 2 (id=3): r0 = socket(0x11, 0x3, 0x0) sendto$unix(r0, &(0x7f0000000140)="b1000503002004000000a10500fef96ec44ed15b35d8827ae30200004e3039d2d236acf20b7804be38164991f7c8cf6ab56c055c9170f3000000009b67404d335c223e7d0c032bfa896443a42102000000720fd18bfbb670c1f5a875645972138f1ea80400000000008000361b1257aea8c500002022fbfe0c2300048abfba0900000008e371a3f8bd3712051eeab71d1889e00084070000000013f868cc14a29984fd00"/177, 0xb1, 0x40e, 0x0, 0x0) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x4287e) r1 = open(&(0x7f0000000300)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7815) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x2, 0xff, 0x1, 0x9}, {0x30, 0xc9, 0x2, 0x8}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$FIONREAD(r1, 0x800474c4, &(0x7f0000000080)) write(r1, &(0x7f0000000000)="5fd4eda2e6fcd4cf310dcd4a", 0xc) mknod(&(0x7f0000000280)='./file0\x00', 0x1100, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x712, 0x0) 1.403909616s ago: executing program 0 (id=1): r0 = socket$inet(0x2, 0x3, 0x40) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0x2, 0x0, 0x0, 0x0, 0xc4, 0x9a43, 0x10, 0x0, 0x2}, 0x10, 0x3, 0x8, 0xff, 0x2, 0x2, 0xfffffffffffffffe, 0x6, 0x0, 0xfffffffffffffff9}) mknod(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x0) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) link(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000007c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') rename(&(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') unlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1) select(0x40, &(0x7f0000000000)={0x0, 0x1000}, &(0x7f0000001140)={0x0, 0x5, 0x6, 0x8}, &(0x7f0000000080)={0x3, 0x0, 0xb, 0x0, 0x18ae, 0x9, 0x0, 0x2}, &(0x7f0000000100)) r1 = socket(0x18, 0x1, 0x0) setsockopt(r1, 0x1000000029, 0xc, &(0x7f0000000040)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) open(&(0x7f0000000080)='./file0\x00', 0x800, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) sendmsg$unix(r2, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002c40)=ANY=[], 0x10, 0x403}, 0xa) open(&(0x7f0000000000)='./file0\x00', 0x615, 0x166) r3 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) fchmod(r0, 0x48) shutdown(r0, 0x0) r4 = socket(0x18, 0x3, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000080)=0x8) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) r5 = open(&(0x7f0000000640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1da) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCSETD(r5, 0x8004741b, &(0x7f0000000080)=0xf) closefrom(r4) mmap(&(0x7f00002b7000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x3) socket$inet(0x2, 0x3, 0x40) 1.383121392s ago: executing program 1 (id=2): mknod(&(0x7f0000000400)='./file0\x00', 0x2000, 0x5c4a) r0 = openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) ioctl$VNDIOCGET(r0, 0xc4104603, &(0x7f0000000440)={'./file0\x00', 0x3, 0xfe, 0x2}) r1 = openat$wsmouse(0xffffffffffffff9c, &(0x7f00000003c0), 0x8000, 0x0) ioctl$WSMOUSEIO_GETPARAMS(r1, 0x80105727, &(0x7f0000000440)={&(0x7f0000000400)=[{0x20, 0xffff0000}, {0x21, 0x200}], 0x2}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) poll(&(0x7f00000000c0)=[{r2, 0x80}], 0x1, 0x0) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000100), 0x7e, 0x0) ioctl$TIOCSETA(r3, 0xcd60441a, &(0x7f0000000000)={0x4, 0x2, 0x4, 0x0, "2000030100010000000000000068a95a010400", 0x6, 0x2}) ioctl$TIOCMGET(r0, 0x4004746a, &(0x7f0000000140)) close(0xffffffffffffffff) 253.159489ms ago: executing program 5 (id=9): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000003f00)={0x9, 0x20fdc7}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) getpeername$unix(0xffffffffffffffff, &(0x7f0000000dc0)=@file={0x0, 0x0, ""/4104}, &(0x7f0000001e00)=0x100a) (async) ioctl$DIOCGETRULE(r0, 0xcd604407, &(0x7f0000000040)={0x7ff, 0x1, 0xfffffffa, './file0\x00', './file0\x00', 0x0, "8795d0177c1214ebc21c768ca319b169c655c7cab7595ba2bee5a4841ff36bdb9547547f20bafc20710ace0210e5c42c9d4c41d63b24d8a519dfcd2d71ed62018b2aab6b97ad33686ae910dba69631829e425ccdc4460d42fe699da7d08ca531fb2bc7e38bfdeef291984f45e3ae60008498cf299dea0152e1c8077c253d3772ee7f9c77445f4066dbf00623911e34a0a4ee0b9f024c37e56e884413b79dce03206e1a20f3464be083b1e44058830e0b9037dbf72e22c80a4c96a7bba13e0ae5cffb134bd40c530708b84da10eae1a7f60cb8d6c20b90d863e8ec02776f5ef214db25b73640a3843937d6a8d37ff6adebb79a3a894a78252c9c5b408a01a858ec4547cc39b274a6260301a0e795903b24ad2afd57112f9207f0753e16a4817c3d4e29658a5e5e5e688d4729d7cb6ae2143f8cb3bd76b14058c7e46efe2b7dc94b6d756c00d52937afaa40820370e29ceda2a21d642e3291c1936142160e8f550849664dff8055104235276b75f2797844d4b0b9211273809c62ab138aa09ab7ab0d37ee87054e105c88110f83c7e33c5994f3fab1fc0aba3345985a0bff1f4a706bcca508b510cc2199355d227be8ae550edee800f40bdb9f9465a89bf389790f7377b0a9a89c33c9d1ab43f78933d09cdc6abfa3d254ac127a1eb946cfc206bb9d10252dbfb8e23b876395a64187f9b8d2e4292309713816d6607b35a2a58828faf70561ac75e79e06bd969c43371417733fb1c888a7e113ed81f63d544da11549e8e3ff2e4456d2980223576e2ea0bc2bed95a820b0c963d0292a4de1a6b076cb43e7d16e25d6ddfa7506bae944c280b839767ef7d9ef8e0be410ea7cd93b064ab419ee856cfeb388fc3b73a1151bba64c601c3854a810e9c7d796aacb022dcba1ca2b4d0e47a914952cc21d6f3548c7f2aab90c49fafae495ae81e59f7fbfef45bad7595229168d45342c36f17392ea62898e9799940b2bb73a265eccf0851017d0797efd334f51498c3d371f381c28c66019f49bdca504a596d97db0062c88693df05a7e8b25b22ec47db2a19dc45ac571049f12e1fdabfc89f0f7321b9f09a74e36d97b78963351a760376936e9b96ba79f78e3d2aa1088267aa7cf19413c8a7fd029db9286ca8b792e12efc43adde20baef8006a84fbeaa8992b660438bd1e313d65bb4fa014a78fcaa449f82781105dd3259934263293aff0853422107c8746328e3ae0fe28faccbb67ab7fde831481b2b0e2774ef38b712dff52d5269e3ca405011d3a30e45c65534d59ed452597dda2976213d4275b850e7af903ec1f1eb3b70ca0c3f49eecb6e6900f6e5ae9111bfcba836f424ca16694142c41f8294e418194e89db75ea26e9a4df6503dd01caae2a1b606fa7a03813746e29ae9efa7afd16dd5a0a426149dd357b176a07bc8155db10622c07e37ce846ea749a3812416fd56abd4fa9001ceb0af81186c8df7285d76973572dd8dda6698cef92d20357541293c1f6fc4c5c89f0ee5d8e707e885bdf5739cba28b61fe52a325b7e0be035e6aa872322fa35450db1aa019166ffb162d5783cbc071c5beaf5fccb88d6f166789b831315920bfd7324f7759a4478a4cebd0c4c1ed6485ea2ff41bdd47c11537496f650a1cf16c1e810ea5d98e4789727110eb478327701436db86159fa6414f485f5cff27b77c633a2c6220e6fb785a235aa98a3b2e0fa5eb323bfd2062aaf04538a6fa8d20f58a1a665e7e745896b7ad53cf8877f3538196550231cdf9b48f7f0e95f1b8fa7c59ea67c2b62db9961bb1a68cf853ad4968373d77066e5359f6fb0da1caf05b3640575e23a33050ab3ad96eab6ffb2cb282c7d9f0729835d71a65baae687bb69cb1286d1eb22f4814e6add05e124145b9e45501511615045d9e03b81984fe8ed33d286c7f7b5"}) 251.891011ms ago: executing program 5 (id=10): r0 = syz_open_pts() (async, rerun: 64) sysctl$kern(0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)="4f1d4c6344b80ed788b6a4515248df3aa745bb992c574ab4cdf5587145812eab4a988f7fafd7a01d99776d988908cd186b51f34f8c15ffa0c685ad4116c783959eff4278384b4000384dbb1c2aaeff10b4135529a1da6fda67c67469d954be811b25ec5521559154c586eefff122009f659cd3e27e98a3241495005f102d9101d158284c0ee3250aa7c11042330de22a29", 0x91) (rerun: 64) sysctl$net_inet_ip(&(0x7f0000000000)={0x4, 0x2, 0x0, 0x10}, 0x4, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000412000/0x2000)=nil) (async, rerun: 32) open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) (rerun: 32) ktrace(&(0x7f0000000100)='./file0\x00', 0x4, 0xd27d43220c7ff9d, 0x0) (async) shmctl$IPC_SET(r1, 0x1, &(0x7f0000000100)={{0x0, 0x0, 0x0, 0x0, 0x10b, 0x190, 0x3fd, 0x0, 0x100000}, 0xcb8, 0x9, 0x0, 0x0, 0x5, 0x9, 0x1000000000000, 0x0, 0x0, 0x0, 0x3}) r2 = openat$wsdisplay(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) (async, rerun: 64) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000b40)="825a4f47c21e6ed7eda0f5903abf65b18d7c51f78b06ccffb40500000000000000000000fafd3493776665d4cd12c63d34", 0x31}, {&(0x7f0000000b80)="4283540c3ee812bca9", 0x9}], 0x2, 0x0, 0x0, 0x406}, 0x0) (async, rerun: 64) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TIOCSETA(r3, 0xc4504448, &(0x7f0000000740)={0x6, 0x3, 0x0, 0x0, "000001e3bb4e3447c1d100", 0x4, 0xffff2bd9}) ioctl$WSMUXIO_INJECTEVENT(r2, 0x80185760, &(0x7f00000001c0)={0xfffffffc, 0x3, {0x3, 0x9}}) (async) setuid(0xee01) (async) r4 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) pwritev(r4, &(0x7f0000000300)=[{&(0x7f0000000400)="3d3132e6f51c96596d10605769667d7f2f8141bdf4da159d2ca23b7cce169007e6488dd03a7801c0be3ca57912a197498e362f3b6e94269995580039c2a8638a49445c7c9393e9f1a8fec56a77a13572f3693cb5bd11a54f40f5d6ea1bcc2e9b609dd803ceafb8ca00eb80c9b51ae1c8d1fe1206cecf6b6d96a44f", 0x7b}], 0x1, 0x5) (async, rerun: 64) execve(0x0, 0x0, 0x0) (async, rerun: 64) ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f0000000040)={0xfffffffd, 0x2, 0x3, 0x5, "01000000d000", 0x0, 0x4}) (async) sysctl$kern(&(0x7f0000000040)={0x1, 0x3e}, 0x3ffffffffffffdf3, 0x0, 0x0, 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) sysctl$vm_swapencrypt(&(0x7f0000000040), 0x3, 0x0, 0x0, &(0x7f0000001180), 0x0) (async, rerun: 32) shmctl$IPC_STAT(r1, 0x2, 0x0) (async, rerun: 32) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000040)={0xda, 0x4, 0x4, 0xfffffffa, "f445403fca00a8177dd92a5cb46cdb9ffaf21f3b", 0x4, 0xb}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x4b}, 0x2, &(0x7f0000000340)="71f91e3471", &(0x7f0000000000)=0x5, 0x0, 0x0) 76.114759ms ago: executing program 2 (id=11): munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x2, 0x0) msgsnd(r0, &(0x7f0000000040)=ANY=[@ANYRESOCT], 0x401, 0x0) msgsnd(r0, 0x0, 0x444, 0x800) sysctl$net_inet_tcp(&(0x7f0000000000)={0x4, 0x2, 0x6, 0x13}, 0x4, 0x0, 0x0, &(0x7f0000001740), 0xfffffffffffffdff) 75.494004ms ago: executing program 7 (id=8): r0 = socket(0x2, 0x3, 0x0) setsockopt(r0, 0x0, 0x6, &(0x7f00000000c0)="63e1303d", 0x4) setrlimit(0x8, &(0x7f0000000400)={0x7ff, 0x800000003fe}) r1 = syz_open_pts() setrlimit(0x8, &(0x7f0000000980)={0xb, 0x4e}) r2 = syz_open_pts() close(r2) r3 = syz_open_pts() ioctl$FIOASYNC(r2, 0x80047469, &(0x7f00000000c0)=0x47) write(r2, 0x0, 0x0) writev(r2, &(0x7f0000000580)=[{&(0x7f0000000100)="25bb", 0x2}], 0x1) read(r3, &(0x7f0000000180)=""/226, 0xe2) getsockopt$sock_cred(0xffffffffffffff9c, 0xffff, 0x1022, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) fcntl$lock(r1, 0x0, &(0x7f0000000300)={0x2, 0x0, 0x805, 0xffffffffffffffff, r4}) 74.093506ms ago: executing program 5 (id=12): r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$KDSETRAD(r0, 0x20004b43) openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000040)={0xd1, 0x5, 0x4, 0x4ef, "c56681054de2e80b7b397cda5b90f9e8bec0d979", 0xfff, 0x8}) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000080)={'tap', 0x0}) ioctl$WSDISPLAYIO_GBURNER(r0, 0x400c5752, &(0x7f00000000c0)) ioctl$WSDISPLAYIO_GETPARAM(r0, 0xc0205759, &(0x7f0000000100)={0x2, 0xfffff001, 0xfffffff7, 0x80000000}) ioctl$TIOCOUTQ(r0, 0x40047473, &(0x7f0000000140)) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000180)={'tap', 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$BIOCSDIRFILT(r1, 0x8004427d, &(0x7f0000000200)=0x6) ioctl$BIOCSETF(r1, 0x80104267, &(0x7f00000002c0)={0x9, &(0x7f0000000240)=[{0x401, 0x8, 0x1}, {0x9, 0x1, 0x8, 0x3}, {0x400, 0xb0, 0x5, 0xffffffff}, {0x7ff, 0xc, 0xd4, 0x3c9}, {0x9, 0x5, 0x81, 0x70}, {0x0, 0x9, 0x9, 0x6}, {0x1, 0x2, 0x2, 0x9}, {0x2, 0xa, 0x3, 0x7}, {0x5, 0x5, 0x7, 0xb}]}) shutdown(r1, 0x0) connect(r0, &(0x7f0000000300)=@un=@file={0x8, 0x1, './file0\x00'}, 0xa) r2 = openat$tty(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl$TIOCCONS(r2, 0x80047462, &(0x7f0000000380)=0x5c9f) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x4, 0x4010, r1, 0x7fffffffffffffff) fchmod(r1, 0x1) ioctl$TIOCNXCL(r1, 0x2000740e) mquery(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x2, 0x0, r0, 0x200) r3 = shmget$private(0x0, 0x4000, 0x291, &(0x7f0000ffb000/0x4000)=nil) shmctl$IPC_RMID(r3, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000440)={0x9, &(0x7f00000003c0)=[{0x7, 0x80, 0x1, 0x80000001}, {0x8, 0x2, 0x0, 0x6}, {0x9, 0x7, 0x6, 0x8}, {0xffff, 0x9, 0x7f, 0x80000001}, {0x8000, 0x0, 0x2, 0x1}, {0x29, 0xf7, 0x7, 0x2}, {0x0, 0x0, 0x9, 0x7fff}, {0x9, 0x8, 0x6, 0x8}, {0x0, 0x3, 0x80, 0x7fff}]}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f00000004c0)={&(0x7f0000000480)=[0x5, 0x0], 0x2, 0x4, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000540)={&(0x7f0000000500)=[0xfffffc01, 0x1, 0x7, 0x8, 0xd926], 0x5, 0x20004, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r4, 0xc00464c9, &(0x7f0000000580)={r5}) r7 = dup(r0) ioctl$WSKBDIO_SETBACKLIGHT(r7, 0x800c5712, &(0x7f00000005c0)={0x0, 0x4000000, 0xa8}) ioctl$TIOCMGET(r7, 0x4004746a, &(0x7f0000000600)) fsync(r6) 73.14937ms ago: executing program 5 (id=13): r0 = syz_open_pts() ioctl$TIOCSETD(r0, 0x8004741b, &(0x7f0000000040)=0x9) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/50, 0xfd9f}], 0x2f) madvise(&(0x7f0000000000/0x600000)=nil, 0xffffffffffffffff, 0x16) execve(0x0, 0x0, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f0000000100)="19", 0xfffffe98}], 0x1) pipe(&(0x7f0000000080)={0xffffffffffffffff}) fcntl$setstatus(r3, 0x4, 0xc0) r4 = setsid() fcntl$setown(r3, 0x6, r4) close(r3) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r3, 0xc01864c2, &(0x7f0000000080)={0x0, 0x2, r2, 0x0, 0x5}) 69.052776ms ago: executing program 1 (id=14): mknod(0x0, 0x2000, 0x5900) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {0x2, 0x0, 0x0, 0x3}]}) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x11}, 0x4000000000000006, 0x0, 0x0, 0x0, 0x0) open(0x0, 0x8, 0x9bf2d372586474f1) socket(0x18, 0x1, 0x0) ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, 0x0) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc5005601, &(0x7f0000000000)={0x10, 0x0, [{&(0x7f0000462000/0x2000)=nil, &(0x7f000057e000/0x2000)=nil, 0x1}, {&(0x7f0000ffd000/0x1000)=nil}, {&(0x7f00000cf000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0xfffffffffffffffd}, {0x0, &(0x7f00004f5000/0x4000)=nil, 0x10000}, {&(0x7f0000000000/0x2000)=nil, &(0x7f0000181000/0x1000)=nil, 0x1}, {&(0x7f0000000000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x2}, {&(0x7f000028c000/0x4000)=nil, &(0x7f000028b000/0x3000)=nil, 0xe04}, {&(0x7f00003de000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil}, {&(0x7f0000065000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0xffffffffffffffff}, {&(0x7f0000523000/0x1000)=nil, &(0x7f0000063000/0x13000)=nil}, {&(0x7f0000181000/0x3000)=nil, &(0x7f0000156000/0x1000)=nil, 0x6}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000463000/0x1000)=nil, 0x8}, {&(0x7f00004c1000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x1ffffffff}, {&(0x7f00004c1000/0x2000)=nil, &(0x7f000006c000/0x4000)=nil, 0x2}, {&(0x7f00001cf000/0x4000)=nil, &(0x7f0000463000/0x3000)=nil, 0x4}, {&(0x7f00000cf000/0x1000)=nil, &(0x7f000028b000/0x4000)=nil, 0x9}], './file0\x00'}) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x2, 0x0) ioctl$FIONREAD(r0, 0xc028698d, &(0x7f0000000000)) r1 = socket(0x18, 0xc003, 0x3a) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0x66, 0x0, 0x0) setsid() ioctl$TIOCSCTTY(0xffffffffffffffff, 0x20007461) ioctl$WSMOUSEIO_SRES(0xffffffffffffffff, 0x80045721, &(0x7f0000000080)=0x5) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, 0x0) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000000c0)={0x10, 0xfffffffffffffffd, [{&(0x7f00000c7000/0x3000)=nil, &(0x7f0000ff6000/0x6000)=nil, 0x1}, {&(0x7f00004d7000/0x2000)=nil, &(0x7f0000698000/0x1000)=nil, 0x4}, {&(0x7f00005fd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0xf}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x80}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f00005dd000/0x3000)=nil, 0xc}, {&(0x7f0000ff3000/0x1000)=nil, &(0x7f000068e000/0x12000)=nil, 0x2000000000000000}, {&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff2000/0x2000)=nil, 0x40000000000007}, {&(0x7f0000636000/0x2000)=nil, &(0x7f0000696000/0x2000)=nil, 0xffffffffffffffff}, {&(0x7f0000696000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x7}, {&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x8}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000695000/0x1000)=nil, 0xffffffff}, {&(0x7f00007f8000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0xc}, {&(0x7f00000c6000/0x2000)=nil, &(0x7f0000668000/0x4000)=nil}, {&(0x7f0000669000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4}, {&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil}, {&(0x7f0000ff1000/0x1000)=nil, &(0x7f0000abf000/0x3000)=nil, 0x1ff}], './file0\x00', 0x8, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ff, 0xc5, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x44, 0x0, 0x0, 0x2, 0x94fd, 0xffffb6df, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x2, 0x2, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4, 0xae9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffe, 0xffffff49, 0x9, 0x8000009, 0xfffffffd, 0x0, 0x6, 0xffc, 0x0, 0x4, 0x0, 0x5, 0xffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200, 0x3, 0x0, 0x5, 0x0, 0x400, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0xfffffffe, 0xffffffff, 0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffff001, 0x80, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x70000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x3d, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xfffffffd, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x7, 0xfffff800, 0xd11, 0x0, 0x0, 0x10000, 0x20000000, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4, 0xffffffff, 0x400010, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0xfffffffc, 0x0, 0x20000000, 0x0, 0x3, 0x0, 0xffffffff, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x78a09c5a, 0x0, 0x0, 0x0, 0x0, 0xfdf7fffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffc, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffc, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6453, 0x0, 0x2, 0x7a1, 0x6, 0x2, 0x80000000, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x802, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0x9, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x1000, 0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x2, 0x0, 0x9, 0x800, 0x0, 0x5, 0x808, 0x0, 0x0, 0x3, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x8, 0x0, 0xfffffffe, 0x0, 0x100, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0xaa6, 0x0, 0x0, 0x0, 0x0, 0x6, 0x9, 0x1, 0x0, 0x7, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb2, 0x0, 0x0, 0x0, 0xffffffff, 0x398, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3ff, 0x0, 0x15]}) bind$unix(0xffffffffffffffff, 0x0, 0x0) r2 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x7e, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x58}, 0x2, 0x0, 0x0, 0x0, 0x0) chroot(0x0) ioctl$DIOCGETSYNFLWATS(r2, 0xc0084463, 0x0) ioctl$TIOCSETA(r2, 0xcd60441a, &(0x7f0000000080)={0x1, 0x2, 0x7, 0x2f, "2000030100010000000000000068a95a010400", 0x6, 0x2}) socket$inet(0x2, 0x8003, 0x0) r3 = socket$inet(0x2, 0x3, 0x40) sendto$inet(r3, 0x0, 0x0, 0xa, &(0x7f00000002c0)={0x10, 0x2, 0x2, 0xffffffff}, 0x10) 68.672979ms ago: executing program 3 (id=4): chmod(&(0x7f0000000040)='.\x00', 0x35e) setuid(0xee01) (async) setuid(0xee01) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) link(&(0x7f0000000380)='./file2\x00', &(0x7f00000001c0)='./file2\x00') rename(&(0x7f0000000e40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000580)='./file2\x00') rename(&(0x7f0000000200)='./file2\x00', &(0x7f0000000600)='./file0\x00') openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$DIOCSETIFFLAG(r0, 0xc0284459, &(0x7f0000000180)={'./file2\x00', &(0x7f0000000080)=""/139, 0x6, 0x80000000, 0x647, 0x81}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x44) rename(&(0x7f0000000140)='./file0\x00', &(0x7f0000000340)='./file2\x00') (async) rename(&(0x7f0000000140)='./file0\x00', &(0x7f0000000340)='./file2\x00') 2.448805ms ago: executing program 0 (id=15): socket(0x18, 0x3, 0x7) (async) r0 = socket(0x18, 0x3, 0x7) getsockopt(r0, 0x6, 0xb, 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x8, 0x40) 1.460725ms ago: executing program 1 (id=16): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000980), 0x800, 0x0) ioctl$BIOCLOCK(r0, 0x20004276) ioctl$BIOCGRSIG(r0, 0x40044273, &(0x7f0000000040)) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xfffffff9, 0xffff63db, 0x17, 0x808, 0x8, 0x0, 0x7fffffff, 0x10, [{0x8, 0x10000, 0xfffff115, 0x101}, {0x0, 0xffffffff, 0x200100, 0xffd}, {0xcd8, 0x4b8a, 0x4, 0x3}, {0x7fff, 0x8020fe, 0x13, 0x2000100}, {0x6, 0x2000007, 0x8, 0x5}, {0x7f, 0xfffd, 0x6, 0x40000029}, {0x10004, 0xa00, 0x3, 0xfffffffb}, {0x207, 0xffffffff, 0x4, 0xffffe2e9}, {0x9, 0x1004, 0x5, 0x7fff}, {0xfe29, 0xfffff001, 0x7, 0xfffffd76}, {0x3, 0x0, 0x8a3a0004, 0x2000a}, {0x8010000, 0x7, 0x1, 0xa6a}, {0x401, 0x3, 0x7f, 0x4}, {0x3, 0x400022, 0xfffffffd, 0x6f5fc48f}, {0x3, 0xff, 0x3, 0x9}, {0x6, 0x7d, 0xfffffffe, 0xb}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x33}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x18, 0x0, 0xffffffffffffffb8) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0xb}, 0x4, 0x0, 0x0, &(0x7f0000000040)="be0673a8", 0x4) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BIOCIMMEDIATE(r1, 0x80044270, &(0x7f00000000c0)=0x4e) openat$bpf(0xffffffffffffff9c, &(0x7f0000000980), 0x800, 0x0) (async) ioctl$BIOCLOCK(r0, 0x20004276) (async) ioctl$BIOCGRSIG(r0, 0x40044273, &(0x7f0000000040)) (async) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xfffffff9, 0xffff63db, 0x17, 0x808, 0x8, 0x0, 0x7fffffff, 0x10, [{0x8, 0x10000, 0xfffff115, 0x101}, {0x0, 0xffffffff, 0x200100, 0xffd}, {0xcd8, 0x4b8a, 0x4, 0x3}, {0x7fff, 0x8020fe, 0x13, 0x2000100}, {0x6, 0x2000007, 0x8, 0x5}, {0x7f, 0xfffd, 0x6, 0x40000029}, {0x10004, 0xa00, 0x3, 0xfffffffb}, {0x207, 0xffffffff, 0x4, 0xffffe2e9}, {0x9, 0x1004, 0x5, 0x7fff}, {0xfe29, 0xfffff001, 0x7, 0xfffffd76}, {0x3, 0x0, 0x8a3a0004, 0x2000a}, {0x8010000, 0x7, 0x1, 0xa6a}, {0x401, 0x3, 0x7f, 0x4}, {0x3, 0x400022, 0xfffffffd, 0x6f5fc48f}, {0x3, 0xff, 0x3, 0x9}, {0x6, 0x7d, 0xfffffffe, 0xb}]}) (async) sysctl$kern(&(0x7f00000000c0)={0x1, 0x33}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x18, 0x0, 0xffffffffffffffb8) (async) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0xb}, 0x4, 0x0, 0x0, &(0x7f0000000040)="be0673a8", 0x4) (async) openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$BIOCIMMEDIATE(r1, 0x80044270, &(0x7f00000000c0)=0x4e) (async) 443.573µs ago: executing program 3 (id=17): sysctl$kern(&(0x7f0000000080)={0x1, 0x16}, 0x2, &(0x7f00000000c0), 0x0, &(0x7f00000001c0), 0x0) sysctl$net_inet_ip(0x0, 0x0, &(0x7f00000000c0)="97e0c035", 0x0, 0x0, 0x0) r0 = setsid() setpgid(0x0, r0) r1 = syz_open_pts() ioctl$TIOCSETAW(r1, 0x80047476, &(0x7f00000005c0)={0x1, 0x2, 0x5d, 0xfffffff9, "8f73727b6cc01b2120c84e958d24047f24cf4d62", 0x9, 0x9}) r2 = kqueue() kevent(r2, &(0x7f0000000000)=[{{r2}, 0xfffffffffffffff6, 0x8b, 0x1, 0x3, 0x3}], 0x8, 0x0, 0x15, 0x0) closefrom(r2) r3 = socket(0x6, 0x5, 0x0) sysctl$net_inet_ip(&(0x7f0000000000)={0x4, 0x2, 0x0, 0x29}, 0x4, &(0x7f00000001c0)="0d87c8e9778247182c8f618384eda1f1a163b47909440ed82fb3e1f063e89def9ad35c5b5918825b993d4aed514e3dffd0a962df7e36ba56c9dec801cebc6218f195ab62ff08044171b0b45a5974de0f35d1888bcde7c0a3d5961585b922a3fb81dd2e349e18e5bf965d", &(0x7f0000000100)=0x6a, &(0x7f0000000340)="b3f8828f91d2de32cbabdeb248c7af9c6ea412fd0ec077121e1c18d9f2496998428bfddab08b96334feaef3026835ca0b4fe8468a7f3a067193d5a1b1b867afe73f0ba25a828c32472591afc79460841ae7826bb9c4796f0e2ad89d8619b4c610999020df20361da150711e5f650feeba346de932c61ea28e4735c446b6b35caaf31c51fd49d8b12220013d430cfcc5ba3e770b2e6850c3c0ac22174d92d7f5e04fcfd3d501183c7c7740369cdcf72aaf067d9c71fb1b4b3c82744fac9ddbe17daad984b8e232c51b3f16668925ed32fd330c33d820ce6f78168c1e25de38a5bbedb5541d9ddbb4b3e3e8ddb9eb431cda2d191e4e58cda218c950d198409c6a2dff493a450ffb4ef88a1469b03dde359838df5e761c12087fe620b988d486e8c2f119d1468a40eb905559cd436200b026a8a39d6044c139a44841fcd7d596288f9c7bba2859cf76b965013f223fd40c306d65dc5a3fe5477f7c89888788881828d8baedfe19cad260513f51c5736442fed5e09973cb1cc14de6ff4269455f23e547fdbd8ac2da5068e", 0x189) close(r3) socket(0x2, 0x5001, 0x0) connect$unix(r3, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) 0s ago: executing program 4 (id=5): chflags(0x0, 0x10001) r0 = socket(0x2, 0xc003, 0x2) (async, rerun: 32) r1 = socket(0x18, 0x1, 0x0) (rerun: 32) setsockopt(r1, 0x1000000000029, 0xa, &(0x7f0000000040)="03000000", 0x4) (async) r2 = socket(0x18, 0x3, 0x0) setsockopt(r2, 0x1000000029, 0xc, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) (async) setsockopt(r2, 0x1000000029, 0xc, &(0x7f0000000040), 0x0) connect(r2, &(0x7f0000000000)=@in6={0x1c, 0x18, 0x2, 0x3, "bf910c3228977958ace07c8d32add287", 0x86b}, 0x1c) (async) closefrom(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.59' (ED25519) to the list of known hosts. Data modified on freelist: word -35183597971728 of object 0xffff800000c43af0 size 0x10 previous type free (invalid addr 0xaddb3cb5734f0cd3) kernel: protection fault trap, code=0 Stopped at malloc+0x855: movq 0x8(%rbx),%r14 ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> show kasan No such command ddb{1}> trace malloc(10,7f,1) at malloc+0x855 ktrsyscall(ffff80002a222540,67,8,ffff80002a2ac030) at ktrsyscall+0x19a syscall(ffff80002a2ac030) at syscall+0x305 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x717ed9bf2a10, count: -4 ddb{1}> show registers rdi 0xaddb3cb5734f0cd3 rsi 0 rbp 0xffff80002a2abe70 rbx 0xaddb3cb5734f0cd3 rdx 0 rcx 0xffff80002a222540 rax 0xffff80002999dff0 r8 0 r9 0 r10 0 r11 0xea6e90fe8b7d1056 r12 0 r13 0xffffffff83b08000 kmemstats+0x1fc0 r14 0xa30c333 __kernel_phys_end+0x670c333 r15 0xaddb3cb5734f0cd3 rip 0xffffffff82fe67e5 malloc+0x855 cs 0x8 rflags 0x10282 __ALIGN_SIZE+0xf282 rsp 0xffff80002a2abdb0 ss 0x10 malloc+0x855: movq 0x8(%rbx),%r14 ddb{1}> show proc PROC (syz-executor) tid=420950 pid=61871 tcnt=1 stat=onproc flags process=10000002 proc=1 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045ffd9f8,0xffff80002a222a80 process=0xffff800045ff0e80 user=0xffff80002a2a7000, vmspace=0xffffee006f0ab010 estcpu=15, cpticks=8, pctcpu=0.5, user=0, sys=7, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 46382 200225 32689 0 2 0 syz-executor 34169 102098 20575 0 2 0 syz-executor 65723 135859 64834 0 2 0 syz-executor 65723 264972 64834 0 3 0x4000080 fsleep syz-executor 65723 464176 64834 0 3 0x4000080 pipewr syz-executor 52736 58473 4102 0 2 0 syz-executor 52736 366951 4102 0 3 0x4000080 ttyout syz-executor 80813 129885 28781 0 3 0x80 nanoslp syz-executor 80813 289321 28781 0 3 0x4000080 msgwait syz-executor 80813 32178 28781 0 3 0x4000080 fsleep syz-executor 80307 519726 51058 0 3 0x100082 sbwait arp 51058 377865 41111 0 3 0x10008a sigsusp sh 4102 106819 91028 0 3 0x82 nanoslp syz-executor 41111 329565 91028 0 3 0x82 wait syz-executor 64834 195725 91028 0 3 0x82 nanoslp syz-executor 32689 334186 91028 0 2 0x2 syz-executor 20575 272264 91028 0 2 0x2 syz-executor 28781 468923 91028 0 3 0x82 nanoslp syz-executor 65017 341445 91028 0 3 0x82 nanoslp syz-executor *61871 420950 91028 0 7 0x10000003 syz-executor 91028 32046 80997 0 3 0x82 kqread syz-executor 80997 189199 14900 0 3 0x10008a sigsusp ksh 14900 418551 29889 0 3 0x98 kqread sshd-session 29889 509132 39525 0 3 0x92 kqread sshd-session 16109 469222 1 0 3 0x100083 ttyin getty 39525 458813 1 0 3 0x88 kqread sshd 15538 330621 17653 74 3 0x1100092 bpf pflogd 17653 107022 1 0 3 0x80 sbwait pflogd 48061 449266 91847 73 3 0x1100090 kqread syslogd 91847 183560 1 0 3 0x100082 sbwait syslogd 31062 311868 1 0 3 0x100080 kqread resolvd 18706 92093 85119 77 3 0x100092 kqread dhcpleased 28702 422987 85119 77 3 0x100092 kqread dhcpleased 85119 75569 1 0 3 0x80 kqread dhcpleased 14559 438074 0 0 3 0x14200 bored smr 66004 368375 0 0 2 0x14200 zerothread 91483 134723 0 0 3 0x14200 aiodoned aiodoned 94968 90937 0 0 3 0x14200 syncer update 20531 440900 0 0 3 0x14200 cleaner cleaner 10510 309050 0 0 2 0x14200 reaper 59385 391370 0 0 3 0x14200 pgdaemon pagedaemon 88965 505386 0 0 3 0x14200 bored viomb 63932 210429 0 0 3 0x40014200 acpi0 acpi0 93809 294535 0 0 3 0x40014200 idle1 52447 282672 0 0 3 0x14200 bored softnet1 74251 72879 0 0 3 0x14200 bored softnet0 59096 418391 0 0 3 0x14200 smrbar systqmp 57094 15402 0 0 3 0x14200 bored systq 17019 147351 0 0 3 0x14200 tmoslp softclockmp 17332 221938 0 0 3 0x40014200 tmoslp softclock 60478 450510 0 0 3 0x40014200 idle0 1 315436 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks CPU 0: exclusive mutex amapchunkpl r = 0 (0xffffffff83b08e88) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 pool_put+0xa6 #3 amap_free+0x1c7 #4 uvm_unmap_detach+0x8a #5 uvm_map_teardown+0x360 #6 exit1+0x71b #7 sys_exit+0x1a #8 syscall+0xb17 #9 Xsyscall+0x128 CPU 1: exclusive mutex /syzkaller/managers/multicore/kernel/sys/kern/kern_malloc.c:96 r = 0 (0xffffffff839b0038) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 malloc+0x2ef #3 ktrsyscall+0x19a #4 syscall+0x305 #5 Xsyscall+0x128 Process 59096 (systqmp) thread 0xffff800045ffe000 (418391) shared rwlock systqmp r = 0 (0xffffffff838f8528) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11058 12087K 12101K 166960K 12156 0 pcb 17 12K 12K 166960K 28 0 rtable 221 6K 6K 166960K 338 0 pf 34 17K 18K 166960K 50 0 ifaddr 41 7K 7K 166960K 44 0 ifgroup 55 2K 2K 166960K 60 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 72 0 ioctlops 0 0K 4K 166960K 1485 0 iov 0 0K 1K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1293 81K 81K 166960K 1380 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 15 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 17 61K 89K 166960K 142 0 proc 70 115K 180K 166960K 545 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 1 0 in_multi 89 6K 6K 166960K 89 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 2 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 49 228K 228K 166960K 49 0 exec 0 0K 1K 166960K 391 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 240 161K 170K 166960K 3176 0 UVM aobj 36 2K 2K 166960K 37 0 pinsyscall 43 86K 104K 166960K 1329 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 18 0K 1K 166960K 27 0 temp 37 9114K 9120K 166960K 5469 0 kqueue 13 20K 22K 166960K 26 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 37 0 33 1 0 1 1 0 8 0 rtentry 176 103 0 1 5 0 5 5 0 8 0 unpcb 144 40 0 23 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 10 0 6 1 0 1 1 0 8 0 arp 136 17 0 0 1 0 1 1 0 8 0 inpcb 328 77 0 69 2 0 2 2 0 8 1 nd6 152 21 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pftag 88 2 0 0 1 0 1 1 0 8 0 pfstitem 24 19 0 0 1 0 1 1 0 8 0 pfstkey 128 19 0 0 1 0 1 1 0 8 0 pfstate 448 19 0 0 3 0 3 3 0 8 0 pfrule 1360 23 0 17 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 412 0 0 26 0 26 26 0 8 0 art_table 40 413 0 0 5 0 5 5 0 8 0 art_node 32 103 0 8 1 0 1 1 0 8 0 sysvmsgpl 40 1 0 0 1 0 1 1 0 8 0 shmpl 112 34 0 1 1 0 1 1 0 8 0 dirhash 1024 19 0 2 3 0 3 3 0 8 0 dino2pl 256 1595 0 126 93 0 93 93 0 8 0 ffsino 296 1595 0 126 114 0 114 114 0 8 0 nchpl 144 1800 0 100 64 0 64 64 0 8 0 vnodes 216 1688 0 0 94 0 94 94 0 8 0 namei 1024 5647 0 5647 2 0 2 2 0 8 2 percpumem 16 52 0 1 1 0 1 1 0 8 0 kstatmem 264 29 0 2 2 0 2 2 0 8 0 scxspl 216 6298 0 6298 4 3 1 3 1 8 1 plimitpl 152 31 0 13 1 0 1 1 0 8 0 sigapl 424 471 0 422 7 0 7 7 0 8 0 knotepl 120 56 0 0 2 0 2 2 0 8 0 kqueuepl 224 23 0 14 1 0 1 1 0 8 0 pipepl 344 132 0 104 3 0 3 3 0 8 0 fdescpl 528 455 0 424 3 0 3 3 0 8 0 filepl 160 1728 0 1509 11 0 11 11 0 8 1 lockfpl 104 14 0 12 1 0 1 1 0 8 0 lockfspl 48 8 0 6 1 0 1 1 0 8 0 sessionpl 144 25 0 16 1 0 1 1 0 8 0 pgrppl 48 33 0 16 1 0 1 1 0 8 0 ucredpl 104 131 0 118 1 0 1 1 0 8 0 zombiepl 144 424 0 422 1 0 1 1 0 8 0 processpl 1232 471 0 422 5 0 5 5 0 8 0 procpl 664 495 0 440 5 0 5 5 0 8 0 sockpl 752 154 0 125 4 0 4 4 0 8 0 mcl64k 65536 3 0 0 1 0 1 1 0 8 0 mcl16k 16384 3 0 0 1 0 1 1 0 8 0 mcl9k128 9344 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 111 0 0 14 0 14 14 0 8 0 mcl2k 2048 27 0 0 4 0 4 4 0 8 0 mextrefs 64 27 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 223 0 0 14 0 14 14 0 8 0 bufpl 272 2331 0 105 149 0 149 149 0 8 0 anonpl 32 3711 0 0 30 0 30 30 0 247 0 amapchunkpl 152 8734 0 8255 20 0 20 20 0 158 0 amappl16 200 1527 0 1510 5 1 4 5 0 8 3 amappl15 192 1 0 1 1 1 0 1 0 8 0 amappl14 184 437 0 435 1 0 1 1 0 8 0 amappl13 176 128 0 115 1 0 1 1 0 8 0 amappl12 168 710 0 679 2 0 2 2 0 8 0 amappl11 160 5 0 5 1 1 0 1 0 8 0 amappl10 152 66 0 52 1 0 1 1 0 8 0 amappl9 144 276 0 276 1 1 0 1 0 8 0 amappl8 136 101 0 98 1 0 1 1 0 8 0 amappl7 128 149 0 135 1 0 1 1 0 8 0 amappl6 120 150 0 148 1 0 1 1 0 8 0 amappl5 112 99 0 89 1 0 1 1 0 8 0 amappl4 104 317 0 297 1 0 1 1 0 8 0 amappl3 96 1522 0 1413 3 0 3 3 0 8 0 amappl2 88 557 0 496 2 0 2 2 0 8 0 amappl1 80 10674 0 10051 15 0 15 15 0 8 1 amappl 88 2431 0 2267 4 0 4 4 0 92 0 uvmvnodes 80 100 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 36 0 1 1 0 1 1 0 8 0 uaddrrnd 24 455 0 424 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 455 0 424 1 0 1 1 0 8 0 vmmpekpl 168 5800 0 5766 2 0 2 2 0 8 0 vmmpepl 168 38549 0 36653 88 0 88 88 0 357 3 vmsppl 488 454 0 423 5 0 5 5 0 8 0 rwobjpl 80 14608 0 13523 24 0 24 24 0 8 0 pdppl 4096 917 0 846 99 20 79 83 0 8 8 pvpl 32 10236 0 0 84 0 84 84 0 265 1 pmappl 256 454 0 423 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 421 0 23 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{0}> trace x86_ipi_db(ffffffff838ebff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 pool_do_put(ffffffff83b08e70,ffffee006cdee3a0) at pool_do_put+0x180 pool_put(ffffffff83b08e70,ffffee006cdee3a0) at pool_put+0xba amap_free(ffffee006d7134e0) at amap_free+0x1c7 uvm_unmap_detach(ffff800039fb4200,0) at uvm_unmap_detach+0x8a uvm_map_teardown(ffffee006cda3020) at uvm_map_teardown+0x360 exit1(ffff80002a2207e0,b,0,1) at exit1+0x71b sys_exit(ffff80002a2207e0,ffff800039fb43d0,ffff800039fb4320) at sys_exit+0x1a syscall(ffff800039fb43d0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7c22da690fc0, count: -12 ddb{0}> machine ddbcpu 1 Stopped at malloc+0x855: movq 0x8(%rbx),%r14 ddb{1}> trace malloc(10,7f,1) at malloc+0x855 ktrsyscall(ffff80002a222540,67,8,ffff80002a2ac030) at ktrsyscall+0x19a syscall(ffff80002a2ac030) at syscall+0x305 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x717ed9bf2a10, count: -4