last executing test programs: 6.6434042s ago: executing program 1 (id=1443): mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x0) r0 = open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0) fcntl$setown(r0, 0x6, 0xffffffffffffffff) 6.61480863s ago: executing program 1 (id=1445): r0 = getpgrp() msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0x57, 0x0, 0x0, 0x0, 0x0, 0x131, 0xe2f}, 0x3a0, 0xfffffffffffffffb, 0x0, 0x10000, 0x6, 0x40000000000d, r0, 0x8000000000000001, 0x0, 0x4, 0x0, 0x4}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x42}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x1918, 0x0, 0x37) 6.592317429s ago: executing program 1 (id=1448): r0 = syz_open_pts() ioctl$TIOCSETAW(r0, 0x802c7415, &(0x7f0000000040)={0x2ec8, 0xb, 0x1, 0x4, "d0c66119d85cfdb41ee9eae6471312058eaca17d", 0x941, 0x4}) ioctl$TIOCCLRVERAUTH(r0, 0x2000741d) 6.573152482s ago: executing program 1 (id=1452): setuid(0xffffffffffffffff) r0 = socket(0x11, 0x3, 0x0) sendto$unix(r0, &(0x7f00000000c0)="b10005010000009f18003f0107000000211c13fecea79c5dfaf66e8d030100000000000000ef3044d2d236acf20bf404be01000000f7c8cf5f8823297be1aa0504000051e2f0ad3ebbc25769a51f139b672f335c22db830c032bfa896443c32118210000720fd38bfb0000fd54c125191b1257aea8c500001602fbfe0c2300008abf090000000008e37193f8343712050500b71d8000090005080000fca65361ba84913f01000008000000000000000000", 0xb1, 0x408, 0x0, 0x0) 6.554066645s ago: executing program 1 (id=1454): r0 = syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000080)={0x2fffc, 0x4b6b, 0xfff6, 0x21d8b788, "2707a460990d000009000000fff7ff00", 0x89, 0x869}) ioctl$TIOCSTAT(r0, 0x20007465) 2.027969789s ago: executing program 4 (id=1967): chmod(&(0x7f0000000040)='.\x00', 0x35e) setuid(0xee01) open(&(0x7f0000000300)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7815) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 2.016728631s ago: executing program 4 (id=1972): r0 = socket(0x2, 0x3, 0x2f) r1 = dup(r0) setsockopt$inet_opts(r1, 0x0, 0x22, &(0x7f0000000040)="fd0cc085", 0x4) sendto$inet(r1, &(0x7f0000000080)="36e6224acc6758e5dd", 0x9, 0x6, &(0x7f0000000280)={0x10, 0x2, 0x0, 0x63e8}, 0x10) 2.005725126s ago: executing program 4 (id=1975): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000580)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)={{0x10001, 0x0, r1, 0x0, 0x0, 0x81}, 0x20000000000}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x4e}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afed37082", &(0x7f0000000180)=0x5, 0x0, 0x27) 1.996029456s ago: executing program 4 (id=1978): ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000200)={0x2, &(0x7f0000000600)=[{0x54, 0xfd, 0xf, 0x5}, {0x9b1e, 0x4, 0xf4, 0x4}]}) r0 = socket(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x1, 0x200000e3}, 0x10) sendmmsg(r0, &(0x7f0000000480)={{0x0, 0x0, 0x0, 0x0, 0x0}}, 0x38, 0x404) 1.982081449s ago: executing program 4 (id=1980): setgroups(0x1, &(0x7f0000000240)=[0xffffffffffffffff]) setuid(0xee01) r0 = syz_open_pts() fchmod(r0, 0x34) 1.964511212s ago: executing program 4 (id=1984): setsid() r0 = syz_open_pts() ioctl$TIOCSCTTY(r0, 0x20007461) ioctl$TIOCSTAT(r0, 0x20007465) 1.591236219s ago: executing program 0 (id=2019): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000140), 0x10, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000040)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000000)={0x3, &(0x7f0000000280)=[{0x0, 0xfe, 0x14, 0x8}, {0x3c, 0x54, 0x5, 0x209}, {0x16, 0x24, 0x9, 0x9}]}) syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x8, 0xff, 0x0, @local={0xac, 0x14, 0x0}, @rand_addr=0xac1400ff}, @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x8, 0xff, 0x0, 0x8}}}}}}) 1.564172731s ago: executing program 0 (id=2021): r0 = msgget$private(0x0, 0x1ba) msgrcv(r0, 0x0, 0x0, 0x3, 0x1000) msgrcv(r0, 0x0, 0x0, 0x0, 0x1000) msgctl$IPC_RMID(r0, 0x0) 1.562162421s ago: executing program 6 (id=2022): r0 = syz_open_pts() syz_open_pts() syz_open_pts() flock(r0, 0x3) 1.484138487s ago: executing program 6 (id=2028): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x5) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3d, 0x3c, 0x68, 0x0, 0x0, 0x6, 0x0, @remote={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}}, @tcp={{0x3, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x2, 0x3, 0x0, 0xfffc, {[@md5sig={0x13, 0x12, "3661cad9fa3241305fbda5cbfab19081"}, @sack={0x5, 0x2}]}}}}}}}) 1.455289177s ago: executing program 6 (id=2031): r0 = openat$klog(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xa, 0x8, 0x7, 0x2, 0x8, 0x3, 0x40, 0x10, [{0x3, 0xffff, 0x7fff, 0x80000202}, {0x4, 0x8, 0x6, 0xfff}, {0x1, 0xfffffffe, 0x6, 0x2}, {0x1000002, 0xdf, 0xf, 0x40}, {0x4, 0x7, 0xf11, 0x7}, {0x800, 0x0, 0x80cf}, {0x7, 0x5, 0x87, 0x2}, {0x4, 0xfffffffe, 0xfffffffa, 0xfbffe2e9}, {0x8, 0xffe, 0x6, 0x17fff}, {0x101, 0x0, 0x5, 0x7}, {0x8, 0x8000004, 0x8, 0x7}, {0x4, 0xc7cb, 0x800000, 0xa66}, {0x401, 0x10a, 0x6, 0x9}, {0x200003, 0x0, 0x6, 0x5}, {0x81, 0x5, 0x3, 0x7fff}, {0xffffffff, 0x8005, 0x6, 0x69}]}) poll(&(0x7f0000000000), 0x35, 0x0) closefrom(r0) 1.452839951s ago: executing program 6 (id=2033): ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) r0 = socket(0x18, 0xc003, 0x3a) setsockopt(r0, 0x29, 0x6c, &(0x7f0000000040), 0x4) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0x69, 0x0, 0x0) 1.435535224s ago: executing program 6 (id=2036): ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f00000000c0)={0xa, 0x8000148, {[0x3, 0x40, 0x6, 0x6, 0x3, 0x8000, 0x6, 0x40000000000, 0x7, 0x2, 0x9, 0x91c, 0x8, 0x2000180, 0x0, 0xd3, 0x76, 0xffffffffffffbff7], [0x5438b950, 0x5, 0x1004, 0x7, 0x1, 0x1, 0x9, 0x2, 0xffffffffffffffff, 0x3], [0x6, 0x0, 0x8, 0x8000000008, 0x10000, 0x210, 0x1000002], [0x40100000000, 0x10801, 0x0, 0x5, 0x3], [{0x0, 0x7, 0xfffffbfb, 0x5}, {0x2, 0x925, 0x3, 0x338}, {0x1000, 0x7fffffff, 0x0, 0x5}, {0xb, 0xfffffbff, 0x2, 0x1}, {0x4, 0x3, 0x2, 0x8}, {0x1f, 0x4, 0x0, 0x7}, {0xe4, 0xffffff81, 0x1ff, 0x1}, {0x7, 0x10000, 0x8001, 0x5}], {0x52b, 0x4, 0x401, 0x4}, {0xfffb, 0xffffbfc0, 0x8}}}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x45}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$kern(&(0x7f00000000c0)={0x1, 0x4e}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afed37082", &(0x7f0000000180)=0x5, 0x0, 0x27) 1.372574287s ago: executing program 3 (id=2043): mkdir(&(0x7f0000000500)='./file0\x00', 0xa1) r0 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) mkfifoat(r0, &(0x7f00000000c0)='./file0\x00', 0x2) rmdir(&(0x7f0000000180)='./file0\x00') 1.330381431s ago: executing program 3 (id=2045): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x0, 0x8}, {0x3}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x33}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sysctl$kern(&(0x7f00000000c0)={0x1, 0x5a}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x3414, 0x0, 0x37) 1.330025538s ago: executing program 0 (id=2047): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x7, 0x1c, 0x26, 0x1204}, {0x4d, 0x0, 0x0, 0x200040c2}, {0x9b1e, 0x7, 0xff, 0x200004}]}) syz_emit_ethernet(0x3e, &(0x7f0000001200)=ANY=[]) 1.314626041s ago: executing program 3 (id=2049): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5900) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$BIOCSETIF(r0, 0x80084904, &(0x7f0000000380)={'tap', 0x0}) closefrom(r0) 1.285039171s ago: executing program 0 (id=2050): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000b40)="825a4f47c21e6ed7eda0f5903abf65b18d7c51f78b0400ffb40500000000000000000000fafd3493776665d4cd12c63d34", 0x31}], 0x1, 0x0, 0x0, 0x2}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000b80)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "01a724", 0x30, 0x3b, 0x2, @rand_addr="f3d41bdf444d9cb0a4cea51593273637", @local={0xfe, 0x80, '\x00', 0x0}, {[], @icmpv6=@param_prob={0x4, 0x0, 0x0, 0x28, {0x0, 0x6, "d21b9e", 0x5, 0x16, 0x7, @local={0xfe, 0x80, '\x00', 0x0}, @ipv4={'\x00', '\xff\xff', @multicast2}}}}}}}}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000700), 0x8, 0x0) ioctl$TIOCSETA(r0, 0xc4504446, &(0x7f0000000740)={0x2f, 0x3, 0x2, 0x5, "97a2224fd5c14649ebb178926cc9795a6b47c1cf", 0x8000, 0x1000}) 1.284805131s ago: executing program 3 (id=2052): ioctl$DRM_IOCTL_MODE_CURSOR2(0xffffffffffffffff, 0xc02464bb, &(0x7f0000000080)={0x3, 0x7, 0x0, 0x173, 0x800, 0x4, 0x0, 0x5, 0x3}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x14}, 0x2, &(0x7f0000000100)="4ba7841143", &(0x7f0000000040)=0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$kern(&(0x7f0000000100)={0x1, 0x5a}, 0x2, 0x0, 0x0, &(0x7f0000000080)="13108a5b", 0x4) 1.284693017s ago: executing program 0 (id=2053): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x0, 0x0, 0x2}, {0x1, 0x0, 0x0, 0x1}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x59}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) sysctl$kern(&(0x7f00000000c0)={0x1, 0x4e}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000180)=0x66, 0x0, 0x27) 1.284052794s ago: executing program 3 (id=2054): r0 = syz_open_pts() fcntl$lock(r0, 0x8, &(0x7f0000000000)={0x3, 0x2, 0x9, 0x100030000007c}) fcntl$lock(r0, 0x8, &(0x7f0000000080)={0x0, 0x0, 0x300, 0x100000001}) fcntl$lock(r0, 0x9, &(0x7f00000001c0)={0x3, 0x0, 0x300, 0x300000003}) 1.265764805s ago: executing program 0 (id=2056): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x4c, 0x7, 0x3, 0x4}, {0x1, 0x9, 0xff}, {0x6, 0x80, 0x3, 0xfffff802}]}) syz_emit_ethernet(0x4a, &(0x7f0000001600)=ANY=[]) 1.155744423s ago: executing program 3 (id=2058): r0 = syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000340)={0x5, 0x80000000, 0xfffffffe, 0x966b, "ff14e7130b1e586ca6294000", 0x44, 0x2}) syz_open_pts() ioctl$TIOCSTAT(r0, 0x20007465) 1.155381591s ago: executing program 6 (id=2060): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x2015, r0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0) 1.151598113s ago: executing program 1 (id=2061): ioctl$VMM_IOC_RESETCPU(0xffffffffffffff9c, 0x82405605, &(0x7f0000000100)={0xfffffffc, 0x6, {[0xfffffbfffffffffb, 0x0, 0x7, 0x100000000, 0x6, 0xf3e5, 0xdf5c, 0xfffffffffffffffe, 0x200, 0x2eff, 0xfffffffffffffffc, 0x9, 0xffffffffffbffff6, 0xa, 0x80, 0x200, 0xffffffffffffffff, 0x100], [0xbc, 0x80000001, 0xfffffffffffffffd, 0xe3e, 0x5d, 0x6, 0x200, 0x0, 0x2000020000004, 0x9], [0x10000000, 0x2, 0xaf2, 0x0, 0xfffffffffffffffc, 0x10fff, 0xffffffff00000000], [0x1, 0xee97, 0x7ffffffffffffffc, 0x9, 0x9], [{0x80, 0xfeffffe7, 0x8, 0x7d06}, {0xfffc, 0x2, 0x7, 0x1}, {0x4, 0x900, 0x6b0, 0x83}, {0x3, 0x7, 0x6, 0xfffffffffffffff7}, {0x0, 0x3, 0x2, 0x200000000008}, {0x0, 0xfffffffb, 0x9, 0x2fa}, {0x1ffd, 0x101, 0x7, 0x3}, {0x0, 0x100, 0x4, 0x9}], {0x0, 0x6, 0x5, 0x36f}, {0x3, 0x80000004, 0x1000}}}) mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) 1.137366176s ago: executing program 7 (id=2066): open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) r0 = open(&(0x7f0000000000)='./file0\x00', 0x4, 0x0) poll(&(0x7f0000000380)=[{r0, 0xcb}], 0x1, 0x487) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) 1.10174707s ago: executing program 7 (id=2070): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x40000803) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0xa) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCSETD(r0, 0x8004741b, &(0x7f0000000140)=0x8) 1.08142832s ago: executing program 2 (id=2071): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x4d, 0x0, 0x0, 0x200040c5}, {0x9b1e, 0x7, 0xff, 0x200000}]}) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@broadcast, @random="94ea09066dbd", [], {@ipv6={0x86dd, {0x0, 0x6, "008302", 0x8, 0x11, 0x0, @rand_addr="fed38d5ba80b9e61cd0c535a9800", @mcast2, {[], @udp={{0x3, 0x2, 0x8}}}}}}}) 1.081106965s ago: executing program 5 (id=2072): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000140), 0x10, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000040)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000240)={0x2, &(0x7f0000000280)=[{0x50, 0xfe, 0x10, 0x8}, {0x16, 0x24, 0xc, 0x1}]}) syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x8, 0xff, 0x0, @local={0xac, 0x14, 0x0}, @rand_addr=0xac1400ff}, @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x8, 0xff, 0x0, 0x8}}}}}}) 1.081027123s ago: executing program 7 (id=2073): ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x80, {0x1000000ff}}) sysctl$hw(&(0x7f0000000000)={0x4, 0x18}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sysctl$kern(&(0x7f0000000000)={0xa}, 0x7, &(0x7f0000000080), 0x0, 0x0, 0x24) 1.080934426s ago: executing program 2 (id=2074): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x2015, r0, 0x0) sysctl$kern(&(0x7f0000000040)={0x1, 0x53}, 0x2, &(0x7f0000001940), &(0x7f0000000100)=0xffffffffffffff90, 0x0, 0x0) 1.048092449s ago: executing program 5 (id=2075): openat$klog(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xa, 0x8, 0x7, 0x2, 0x8, 0x3, 0x40, 0x10, [{0x3, 0xffff, 0x7fff, 0x80000202}, {0x4, 0x8, 0x6, 0xfff}, {0x1, 0xfffffffe, 0x6, 0x2}, {0x1000002, 0xdf, 0xf, 0x40}, {0x4, 0x7, 0xf11, 0x7}, {0x800, 0x0, 0x80cf}, {0x7, 0x5, 0x87, 0x2}, {0x4, 0xfffffffe, 0xfffffffa, 0xfbffe2e9}, {0x8, 0xffe, 0x6, 0x17fff}, {0x101, 0x0, 0x5, 0x7}, {0x8, 0x8000004, 0x8, 0x7}, {0x4, 0xc7cb, 0x800000, 0xa66}, {0x401, 0x10a, 0x6, 0x9}, {0x200003, 0x0, 0x6, 0x5}, {0x81, 0x5, 0x3, 0x7fff}, {0xffffffff, 0x8005, 0x6, 0x69}]}) poll(&(0x7f0000000000), 0x35, 0x0) poll(&(0x7f0000000000), 0x35, 0x0) 1.047878619s ago: executing program 7 (id=2076): open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x4, 0xc0, 0x3, 0x0, 0x3, 0xfffeffff, 0x3, 0x1, 0x2, 0x3, 0xff}) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x78e, 0x7) 1.04779757s ago: executing program 2 (id=2077): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000140), 0x10, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000280)=[{0xc0, 0x9, 0x5, 0x8001}, {0x16, 0x24, 0xa, 0x8}]}) syz_emit_ethernet(0x46, &(0x7f0000000140)=ANY=[]) 1.047704426s ago: executing program 5 (id=2078): open$dir(&(0x7f0000000040)='./file0\x00', 0x200, 0x0) r0 = getpid() ktrace(&(0x7f0000000000)='./file0\x00', 0x0, 0x510, r0) lstat(&(0x7f0000000fc0)='./file0\x00', &(0x7f0000001000)) 1.047613965s ago: executing program 7 (id=2079): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaabb9f30000000000800450000"]) r0 = socket$inet(0x2, 0x3, 0x0) ioctl$FIONREAD(r0, 0x80206979, &(0x7f0000000100)) 1.047523563s ago: executing program 2 (id=2080): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000180)={0x3, &(0x7f00000001c0)=[{0x8000, 0x4, 0x0, 0xc14}, {0x4, 0x5, 0x0, 0x1}, {0x6, 0x1, 0x45, 0x10000}]}) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r0 = socket(0x1, 0x1, 0x0) ioctl$FIONREAD(r0, 0x8020691f, &(0x7f00000001c0)) 1.033083432s ago: executing program 5 (id=2081): ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000080)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x0, 0x8, 0x7, 0x6}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) select(0x2, 0x0, &(0x7f0000000040)={0x50}, &(0x7f0000000080), &(0x7f00000000c0)) 1.032947906s ago: executing program 7 (id=2082): r0 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) writev(r0, &(0x7f0000000540)=[{&(0x7f0000000140)="ff5acf7e174ed065448b0a6abdc626604f4c", 0x12}, {&(0x7f0000000240)="29d9e0286bbd695ae22e44ec3ee3084d6866cffac780a6fdec942a6ab12d0eeda89195c5981c999c0c2ab92ba5f472f9f50ff082285d200ef69decbeeb9e4a888933e31091a82e33d3f38b7b8b3d44c3e185a9a382228a4203364cd8d4fcab2fb322a1642d", 0x65}], 0x2) openat$pf(0xffffffffffffff9c, 0x0, 0x80, 0x0) execve(0x0, 0x0, 0x0) 1.0328689s ago: executing program 2 (id=2083): mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0x205310) r0 = open(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) poll(&(0x7f00000000c0)=[{r0, 0x1}], 0x1, 0x0) close(r0) 1.032731936s ago: executing program 5 (id=2084): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x80000000, 0xffff63de, 0x5, 0x2, 0x8, 0x3, 0x44, 0x10, [{0x5, 0x3, 0xfffff115, 0x80000001}, {0x3, 0xffffffff, 0x6, 0xfff}, {0x1, 0x4baa, 0x3, 0x9}, {0x4, 0xe2, 0x0, 0x100}, {0x7, 0x2000007, 0x5, 0x84}, {0x7890, 0xfffd, 0x8, 0x2}, {0x4, 0x800, 0x3, 0xfffffffa}, {0x207, 0xffffffff, 0x28000, 0xffffe2e9}, {0x9, 0x1000, 0x6, 0x7fff}, {0x3, 0x1, 0x6, 0x8c01}, {0x0, 0x0, 0x8, 0x6}, {0x10000, 0x0, 0x800000, 0xa6a}, {0x401, 0x4, 0x400009, 0xa1}, {0x3, 0x6e2, 0x2, 0x6f5fc48f}, {0x3, 0x101, 0x3, 0x9}, {0x9be2, 0x1, 0x2, 0x400}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x27}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$vfs_ffs(&(0x7f00000000c0)={0x4, 0x1, 0x1}, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffff3d) 1.029626953s ago: executing program 2 (id=2085): openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x50}, 0x3, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0xfe10, 0x0, 0x37) poll(&(0x7f0000000000), 0x35, 0x0) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) 0s ago: executing program 5 (id=2086): execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000080)="76e5eac907f9ccf7a251ceddcec7d6aa45cffe2c63a56077123a276d3ba4e9d17eb3eb5db12a3783a8e0620d357de1fe04fa9465b5bd1286e9624dec06a00c222f", 0x41}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) unveil(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='c\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.118' (ED25519) to the list of known hosts. malloc(): allocation too large, type = 127, size = 469762064 Rpckbd_enable: command error Connection to 10.128.1.118 closed by remote host. OpenBSD/amd64 (ci-openbsd-main-4.us-central1-b.c.syzkaller.internal) (tty00) login: load: 1.84 not a controlling terminal ;ڻH*CL&+a%u꟎6͐(b e kernel: page fault trap, code=0 Stopped at ktrops+0x58: movq 0x10(%r14),%r14 TID PID UID PRFLAGS PFLAGS CPU COMMAND *207982 12863 0 0 0x4000000 0 syz-executor ktrops(ffff8000314a1ca0,ffffffffffffffff,0,a0c7df9f,fffff4006e0e73b0,fffff40007ffd750) at ktrops+0x58 doktrace(fffff4006e0e73b0,4,20c7df9f,0,ffff8000314a1ca0) at doktrace+0x6bd sys_ktrace(ffff8000314a1ca0,ffff80002a7a19d0,ffff80002a7a1920) at sys_ktrace+0x11c syscall(ffff80002a7a19d0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7d8340f4a50, count: 10 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xfffff4004cc4f5d8, 0xf, 0, 1) -> e ddb> trace ktrops(ffff8000314a1ca0,ffffffffffffffff,0,a0c7df9f,fffff4006e0e73b0,fffff40007ffd750) at ktrops+0x58 doktrace(fffff4006e0e73b0,4,20c7df9f,0,ffff8000314a1ca0) at doktrace+0x6bd sys_ktrace(ffff8000314a1ca0,ffff80002a7a19d0,ffff80002a7a1920) at sys_ktrace+0x11c syscall(ffff80002a7a19d0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7d8340f4a50, count: -5 ddb> show registers rdi 0xffff8000380cc000 rsi 0x2762 __ALIGN_SIZE+0x1762 rbp 0xffff80002a7a16f0 rbx 0xfffff40007ffd750 rdx 0xffff8000380cc000 rcx 0x2761 __ALIGN_SIZE+0x1761 rax 0xffffffff82a5fa03 ktrops+0x43 r8 0xfffff4006e0e73b0 r9 0xfffff40007ffd750 r10 0xcf57164dadfde60c r11 0xbc17d8eada114768 r12 0xffff8000314a1ca0 r13 0xffffffffffffffff r14 0xffffffffffffffff r15 0xa0c7df9f rip 0xffffffff82a5fa18 ktrops+0x58 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80002a7a1670 ss 0 ktrops+0x58: movq 0x10(%r14),%r14 ddb> show proc PROC (syz-executor) tid=207982 pid=12863 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=17, usrpri=79, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000314a0548,0xffff80002a766020 process=0xffff807fffff9f98 user=0xffff80002a79c000, vmspace=0xfffff4004cc4f5d8 estcpu=29, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 80029 470673 91306 0 2 0 syz-executor 33523 393164 60932 0 2 0 syz-executor 33523 273356 60932 0 2 0x4000000 syz-executor 33523 302115 60932 0 2 0x4000000 syz-executor 63591 483735 85750 0 2 0 syz-executor 63591 322515 85750 0 3 0x4000080 rest syz-executor 12863 354776 76222 0 2 0 syz-executor *12863 207982 76222 0 7 0x4000000 syz-executor 11368 199303 64969 0 2 0 syz-executor 11368 332870 64969 0 3 0x4000080 fsleep syz-executor 51578 322890 1 0 3 0x100083 ttyin getty 85750 447790 23900 0 3 0x82 nanoslp syz-executor 76222 185799 23900 0 3 0x82 nanoslp syz-executor 91306 41704 23900 0 3 0x82 nanoslp syz-executor 49791 347904 23900 0 3 0x82 nanoslp syz-executor 64969 8005 23900 0 3 0x82 nanoslp syz-executor 60932 387899 23900 0 3 0x82 nanoslp syz-executor 80104 32291 23900 0 2 0x2 syz-executor 26341 145249 23900 0 2 0x2 syz-executor 23900 305253 1 0 3 0x82 kqread syz-executor 7015 179187 0 0 3 0x14200 bored smr 67951 122801 0 0 2 0x14200 zerothread 82625 121809 0 0 3 0x14200 aiodoned aiodoned 40787 207123 0 0 3 0x14200 syncer update 91330 134521 0 0 3 0x14200 cleaner cleaner 27013 164174 0 0 3 0x14200 reaper reaper 37553 487565 0 0 3 0x14200 pgdaemon pagedaemon 97422 247631 0 0 3 0x14200 bored viomb 8220 481756 0 0 3 0x40014200 acpi0 acpi0 62196 522523 0 0 3 0x14200 bored softnet0 71002 115269 0 0 3 0x14200 bored systqmp 74975 444219 0 0 3 0x14200 bored systq 498 346330 0 0 3 0x40014200 tmoslp softclock 66161 187714 0 0 3 0x40014200 idle0 1 446612 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11039 12307K 12750K 166960K 12825 0 pcb 17 12K 12K 166960K 140 0 rtable 253 8K 9K 166960K 458 0 pf 33 13K 72K 166960K 86 0 ifaddr 41 7K 7K 166960K 48 0 ifgroup 47 1K 2K 166960K 66 0 sysctl 1 1K 9K 166960K 9 0 counters 33 17K 17K 166960K 37 0 ioctlops 0 0K 4K 166960K 140 0 iov 0 0K 16K 166960K 27 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1278 80K 81K 166960K 1932 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 8 0 VM map 2 1K 1K 166960K 2 0 sem 12 1K 1K 166960K 21 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 15 57K 102K 166960K 2224 0 sigio 0 0K 0K 166960K 3 0 proc 20 25K 91K 166960K 576 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 107 0 in_multi 96 7K 7K 166960K 112 0 ether_multi 1 0K 0K 166960K 1 0 mrt 1 0K 0K 166960K 18 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 67 307K 307K 166960K 67 0 exec 0 0K 1K 166960K 419 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 3 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 113 81K 152K 166960K 18899 0 UVM aobj 13 2K 4K 166960K 14 0 pinsyscall 18 36K 90K 166960K 3328 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 29 0 NDP 11 0K 2K 166960K 31 0 temp 51 9110K 9179K 166960K 31603 0 kqueue 2 4K 22K 166960K 108 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 91 0 91 1 0 1 1 0 8 1 rtentry 136 126 0 18 5 0 5 5 0 8 0 unpcb 144 265 0 265 1 0 1 1 0 8 1 syncache 336 13 0 13 2 1 1 1 0 8 1 tcpcb 736 194 0 193 1 0 1 1 0 8 0 arp 96 24 0 1 1 0 1 1 0 8 0 ipq 40 6 0 1 1 0 1 1 0 8 0 ipqe 40 9 0 4 1 0 1 1 0 8 0 inpcb 328 613 0 611 1 0 1 1 0 8 0 ip6q 72 4 0 1 1 0 1 1 0 8 0 ip6af 40 7 0 2 1 0 1 1 0 8 0 nd6 112 29 0 3 1 0 1 1 0 8 0 pkpcb 40 8 0 8 2 1 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1072 2 0 2 1 0 1 1 0 8 1 pfstscr 40 7 0 3 1 0 1 1 0 8 0 pfosfp 40 1 0 0 1 0 1 1 0 8 0 pfosfpen 112 1 0 0 1 0 1 1 0 8 0 pfsrclim 320 2 0 2 1 0 1 1 0 8 1 pfstlim 224 2 0 1 1 0 1 1 0 8 0 pfanchor 1288 2 0 0 1 0 1 1 0 8 0 pfstitem 24 4 0 0 1 0 1 1 0 8 0 pfstkey 128 7 0 3 1 0 1 1 0 8 0 pfstate 384 4 0 2 1 0 1 1 0 8 0 pfrule 1360 3 0 3 2 1 1 1 0 8 1 art_heap8 4096 4 0 0 4 0 4 4 0 8 0 art_heap4 256 519 0 71 32 0 32 32 0 8 1 art_table 40 523 0 71 6 0 6 6 0 8 0 art_node 32 126 0 28 1 0 1 1 0 8 0 sysvmsgpl 40 8 0 5 1 0 1 1 0 8 0 semupl 112 4 0 4 2 1 1 1 0 8 1 semapl 72 17 0 7 1 0 1 1 0 8 0 shmpl 112 11 0 1 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 4276 0 2833 92 0 92 92 0 8 0 ffsino 256 4276 0 2833 92 0 92 92 0 8 0 nchpl 144 6775 0 5086 63 0 63 63 0 8 0 vnodes 216 4682 0 0 261 0 261 261 0 8 0 namei 1024 16242 0 16241 3 2 1 2 0 8 0 kstatmem 264 31 0 8 2 0 2 2 0 8 0 scsiplug 72 9 0 9 2 1 1 1 0 8 1 scxspl 216 21095 0 21095 10 2 8 8 1 8 8 plimitpl 152 41 0 31 1 0 1 1 0 8 0 sigapl 424 2515 0 2484 6 1 5 6 0 8 0 knotepl 120 69780 0 69718 10 0 10 10 0 8 8 kqueuepl 184 129 0 127 1 0 1 1 0 8 0 pipepl 304 141 0 114 3 0 3 3 0 8 0 fdescpl 448 2502 0 2484 4 0 4 4 0 8 0 filepl 120 5648 0 5488 7 0 7 7 0 8 0 lockfpl 104 286 0 286 1 0 1 1 0 8 1 lockfspl 48 122 0 122 1 0 1 1 0 8 1 sessionpl 144 36 0 32 1 0 1 1 0 8 0 pgrppl 48 47 0 35 1 0 1 1 0 8 0 ucredpl 104 562 0 559 1 0 1 1 0 8 0 zombiepl 144 2485 0 2484 2 1 1 1 0 8 0 processpl 1152 2515 0 2484 4 0 4 4 0 8 0 procpl 664 4686 0 4650 5 0 5 5 0 8 1 sockpl 552 992 0 990 3 0 3 3 0 8 2 mcl64k 65536 186 0 183 2 1 1 1 0 8 0 mcl16k 16384 232 0 232 2 1 1 1 0 8 1 mcl12k 12288 244 0 244 2 1 1 1 0 8 1 mcl9k128 9344 118 0 118 2 1 1 1 0 8 1 mcl8k 8192 767 0 766 2 1 1 1 0 8 0 mcl4k 4096 6671 0 6619 14 6 8 13 0 8 0 mcl2k2 2112 1 0 1 1 0 1 1 0 8 1 mcl2k 2048 228 0 228 2 1 1 1 0 8 1 mtagpl 96 5 0 4 2 1 1 1 0 8 0 mbufpl 256 25638 0 25350 22 0 22 22 0 8 3 bufpl 272 5235 0 107 342 0 342 342 0 8 0 anonpl 24 271142 0 269828 54 10 44 44 0 88 21 amapchunkpl 152 64784 0 64506 36 5 31 31 0 158 16 amappl16 200 4008 0 3984 20 9 11 15 0 8 8 amappl15 192 17 0 17 1 1 0 1 0 8 0 amappl14 184 417 0 417 1 0 1 1 0 8 1 amappl13 176 115 0 114 1 0 1 1 0 8 0 amappl12 168 2744 0 2728 2 0 2 2 0 8 0 amappl11 160 7 0 7 1 0 1 1 0 8 1 amappl10 152 69 0 69 1 0 1 1 0 8 1 amappl9 144 274 0 274 1 1 0 1 0 8 0 amappl8 136 94 0 94 1 0 1 1 0 8 1 amappl7 128 145 0 143 1 0 1 1 0 8 0 amappl6 120 149 0 149 1 0 1 1 0 8 1 amappl5 112 91 0 91 1 0 1 1 0 8 1 amappl4 104 268 0 266 1 0 1 1 0 8 0 amappl3 96 14357 0 14295 3 0 3 3 0 8 0 amappl2 88 547 0 541 2 0 2 2 0 8 0 amappl1 80 18469 0 18358 13 1 12 13 0 8 6 amappl 88 18106 0 18007 4 0 4 4 0 92 0 uvmvnodes 80 121 0 0 3 0 3 3 0 8 0 dma32768 32768 1 0 1 1 0 1 1 0 8 1 dma16384 16384 1 0 1 1 0 1 1 0 8 1 dma8192 8192 1 0 1 1 0 1 1 0 8 1 dma4096 4096 2 0 2 2 1 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 7 0 7 2 1 1 1 0 8 1 dma128 128 254 0 254 2 1 1 1 0 8 1 dma64 64 7 0 7 2 1 1 1 0 8 1 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 19 0 18 1 0 1 1 0 8 0 aobjpl 72 13 0 1 1 0 1 1 0 8 0 uaddrrnd 24 2502 0 2484 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2502 0 2484 1 0 1 1 0 8 0 vmmpekpl 168 16693 0 16661 2 0 2 2 0 8 0 vmmpepl 168 149055 0 148289 93 3 90 90 0 357 49 vmsppl 368 2501 0 2484 4 1 3 4 0 8 0 rwobjpl 40 34240 0 33825 14 1 13 13 0 8 1 pdppl 4096 5010 0 4968 98 52 46 76 0 8 4 pvpl 32 949370 0 945417 124 14 110 110 0 265 56 pmappl 216 2501 0 2484 2 0 2 2 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 731 0 69 19 0 19 19 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace ktrops(ffff8000314a1ca0,ffffffffffffffff,0,a0c7df9f,fffff4006e0e73b0,fffff40007ffd750) at ktrops+0x58 doktrace(fffff4006e0e73b0,4,20c7df9f,0,ffff8000314a1ca0) at doktrace+0x6bd sys_ktrace(ffff8000314a1ca0,ffff80002a7a19d0,ffff80002a7a1920) at sys_ktrace+0x11c syscall(ffff80002a7a19d0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7d8340f4a50, count: -5 ddb>