last executing test programs: 1m15.481695066s ago: executing program 2 (id=3037): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f00000002c0)="ee08665d19ac14d5e51348771197a7728420aef61715f7b1c3d4b3830c921bf0817a0000000000006a89dbdf", 0x2c) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000040)="6c65a01c620f382ee4b7d929", 0xc) 1m15.457429211s ago: executing program 2 (id=3039): open$dir(&(0x7f0000000240)='./file0\x00', 0x40000400000002c2, 0xca0706ee3fd5d6f7) r0 = open(&(0x7f0000000080)='./file0\x00', 0xf5fbbcdef939e6ea, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000100)="88", 0x1}], 0x1) 1m15.329894855s ago: executing program 2 (id=3047): r0 = socket$inet6_udp(0x1c, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0xc, &(0x7f0000000080)={0x7ff, {{0x1c, 0x1c, 0x2, 0x0, @rand_addr="65cb30df060000000b603666ab2f3df4"}}, {{0x1c, 0x1c, 0x1, 0x0, @mcast2}}}, 0xfc) setsockopt$inet6_group_source_req(r0, 0x29, 0xc, &(0x7f0000000080)={0x7ff, {{0x1c, 0x1c, 0x2, 0x0, @rand_addr="65cb30df060000000b603666ab2f3df4"}}, {{0x1c, 0x1c, 0x1, 0x0, @mcast2}}}, 0xfc) 1m15.305526356s ago: executing program 2 (id=3050): socketpair(0x1, 0x5, 0x7f, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f000001ba80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[@cred={0x60, 0xffff, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff]}], 0x60}, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0x200000, 0x0, 0x0) 1m15.260502616s ago: executing program 2 (id=3053): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0xe100, 0x0) freebsd11_mknod(&(0x7f0000000080)='./file1\x00', 0x1000, 0x0) 1m15.210969498s ago: executing program 2 (id=3057): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket$inet6_tcp(0x1c, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x762, 0x4) 1m15.141327445s ago: executing program 32 (id=3057): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket$inet6_tcp(0x1c, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x762, 0x4) 25.501514877s ago: executing program 3 (id=4467): r0 = socket(0x26, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1001, &(0x7f0000000000)=0x1, 0x4) sendto$inet(r0, &(0x7f0000000180)="a84f89b321b3554241ae905c1d36881d", 0x10, 0x8, 0x0, 0x0) sendto(r0, &(0x7f0000000100)="a7c14583f98564ce55f0ffdde60a501d", 0x10, 0x0, 0x0, 0x0) execve(0x0, 0x0, 0x0) 24.637804442s ago: executing program 3 (id=4481): r0 = socket$inet6(0x1c, 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreqn(r1, 0x0, 0x9, &(0x7f0000000040)={@local={0xac, 0x14, 0x0}, @multicast1}, 0xfdba) getsockopt$inet_mreqn(r1, 0x0, 0x9, &(0x7f0000000000)={@loopback, @multicast2, 0x0}, &(0x7f0000000080)=0xc) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x2e, &(0x7f0000000000)={@empty, r2}, 0x14) 24.610919863s ago: executing program 3 (id=4483): r0 = socket(0x1c, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0x1c, 0x1c, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty}, 0x1c) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000000)=0x3, 0x4) setsockopt$inet_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f00000000c0)={'rack\x00'}, 0x24) 24.495114049s ago: executing program 3 (id=4487): r0 = socket(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x2000, 0x0, &(0x7f0000000380)) setsockopt$inet_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f0000000980)={'rack\x00'}, 0x24) bind(r0, &(0x7f0000000000)=@in={0x10, 0x2, 0x1, @local={0xac, 0x14, 0x0}}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x10, 0x2, 0x0, @rand_addr=0x81000}, 0x10) 22.886246083s ago: executing program 3 (id=4502): open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)="002c78e7", 0x4) setgroups(0x20a, &(0x7f0000000040)) r0 = getegid() lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r0) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 22.795817594s ago: executing program 3 (id=4503): r0 = open$dir(&(0x7f0000000140)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000080)='./file0\x00', 0x0) mknodat(r0, &(0x7f0000000040)='./file0/file0\x00', 0xe004, 0x0) chown(&(0x7f0000000240)='./file0/file0/file0\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000180)='./file0/file0/file0\x00', 0x0, 0x0) freebsd11_stat(&(0x7f0000000280)='./file0/file0\x00', 0x0) 16.609179732s ago: executing program 1 (id=4603): r0 = setsid() r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x10242, 0x0) r2 = openat$filemon(0xffffff9c, &(0x7f0000000180), 0x40, 0x0) ioctl$FILEMON_SET_FD(r2, 0xc0045301, &(0x7f00000001c0)=r1) ioctl$FILEMON_SET_PID(r2, 0xc0045302, &(0x7f0000000000)=r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x40000400000002c2, 0x0) 16.530724014s ago: executing program 1 (id=4605): semget$private(0x0, 0x3, 0x104) r0 = semget$private(0x0, 0x5, 0x0) semop(r0, &(0x7f0000000000)=[{0x3, 0x7, 0x1000}], 0x1) fhstatfs(0x0, 0x0) r1 = semget$private(0x0, 0x5, 0x0) __semctl$IPC_RMID(r1, 0x0, 0x0) 16.516655513s ago: executing program 1 (id=4606): open(&(0x7f0000000040)='./file0\x00', 0x70e, 0x0) link(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') freebsd11_statfs(&(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000680)) 16.498700752s ago: executing program 1 (id=4607): r0 = socket(0x1c, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0x1c, 0x1c, 0x3, 0x2, @empty}, 0x1c) setsockopt$sock_int(r0, 0xffff, 0x1001, &(0x7f0000000040)=0x7f, 0x4) connect$inet6(r0, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty, 0x20000}, 0x1c) sendto$inet(r0, &(0x7f0000000200)="0e", 0xff66, 0x0, 0x0, 0x0) 16.154774831s ago: executing program 1 (id=4614): r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) symlinkat(&(0x7f0000000100)='./file2\x00', r0, &(0x7f0000000140)='./file2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r1 = open$dir(&(0x7f0000000280)='.\x00', 0x0, 0x0) unlinkat(r1, &(0x7f0000000500)='./file2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mknodat(r0, &(0x7f00000009c0)='./file2\x00', 0xb6a0a5d5283be59a, 0x0) 16.090669185s ago: executing program 1 (id=4616): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(r1, 0x0, 0x3, &(0x7f0000000000)="f1010100", 0x4) r2 = openat$filemon(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FILEMON_SET_FD(r2, 0xc0045301, &(0x7f0000000080)=r0) sendto$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) 16.072592098s ago: executing program 33 (id=4616): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(r1, 0x0, 0x3, &(0x7f0000000000)="f1010100", 0x4) r2 = openat$filemon(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FILEMON_SET_FD(r2, 0xc0045301, &(0x7f0000000080)=r0) sendto$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.275899271s ago: executing program 0 (id=4801): r0 = socket(0x1c, 0x10000001, 0x84) setsockopt$inet6_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0xa, &(0x7f00000003c0)={@in6={{0x1c, 0x1c, 0x1, 0x7, @empty}}, 0x0, 0x0, 0x0, 0x30a}, 0x98) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xe, 0x0, 0x0) getsockopt$inet6_int(r0, 0x29, 0x24, &(0x7f0000001580), &(0x7f00000015c0)=0x4) setsockopt$sock_int(r0, 0xffff, 0x800, &(0x7f0000000000)=0x6, 0x4) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000700)={{0x0, 0x0, 0x0, 0x0, 0x85, 0x2, 0x0, 0xffffffff}, 0x7, 0xff, 0x6, 0x3, 0x0, 0x3c}) sendmsg$inet6_sctp(r0, &(0x7f00000001c0)={&(0x7f0000000180)=@in6={0x1c, 0x1c, 0x0, 0x0, @local={0xfe, 0x80, '\x00', 0x0}}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000200)='D', 0x1}], 0x1}, 0x0) 1.247530548s ago: executing program 0 (id=4803): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chmod(&(0x7f0000000280)='./file0\x00', 0x3a) chdir(&(0x7f0000000240)='./file0\x00') setreuid(0x0, 0xee01) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) fchdir(r0) 1.209947507s ago: executing program 0 (id=4804): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) aio_write(&(0x7f0000000240)={r0, 0x80000001, &(0x7f0000000040)="e2", 0x1, [], 0x0, 0x0, 0x0, {0x0, 0x7, 0x0}, {0x0, 0x0, @sival_int, @ke_flags=0xc088}}) r1 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r1, 0x0) rfork(0x96014) ftruncate(r1, 0x0) 1.013050889s ago: executing program 0 (id=4806): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) aio_write(&(0x7f0000000240)={r0, 0x80000001, &(0x7f0000000040)="e2", 0x1, [], 0x1, 0x0, 0x0, {0x3, 0x7, 0x0}, {0x0, 0x0, @sival_int, @spare=[0xce8c, 0x7, 0x400, 0x1, 0x6, 0xffffffff, 0x5, 0x7]}}) mlockall(0x2) r1 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r1, 0x60000000) sync() 996.246322ms ago: executing program 5 (id=4808): setresuid(0x0, 0xee01, 0x0) r0 = socket(0x1c, 0x1, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10000, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x0, 0x0, @loopback}, 0x1c) r1 = socket(0x1c, 0x1, 0x0) setsockopt$sock_int(r1, 0xffff, 0x10000, &(0x7f0000000080)=0xb, 0x4) bind$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x0, 0x0, @empty}, 0x1c) 891.234505ms ago: executing program 5 (id=4810): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) aio_write(&(0x7f0000000240)={r0, 0x80000001, &(0x7f0000000040)="e2", 0x1, [], 0x0, 0x0, 0x0, {0x0, 0x7, 0x0}, {0x0, 0x0, @sival_int, @ke_flags=0xc088}}) r1 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r1, 0x0) rfork(0x96014) sync() 867.998787ms ago: executing program 4 (id=4811): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f00000001c0)='./file1\x00', 0x0) renameat(r0, &(0x7f0000000200)='./file1\x00', r0, &(0x7f0000000140)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0xa7210e10bc3c9def) r1 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0) renameat(r1, &(0x7f00000025c0)='./file0\x00', r1, &(0x7f0000002600)='./file1\x00') 766.530525ms ago: executing program 0 (id=4812): syz_emit_ethernet(0xe, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000001"]) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000000)="6dc100167f", 0xffffffef}], 0x1) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket(0x2, 0x1, 0x0) connect$unix(r0, &(0x7f0000000000), 0x10) close(r0) 697.929818ms ago: executing program 4 (id=4813): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) aio_write(&(0x7f0000000240)={r0, 0x80000001, &(0x7f0000000300)="e2", 0x1, [0x7fff], 0xc0, 0x4, 0x0, {0x6, 0x7, 0x0}, {0x0, 0xb, @sival_int, @spare=[0x800000000001000, 0xf, 0x9, 0x0, 0x7, 0x2, 0x6, 0x9]}}) r1 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) 587.908705ms ago: executing program 0 (id=4814): r0 = socket$inet6_udp(0x1c, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x3, 0xffffffffffffffff) execve(0x0, 0x0, &(0x7f0000000280)=[&(0x7f0000000240)='\x00', &(0x7f0000000480)='\x00']) writev(r1, &(0x7f0000000280), 0x26) fork() setsockopt$inet_tcp_TCP_FUNCTION_BLK(0xffffffffffffffff, 0x6, 0x2000, &(0x7f0000000040)={'bbr\x00'}, 0x24) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x4) 568.933287ms ago: executing program 4 (id=4815): r0 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x0) ftruncate(r0, 0x3c62) r1 = socket(0x1c, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0x1c, 0x1c, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r1, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty, 0xfffffffc}, 0x1c) r2 = open$dir(&(0x7f0000000240)='./file0\x00', 0x2000000, 0x126) sendfile(r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0) 497.924908ms ago: executing program 5 (id=4816): munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) r0 = socket(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f00000000c0)={0x10, 0x2, 0x2, @rand_addr=0xfffffffb}, 0x10) rfork(0x85000) recvmsg(0xffffffffffffffff, 0x0, 0x81) ppoll(0x0, 0x0, &(0x7f0000004080)={0x0, 0x3938700}, 0x0, 0x0) minherit(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) 392.715898ms ago: executing program 4 (id=4817): r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) setsockopt$sock_int(r0, 0xffff, 0x1001, &(0x7f00000000c0)=0x1fe, 0x4) setsockopt$inet6_sctp_SCTP_EXPLICIT_EOR(r0, 0x84, 0x1b, &(0x7f0000000240)=0x80000001, 0x4) sendmsg$inet6_sctp(r0, &(0x7f0000000680)={&(0x7f0000000640)=@in6={0x1c, 0x1c, 0x1, 0x0, @remote={0xfe, 0x80, '\x00', 0x0}}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)="fcc6aa3e9e3fc42bb89bf3e676910677c03283fea24a3d5fe916bc7c6afe25e7491c26a4ea436cf99ab7b559fc19289a8707b32558044f8ad0d26800eb6676cf436aa054be3b092f7f1c0130888b129058b2cd07fea6332a40e45fc2d4a08fb11548d2e77070cbbf18fb019685b7e3466f8a75c268e6", 0x76}, {&(0x7f00000007c0)="19b64567e75a181e1f5cdf23a6fe847436229d915e68d8ba846f5b169bb934b2fc22691a86c373790b3c6c36ddf33549f6ad3ff7319b9e450cbcdc3fa3225107a2b023f2b4cf42699cad89d6b62ffcae6aabb4967fd4e36d1b1fa0240527b53a0025b5e979376d0a0f8746889984bc8deb72ed169d82208b48537b8002abb7dbd7686b69e8318d8dac88b09fd14a9d8ce73358ab733763b628a6cab300e84fd75d6b8dccea37fff8d5fbbe5d714bf65251dff89bd3047892c27b5a6961fd282a6cc3847c78b94c1bf8bd04f0b568b9ec9c98e59c263e40de2b36c2ff11e8e9fa0f25f3443aa1ace80802c211be19469f3b676fd5e16a497054c315dcdf8c6b9dc14f569cc04a5ebc5ec671ae8bed70d55742fb04f99314ed8f1b1bf3966a0cce0a83403076d31374da5cce6ac44e3f32fa1c53d8fc0c84c4d97393fbefd504ac500f13c2a6da3232baa38384a3cedcb82bc06214af5ad3f0dc0c8be01786725e87d8db9a07eabb890a500896b9197b277a9e5fb95e1b6b9dde403dfe6f9a0ef63986d96c95816ff4b8", 0x189}], 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001dc0)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) rfork(0x82040) 217.31552ms ago: executing program 5 (id=4818): sendmsg$inet6_sctp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000040)="53da24fe52d7ae4470dbb3cc", 0xc}], 0x1}, 0x0) r0 = socket(0x2, 0x1, 0x0) r1 = dup(r0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) close(r2) r3 = socket(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) 172.414411ms ago: executing program 5 (id=4819): r0 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x0) r1 = open$dir(&(0x7f0000000240)='./file0\x00', 0x40000400000002c2, 0x0) lchflags(&(0x7f0000000040)='./file0\x00', 0x4) r2 = kqueue() kevent(r2, &(0x7f0000000100)=[{0x3, 0xffffffffffffffff, 0x80a9, 0x10}], 0x1, 0x0, 0x0, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x0) fspacectl(r0, 0x1, &(0x7f0000000040)={0x3ff, 0x7ffffffffffffc00}, 0x0, 0x0) 127.969797ms ago: executing program 4 (id=4820): r0 = socket(0x1c, 0x3, 0xff) setsockopt$sock_int(r0, 0xffff, 0x4000, &(0x7f0000000140)=0x1d, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0x1c, 0x1c, 0xffffffffffffffff, 0x0, @loopback}, 0x1c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0x40, 0x0, 0x0) rfork(0x1000) ksem_close(0x0) 86.410427ms ago: executing program 4 (id=4821): r0 = open$dir(&(0x7f0000000840)='./file1\x00', 0x40000400000002c2, 0x0) r1 = open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x0) poll(&(0x7f00000000c0)=[{r1, 0x2000}], 0x1, 0x0) poll(&(0x7f0000000100)=[{r0, 0x2000}], 0x1, 0x0) mkdirat(r1, &(0x7f00000001c0)='./file0\x00', 0x0) renameat(r1, &(0x7f0000000200)='./file1\x00', r1, &(0x7f0000000140)='./file0/file0\x00') renameat(r1, &(0x7f0000000340)='./file0/file0\x00', r1, &(0x7f0000000380)='./file1\x00') 0s ago: executing program 5 (id=4822): open$dir(&(0x7f0000000800)='./file0\x00', 0x40000400000002c2, 0x1c0) setreuid(0xee00, 0x0) r0 = getuid() chown(&(0x7f0000000000)='./file0\x00', r0, 0x0) r1 = getuid() setreuid(0x0, r1) ktrace(&(0x7f00000000c0)='./file0\x00', 0x4, 0x30a, 0xffffffffffffffff) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.162' (ED25519) to the list of known hosts. Nov 21 01:20:00 ci-freebsd-i386-4 kernel: attempted source route from 255.255.255.255 to 224.0.0.2 Nov 21 01:20:01 ci-freebsd-i386-4 kernel: arp: 04:d8:98:d8:30:1f attempts to modify permanent entry for 172.20.2.187 on tap2 Nov 21 01:20:03 ci-freebsd-i386-4 kernel: attempted source route from 255.255.255.255 to 172.20.0.170 UDP6: M_MCAST is set in a unicast packet. if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 md2: truncating fractional last sector by 183 bytes md3: truncating fractional last sector by 183 bytes md4: truncating fractional last sector by 183 bytes md5: truncating fractional last sector by 1024 bytes md6: truncating fractional last sector by 1024 bytes md7: truncating fractional last sector by 4791 bytes md8: truncating fractional last sector by 183 bytes [zone: pf frag entries] PF frag entries limit reached if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f7000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 Out of ktrace request objects. if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 md9: truncating fractional last sector by 508 bytes ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f7800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f6800 lock order reversal: 1st 0xfffffe0077f82c78 ufs (ufs, lockmgr) @ /syzkaller/managers/i386/kernel/sys/kern/vfs_subr.c:3369 2nd 0xffffffff82e01c40 proctree (proctree, sx) @ /syzkaller/managers/i386/kernel/sys/kern/subr_prf.c:188 lock order proctree -> ufs established at: #0 0xffffffff81610701 at witness_checkorder+0x781 #1 0xffffffff8147bda6 at lockmgr_lock_flags+0x1d6 #2 0xffffffff81d1efeb at ffs_lock+0x18b #3 0xffffffff82276ccb at VOP_LOCK1_APV+0x6b #4 0xffffffff8176b7ee at _vn_lock+0x14e #5 0xffffffff8176c098 at vn_close1+0x1e8 #6 0xffffffff8146d99a at ktrops+0x41a #7 0xffffffff8146d11d at sys_ktrace+0xa7d #8 0xffffffff8223c0b8 at ia32_syscall+0x488 #9 0xffffffff820609cf at int0x80_syscall_common+0x9c lock order ufs -> proctree attempted at: #0 0xffffffff816115d2 at witness_checkorder+0x1652 #1 0xffffffff81504fcf at _sx_slock_int+0x13f #2 0xffffffff815ce69d at uprintf+0x14d #3 0xffffffff81d4b13f at ufs_rmdir+0xdf #4 0xffffffff82275b11 at VOP_RMDIR_APV+0xe1 #5 0xffffffff81760f94 at kern_frmdirat+0x8b4 #6 0xffffffff8223c0b8 at ia32_syscall+0x488 #7 0xffffffff820609cf at int0x80_syscall_common+0x9c ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f7800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f6800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058782800 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 if_delmulti_locked: detaching ifnet instance 0xfffffe00079f8000 vnode_pager_putpages: zero-length write at 0 resid 12288 0xfffffe007ac54528: type VREG state VSTATE_CONSTRUCTED op 0xffffffff83500340 usecount 4, writecount 3, refcount 35 seqc users 0 hold count flags () flags (VIRF_PGREAD|VMP_LAZYLIST) v_object 0xfffffe007aa43738 ref 1 pages 264 cleanbuf 22 dirtybuf 11 lock type ufs: EXCL by thread 0xfffffe007aa35000 (pid 5816, syz-executor, tid 105808) nlink=1, effnlink=1, size=1048576, extsize 0 generation=16c5d2e9, uid=0, gid=0, flags=0x40008 ino 198731, on dev gpt/rootfs if_delmulti_locked: detaching ifnet instance 0xfffffe0058782000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058783800 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) FreeBSD/amd64 (ci-freebsd-i386-4.us-central1-b.c.syzkaller.internal) (ttyu0) login: set $lines = 0 Password: Login incorrect login: show registers Password: Login incorrect login: ps Jan 1 00:07:09 ci-freebsd-i386-4 login[748]: 2 LOGIN FAILURES ON ttyu0 Password: Login incorrect login: show malloc Password: Login incorrect