last executing test programs: 1.515057542s ago: executing program 6 (id=7): mknod(&(0x7f0000000040)='./file0\x00', 0x100, 0x1) open(&(0x7f00000004c0)='./bus\x00', 0x0, 0x10) 1.474894116s ago: executing program 1 (id=2): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x78e, 0x7) ioctl$DIOCRCLRTABLES(r0, 0xc450443c, &(0x7f00000005c0)={{'./file0\x00', './file0\x00', 0x2a, 0x6}, 0x0, 0x0, 0x0, 0xa, 0x8001, 0x3, 0x0, 0x50, 0x3}) setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) ioctl$VMM_IOC_RESETCPU(r0, 0x82405605, &(0x7f0000000100)={0x12f6, 0xa, {[0x6, 0x5, 0x10000, 0x7, 0x82, 0xffffffff, 0x60, 0x4, 0x9, 0xfffffffffffffffc, 0x1000, 0x1b0, 0xfffffffffffffffb, 0x4270, 0x6, 0xfffffffffffffff8, 0x39, 0x8], [0x80, 0x7, 0x5, 0x8fe7, 0x2, 0x7, 0x15d, 0x0, 0x80000001], [0xfffffffffffffffb, 0x1, 0x0, 0xee6, 0x7, 0x4, 0x3], [0x0, 0xdccc, 0x7, 0x9, 0x6, 0xce], [{0x3ff, 0x1, 0x5, 0x7}, {0x2, 0x3, 0x10001, 0xb38}, {0x0, 0x201, 0xba, 0x6}, {0x3, 0x0, 0x2, 0x7}, {0x8001, 0x7f, 0x4, 0x4}, {0x6, 0x10001, 0x3, 0xfffffffffffffffd}, {0x6, 0x4, 0x14c, 0x4}, {0x9, 0x5, 0xc6, 0xfffffffffffffff8}], {0xfff9, 0x1, 0x6, 0x8}, {0x6f7, 0x0, 0x8}}}) truncate(&(0x7f0000000080)='./file0\x00', 0x40002ffff) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000400)="95c5", 0x2}], 0x1) open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x0) 1.426537478s ago: executing program 6 (id=9): preadv(0xffffffffffffffff, 0x0, 0xbc4824eb0d320e68, 0x7) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x4], 0x1, 0x10000, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f00000000c0)={0x1, 0x0, &(0x7f0000000080)=[0x0]}) 1.425418346s ago: executing program 2 (id=3): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc0e99db6de761f86, 0x0) msgsnd(0x0, 0x0, 0x401, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) openat$wsmuxkbd(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) rename(&(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='./bus\x00') r1 = socket$inet(0x18, 0x3, 0x102) sendmsg(r1, &(0x7f0000000040)={&(0x7f0000000280)=@in6={0x1c, 0x18, 0x0, 0x9, "00001696d42ba354410d00", 0x63}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000080)="638802000000339afee0641548e0c23e00070000000300000000000000000000221174", 0x23}], 0x1, 0x0}, 0x402) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x0, 0x2, 0x3, 0x5}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) r2 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000080), 0x400d1, 0x0) ioctl$WSKBDIO_SETKEYREPEAT(r2, 0x800c5707, &(0x7f00000001c0)={0x2, 0x6, 0x3}) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000000)=@file={0x1, 0x1, './file0\x00'}, 0xa) listen(r3, 0xa000) connect$unix(r3, &(0x7f00000000c0)=@abs={0x9, 0x0, 0x0, 0x3}, 0x8) r4 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) ioctl$DIOCMAP(r4, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r4}) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="69b8159b6174aaa7aaaaaabb86dd60102e6e"]) execve(0x0, 0x0, 0x0) mknod(&(0x7f0000000040)='./bus\x00', 0x100000000205f, 0x2a02) unlink(&(0x7f00000000c0)='./bus\x00') r5 = open(&(0x7f00000002c0)='./bus\x00', 0x0, 0x0) accept$unix(r5, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x8) 1.423321118s ago: executing program 6 (id=10): r0 = socket$inet(0x2, 0x3, 0x40) setsockopt$sock_int(r0, 0xffff, 0x800, &(0x7f00000011c0)=0xb92, 0x4) socket$inet(0x2, 0x5, 0x2) r1 = socket$unix(0x1, 0x5, 0x0) bind$unix(r1, &(0x7f00000000c0)=@file={0xe, 0x1, './file0\x00'}, 0xa) listen(r1, 0x1) select(0x40, &(0x7f0000000000)={0x0, 0x2, 0x0, 0xfffffffffffff40d, 0x5, 0x8001, 0x590e, 0x5}, &(0x7f0000000040)={0xa9d4, 0x0, 0x9, 0x2, 0x6, 0x7, 0x7ff, 0x3}, &(0x7f0000000080)={0x10001, 0x8, 0x7, 0x25df, 0x249, 0x5, 0x6, 0x8}, &(0x7f00000000c0)={0xfffffffffffffffc, 0x80000000}) sendto$inet(r0, 0x0, 0x0, 0xa, &(0x7f00000002c0)={0x10, 0x2, 0x2, 0xffffffff}, 0x10) socket$inet(0x2, 0x3, 0x40) (async) setsockopt$sock_int(r0, 0xffff, 0x800, &(0x7f00000011c0)=0xb92, 0x4) (async) socket$inet(0x2, 0x5, 0x2) (async) socket$unix(0x1, 0x5, 0x0) (async) bind$unix(r1, &(0x7f00000000c0)=@file={0xe, 0x1, './file0\x00'}, 0xa) (async) listen(r1, 0x1) (async) select(0x40, &(0x7f0000000000)={0x0, 0x2, 0x0, 0xfffffffffffff40d, 0x5, 0x8001, 0x590e, 0x5}, &(0x7f0000000040)={0xa9d4, 0x0, 0x9, 0x2, 0x6, 0x7, 0x7ff, 0x3}, &(0x7f0000000080)={0x10001, 0x8, 0x7, 0x25df, 0x249, 0x5, 0x6, 0x8}, &(0x7f00000000c0)={0xfffffffffffffffc, 0x80000000}) (async) sendto$inet(r0, 0x0, 0x0, 0xa, &(0x7f00000002c0)={0x10, 0x2, 0x2, 0xffffffff}, 0x10) (async) 1.423026658s ago: executing program 6 (id=11): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DIOCXBEGIN(r0, 0xc0104451, &(0x7f00000001c0)={0x2, 0x408, &(0x7f0000001800)=[{0x0, './file0\x00', 0x5}, {0x1, './file0\x00', 0x7fffffff}]}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x11}, 0x2, 0xfffffffffffffffe, 0x0, 0x0, 0x0) r1 = socket$inet6(0x18, 0x1, 0x6) bind$inet6(r1, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000000000000000000000000001", 0x7}, 0x1c) mknod(&(0x7f00000002c0)='./file0\x00', 0x2000, 0x5200) r2 = open$dir(&(0x7f0000000000)='./file0\x00', 0x80, 0x3247f5272cf8d3c7) close(r2) r3 = dup3(r2, r2, 0x20004) ioctl$WSDISPLAYIO_GETSCREEN(r3, 0xc0245755, &(0x7f0000000080)={0x4, './file0\x00', './file0\x00'}) setitimer(0x1, &(0x7f0000002900), &(0x7f0000002940)) r4 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$BIOCSETIF(r4, 0x8020426c, &(0x7f0000000040)={'tap', 0x0}) 1.421987538s ago: executing program 2 (id=12): r0 = socket(0x6, 0x4000, 0xb) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x9, 0xfffffffb, 0x3, 0x101, 0x5, 0x1, 0x4003, 0x10, [{0x5, 0xfe3, 0xffff7f26, 0x71800}, {0xfffffffd, 0x9, 0x800002, 0xa}, {0x100806, 0x0, 0x4, 0x2}, {0x2, 0x0, 0x200, 0x94}, {0x4, 0x4, 0x80000000, 0x7}, {0xffffffff, 0x1000, 0x1400000a, 0xc}, {0x5, 0xbffffff5, 0x7, 0x6d}, {0x2000a, 0x8, 0xfdf0, 0x9}, {0x4000000, 0x7, 0x34, 0xa}, {0xfffffc04, 0x3, 0x8003, 0x1}, {0xa44f, 0xfff9, 0xa38c000, 0x80000001}, {0x80000c9, 0x5, 0xc, 0x8}, {0x2000df, 0x9, 0x15}, {0x10008, 0xe2, 0xfffffff8, 0x2}, {0x5, 0x5, 0x24, 0x4}, {0x4, 0xd655, 0x3, 0x6}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x7890, 0x800c1, 0xb, 0x1, 0x1040807, 0x50001, 0x3, 0x0, 0x0, 0x8, 0xf5fffffffffffff9}) r1 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r1, 0xc0106924, &(0x7f00000001c0)) openat$wskbd(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) lseek(r2, 0xafb, 0x1) setitimer(0x2, &(0x7f0000000000)={{}, {0x0, 0xe9db}}, 0x0) r3 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) ioctl$WSKBDIO_SETMAP(r3, 0x8010570e, &(0x7f0000000300)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000140)={{0x0, 0x1}, {0xffffffff}}, 0x0) ioctl$FIONREAD(r0, 0x8080691a, &(0x7f0000000100)) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) r4 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$WSKBDIO_SETMODE(r4, 0x80045713, &(0x7f0000000100)=0x1) r5 = open(&(0x7f0000000100)='./file0\x00', 0x10, 0x8) sysctl$vm_swapencrypt(&(0x7f0000000040)={0x7, 0x2, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x0) sysctl$kern(&(0x7f0000000040)={0x1, 0x59}, 0x3, &(0x7f00000000c0)="3bf2ee74e747c82dad6eb2a36fa755e1a3925fe49afca7e63b52fa65ccaa74d6e6b85b6cdced70357ef201f97842b1068dca31553fa2d7031f38c03e56ad0e24dfc4f97b8b7f81499647e6e7725765d61436c85e43c15d12a78cb8c57ddde87021d7b685507fd3e0652f35e45bdaa3afd86c4fe557433e4c2b632de71c951516adff26aa2e48b45f8ce92bcefd3eceefabee7e3ebe806fdb4f6af569ae94b5d127", &(0x7f0000000080)=0x4, &(0x7f0000000340)="5a67923ef0cb189971421989ebcff78831a7581e2f27caa362f1363042efb27688b2c899220fb2fe37e467d974592496856ca7b78060998608c2f952e43bc0bf11555cc5cb0fe17b2ec1be389871829bfe10dd4c4d2c8f9da2bd2868fd86791dc09dc4fa89a217458bdaed31003fdc3a7323189ba3ccbad6c8af17516e4557f61ad20180000000000000125f568ca7d3396b9057255f381855110eb3a673713716cdf010ddfa7977f92cf061ad125ca670353b45d53aae196b00271f9d3452b523b3dea22d6027625614312183724b71c7eb02083a410c1c99fa455013521f98686e472b70b560f7021f567adf4d", 0x4) ioctl$TIOCSETD(r5, 0x8004741b, &(0x7f0000000080)=0x8) r6 = socket(0x2, 0x8002, 0x0) r7 = semget(0x0, 0x1, 0x281) setgid(0xffffffffffffffff) setgroups(0x0, 0x0) setuid(0xffffffffffffffff) semctl$GETNCNT(r7, 0x1, 0x3, 0x0) r8 = fcntl$dupfd(r6, 0x2, 0xffffffffffffffff) sysctl$kern(&(0x7f0000000000)={0x1, 0x5}, 0x2, &(0x7f0000000180)="0ea5e0cb29987dd5106484deda60e2069d6d9940442e1663d40fde6c7a900108dc4bdf8345d34bbaa850781eb95423f0c655166b5a9ca6a4510dcc33b2325b6c619ae13d4105d31c83839a3c05b6c50077dc4c47c4a1614a387615f8c4cb49d64f238a4f419d057fcd75ff62f1b5acb37b2d7ca31a4ac7afb8bfd2e74124b7ff8ad97205d1bd67dc605775b778113839ffca0ce88b09eb0f413408053fc6cdb36cc16f048e9be3e48001a2c7d793843a22f8d7c726576ea22c4e5f1c3606f5d92f09bdb71bbc09dbe15cbaaac9d1e374673b90b1b4770447ab3ff7f0a27c94dec3e60241c4ae3d739722c21e08cf3eb5eebd3875a80b8b45f68bfacb", &(0x7f0000000280)=0xfc, &(0x7f00000002c0)="7bc2", 0x2) closefrom(r8) 356.199089ms ago: executing program 4 (id=5): r0 = socket(0x11, 0x3, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x1000, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x4, 0x0) select(0x40, &(0x7f0000000000)={0x8, 0x3ff, 0x0, 0x2000004, 0x0, 0x0, 0x8000000000000000}, &(0x7f0000000380)={0x9, 0x0, 0x6, 0x0, 0x0, 0x3, 0x2}, 0x0, 0x0) sysctl$vm_swapencrypt(&(0x7f0000000040)={0x6, 0x1b, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x0) msgget(0x1, 0x315) msgget(0x1, 0x42) sendto$unix(r0, &(0x7f0000000200)="b1000513000000000000000020000000000013fecea10500fef96ecf2ac72fd3357ae30208004e3039d2d236acf20b7804be38164991f7c8cf7f882b297be1aa0500000051e2f0ad3ebbc257699af4879b672f335c223e7d0c032bfa896443a41c18000000720fd38bfbb770bef5a872c88106002ec5890400000000000000361b1257aea8c508002002fbfe0c2300008abfba0900000008e371a3f8343712051eeab7196fcbd80407000000c011200000e1718d30d4a13f1dd80460259bbdf3688f457ceb4dbd32bcd83790095c6eb09e606187259a80efe2122e02afb4f82cdc77eaa6a35869ff4c2c2e07ed6f2f37ceb26a25109b47e440a5b3da3aad2c170e1d9840746d7729bb0cd2ce63ab858a44c30951d643e0b1b411780a", 0xb1, 0xe, 0x0, 0x78) 297.264564ms ago: executing program 1 (id=13): socket(0x11, 0x3, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004500009598f7aa1dbf4b9a41c4cc422c271c0000300000009078e000"]) syz_emit_ethernet(0x1000e, &(0x7f0000000080)={@random="b905f0ffffff", @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0xffb0, 0x0, 0x1, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @icmp=@info_request={0xf, 0x0, 0x0, 0x205c, 0x3}}}}}) (async) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffe}, {0x2, 0x0, 0x0, 0xffffffff}, {0x7f, 0x0, 0x0, 0xbbf}]}) (async) sysctl$kern(&(0x7f00000000c0)={0x1, 0x49}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0xff0a, 0x0, 0x37) 295.752024ms ago: executing program 5 (id=6): mkdir(&(0x7f0000000100)='./file0\x00', 0x100) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) unveil(&(0x7f00000007c0)='./file0/../file0\x00', &(0x7f00000000c0)='c\x00') unveil(&(0x7f0000000200)='./file0/file0\x00', &(0x7f00000001c0)='x\x00') unveil(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='c\x00') unveil(&(0x7f0000004c00)='./file1\x00', &(0x7f0000004c40)='c\x00') ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) symlink(&(0x7f0000000000)='\x00', &(0x7f0000000040)='./file0\x00') openat$speaker(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) 294.842677ms ago: executing program 7 (id=8): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$DIOCRGETASTATS(r0, 0xc4504447, &(0x7f0000000600)={{'./bus\x00', './bus\x00', 0x0, 0x2}, 0x0, 0xa0, 0x0, 0x5, 0xe, 0x206, 0x20003, 0x2, 0x1000ce6}) mknod(&(0x7f0000000000)='./bus\x00', 0x3a0914c44f7b202d, 0x6) (async) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x10, 0x0) fcntl$lock(r1, 0x9, &(0x7f0000000080)={0x1, 0x2, 0xfffffffffffffffc, 0x20001fffffffd}) (async) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x10, 0x0) fcntl$lock(r2, 0x9, &(0x7f0000000000)={0x0, 0x2, 0xd9, 0x20001fffffffd}) (async) r3 = open(&(0x7f0000000080)='./bus\x00', 0x8000, 0x8) ioctl$TIOCSTAT(r3, 0x20007465) r4 = syz_open_pts() (async) r5 = socket(0x18, 0x3, 0x85) sendmmsg(r5, &(0x7f0000000240)={{&(0x7f0000000180)=@in={0x10, 0x2, 0x3, 0x1}, 0x10, 0x0, 0x0, &(0x7f0000000300)=[{0x40, 0xfffe, 0x6, "941975ed07d065a9debc23a5b6bd748098cdead39812324180f5fdcf074f9ca004d5787077594dc4c16266f4ff6deb1c02"}, {0x10, 0x29, 0xbe, '\x00'}, {0x8c, 0x1, 0x3, "82e2965cf3b22275c77326d98c36ced8e50e9aaf7a1b75b4a09667ac27d1e4b8591a78867572dcf5dc752f406d10599317b0359c7127aa8b3ab6fa11bf120fec401b77988d87c2b6bc91a3acb819d801cc7194610afd36ce9a978df7bae5f3d3d031abc37f9532f975c644c96e6f77688a5432d19b4631b44c717cec27eb"}, {0x30, 0x1, 0x4, "0f2e7fd9ccd65020df7d24de64f18667775ac8dfd4c8b013ce229060a70231dd246f46cc"}], 0x10c}}, 0x38, 0x0) (async) ioctl$TIOCGWINSZ(r4, 0x40087468, &(0x7f0000000040)) 290.032593ms ago: executing program 5 (id=14): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x30000) ftruncate(r0, 0x6) select(0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0) socket$inet(0x2, 0x1, 0x0) (async) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r1, 0x1) setuid(0xee01) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0x25}, 0x4, &(0x7f0000000140), 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x10, 0x2, 0x0, 0xac1400ff}, 0x10) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x10, 0x2, 0x0, 0xac1400ff}, 0x10) setsockopt(r1, 0x6, 0x6, &(0x7f0000000140)="d36f456174630986e9c25e95530ceff5a9b3906afae860c5b7c135e085434f0908cbed6cddf407e0ce06ccba5d6474f5cf03e64d0aa527f595be2a080cffb16c72d50400a92c1965b73ecdc7486b018af77e3d81a5b0b8c012b5f5850f58bbcb1c95f9f9ad24f6d1b5e325f200f9378b67ae80e03237aafef3f4b2e056e190ddfc67a9894a00e98b0a89d3dcb60159f60400866740603e70c92e57e123ac7c67200a99b0fe6f1603dafa2def5336150fe4a0c5048f2fd5f00134d9762f", 0xbd) (async) setsockopt(r1, 0x6, 0x6, &(0x7f0000000140)="d36f456174630986e9c25e95530ceff5a9b3906afae860c5b7c135e085434f0908cbed6cddf407e0ce06ccba5d6474f5cf03e64d0aa527f595be2a080cffb16c72d50400a92c1965b73ecdc7486b018af77e3d81a5b0b8c012b5f5850f58bbcb1c95f9f9ad24f6d1b5e325f200f9378b67ae80e03237aafef3f4b2e056e190ddfc67a9894a00e98b0a89d3dcb60159f60400866740603e70c92e57e123ac7c67200a99b0fe6f1603dafa2def5336150fe4a0c5048f2fd5f00134d9762f", 0xbd) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000200)=ANY=[@ANYBLOB="ee66da2bd34b796d2580008008004510002c0067000000119078e0000002ac1400aa4e234e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="474f9f98e49cee3d64b7502739abac4974f07af67a0a849b7c4b704ddcf1ba146855b40eaacbd9628144d3e6957e95282ca33a61ca97a977e1ed7954a405a45766f7feca14ac869ea94e35cbb9d00020784a7c8c92"]) (async) syz_emit_ethernet(0x3a, &(0x7f0000000200)=ANY=[@ANYBLOB="ee66da2bd34b796d2580008008004510002c0067000000119078e0000002ac1400aa4e234e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="474f9f98e49cee3d64b7502739abac4974f07af67a0a849b7c4b704ddcf1ba146855b40eaacbd9628144d3e6957e95282ca33a61ca97a977e1ed7954a405a45766f7feca14ac869ea94e35cbb9d00020784a7c8c92"]) 288.885529ms ago: executing program 1 (id=15): r0 = open$dir(&(0x7f0000000080)='./bus\x00', 0x2, 0x68) r1 = socket(0x2, 0x8002, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r2 = socket(0x2, 0x3, 0x0) setsockopt(r2, 0x0, 0x6, &(0x7f00000000c0)="63e1303d", 0x4) r3 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) closefrom(r3) socket$inet(0x2, 0x3, 0x2) r4 = socket(0x1, 0x1, 0x0) close(r4) chroot(0x0) r5 = socket(0x10, 0x2, 0xf7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(r6, 0x10000000, 0x2000009, &(0x7f0000000100)='\t\a(|', 0x4) connect(r5, &(0x7f0000000000)=@in6={0x1c, 0x18, 0x2, 0x0, "ffe54a09470300261febf2fc8dc83304", 0x1}, 0x1c) r7 = socket(0x18, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb5219f1000b913f1, 0x0) ktrace(&(0x7f0000000080)='./file0\x00', 0x4, 0xd27d43220c7fb8f, 0x0) getitimer(0x0, &(0x7f0000000080)) syz_emit_ethernet(0x15, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000aa"]) setsockopt(r7, 0x1000000029, 0xf, &(0x7f0000000000), 0x0) write(r4, &(0x7f0000000140)="24bdfa5d1d2873c63e35348295b299ab22dbd0734449c365d05ba166e2fea9aec43050006123339a346f731573d8d508753f95b7688a858b8cf6bbca32ec975d185cfcadf68ed7796e53e0000400007a20746f313da7dc645133407dbcafaea3077475df6575658bc77274869b4cf11d1374cacc8af0e650876593f6a8822b437639678a1cc3702368dc70dcf2429a7e1582", 0x92) socketpair$unix(0x1, 0x1, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3, 0x2810, r0, 0x20000000) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0x1b}, 0x4, 0x0, 0x0, &(0x7f0000000000)="01000000", 0x4) open(&(0x7f00000000c0)='./bus\x00', 0x80, 0x20) mknod(&(0x7f0000000200)='./bus\x00', 0x6000, 0x202) rename(&(0x7f0000000140)='./bus\x00', &(0x7f0000000040)='./file0\x00') ioctl$BIOCSETWF(r3, 0x80104277, &(0x7f0000000500)={0x4, &(0x7f00000004c0)=[{0x3ff, 0x2, 0x5, 0xff}, {0x9, 0x0, 0x70}, {0x7, 0x70, 0x8, 0x7}, {0x2, 0x2, 0x8, 0x4}]}) 288.020239ms ago: executing program 3 (id=4): r0 = msgget$private(0x0, 0x460) msgrcv(r0, 0x0, 0x0, 0x5, 0x0) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f0000000240)={'tap', 0x0}) r2 = socket$unix(0x1, 0x1, 0x0) shutdown(r2, 0x2) ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1, 0x4}) r3 = socket(0x18, 0xc003, 0x3a) setsockopt(r3, 0x29, 0x6c, &(0x7f0000000040), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0x66, &(0x7f00000003c0)={0x0, 0x1, 0x14, 0x1}, 0xc) ioctl$BIOCSETF(r1, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x50, 0x0, 0x3, 0x4}, {0x1, 0x9, 0xf7, 0x8100}, {0x1b0e, 0x7f, 0xf4, 0x4000800}]}) syz_emit_ethernet(0x26, &(0x7f0000000000)={@broadcast, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x20, 0x18, 0x0, 0x0, 0x80, 0x1, 0x0, @empty, @rand_addr=0xdfffffff}, @icmp=@generic={0x9, 0x20}}}}}) msgctl$IPC_RMID(r0, 0x2000000) 286.174946ms ago: executing program 6 (id=16): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) sysctl$net_inet_tcp(&(0x7f0000002a80)={0x4, 0x2, 0x6, 0x18}, 0x4, 0x0, 0x0, &(0x7f0000002b80), 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x6, 0x0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x820007f, 0xa, 0x9, 0x0, 0x4, 0xd86, 0x40, 0x2, 0x0, 0x100002000642}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r1 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0xba) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0x7, 0x7, 0x3, 0xb, 0x3, 0x99, 0x10, [{0x5, 0x9, 0x1, 0x7ff}, {0x7, 0x0, 0xffb, 0x4}, {0x10000006, 0x2000f87, 0x0, 0x40007}, {0x0, 0x800, 0x7, 0xffffff}, {0xe, 0x0, 0x9, 0x10000}, {0x6, 0xa, 0x0, 0x8000094}, {0x9, 0xffffffff, 0x1003, 0x71}, {0x1f, 0x10008803, 0x14, 0x1}, {0x2, 0x81, 0x1, 0x9}, {0x6, 0x8001, 0x1, 0x800000b}, {0x4, 0x5, 0x3, 0x3}, {0x0, 0x44, 0x400008, 0x4}, {0xe0, 0x4, 0x5, 0x3}, {0xffff0354, 0xfffffffa, 0x7, 0xa}, {0xffffffff, 0x5, 0x7, 0x1ffffffc}, {0x101, 0x1, 0x5, 0xc3}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0x2000007, 0xfffffffffffffffd, 0x27ffffffffffffff, 0x181c, 0xc, 0x401}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x1) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r2 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(r2, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x8, 0xfffffffa, 0x400, 0x0, 0xa, 0x2, 0x0, 0x0, 0x0, 0x8c6d, 0x10001}) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x2) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$TIOCSETA(r3, 0x80d04466, &(0x7f0000000040)={0xfffeffff, 0xa525, 0x5, 0x127492, "0849a2ba6300000058302a2f0e83050095ea0868", 0x20004118, 0x9}) 259.602877ms ago: executing program 5 (id=17): mkdir(&(0x7f0000000080)='./file0\x00', 0x0) clock_getres(0x4, 0xffffffffffffffff) r0 = fcntl$getown(0xffffffffffffff9c, 0x5) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x2, 0x0, 0x24}, 0x4, 0x0, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0e99db6de761f86, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r1 = open(&(0x7f0000000040)='./file0\x00', 0x70e, 0x0) ioctl$FIONREAD(r1, 0xc0106924, &(0x7f00000001c0)) r2 = getpgrp() setpgid(r0, r2) nanosleep(&(0x7f0000000000)={0x335, 0x4}, 0x0) execve(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 245.306183ms ago: executing program 0 (id=18): r0 = syz_open_pts() fcntl$lock(r0, 0x9, &(0x7f0000000840)={0x2, 0x0, 0x922, 0x1000100000000}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) flock(r1, 0x5) fcntl$lock(r0, 0x8, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x100000001}) 204.596826ms ago: executing program 2 (id=19): r0 = open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x160) setrlimit(0x1, &(0x7f0000000000)={0x100000000, 0xfffffffffffffffb}) ioctl$TIOCSTAT(0xffffffffffffffff, 0x20007465) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x46) ioctl$BIOCGDLTLIST(0xffffffffffffffff, 0xc010427b, &(0x7f0000000240)={0x0, &(0x7f0000000200)}) (async) ioctl$BIOCGDLTLIST(0xffffffffffffffff, 0xc010427b, &(0x7f0000000240)={0x0, &(0x7f0000000200)}) open(&(0x7f0000000080)='./file0\x00', 0x800, 0x100) getsockopt(r1, 0x2, 0x9, &(0x7f00000000c0)=""/117, &(0x7f0000000180)=0x75) fchflags(r1, 0x10001) (async) fchflags(r1, 0x10001) socket(0x18, 0x2, 0x0) (async) r2 = socket(0x18, 0x2, 0x0) setsockopt(r2, 0x1000000029, 0xd, &(0x7f0000000000), 0x14) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000000)=0x9) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) (async) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sysctl$hw(&(0x7f0000001180)={0x7, 0xf}, 0x2, 0x0, 0x0, &(0x7f00000003c0), 0x4) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000140)={0x0, 0x0}) truncate(&(0x7f00000000c0)='./file0\x00', 0x6001000004) preadv(r0, &(0x7f0000002540)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1, 0x7fffffff) (async) preadv(r0, &(0x7f0000002540)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1, 0x7fffffff) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0x25}, 0x4, &(0x7f0000000140), 0x0, 0x0, 0x0) r3 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r3, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(r3, 0x80104267, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x14, 0x9, 0x2, 0x6}, {0x48, 0x9, 0xf7, 0x100}, {0x1b0e, 0xf4, 0xf4, 0x4000800}]}) (async) ioctl$BIOCSETF(r3, 0x80104267, &(0x7f0000000140)={0x3, &(0x7f0000000000)=[{0x14, 0x9, 0x2, 0x6}, {0x48, 0x9, 0xf7, 0x100}, {0x1b0e, 0xf4, 0xf4, 0x4000800}]}) syz_emit_ethernet(0x2e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaad480d5968f290800455c00200026000000019078ac1400bbe0000001120090780000000000000000"]) (async) syz_emit_ethernet(0x2e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaad480d5968f290800455c00200026000000019078ac1400bbe0000001120090780000000000000000"]) 201.036784ms ago: executing program 0 (id=20): r0 = openat$pci(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PCIOCWRITE(r0, 0xc00c7007, &(0x7f00000005c0)={{}, 0x80002, 0x800002}) r1 = openat$pf(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4) (async, rerun: 32) ioctl$TIOCSETA(r1, 0xc0d0446b, &(0x7f0000000740)={0x5, 0x0, 0x0, 0xe1, "0000000400000000000000008000004000", 0xa, 0x800004}) (async, rerun: 32) openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) (async) select(0x40, &(0x7f0000000000)={0xc, 0x3e4, 0x0, 0x7, 0xfffffffffffffffc, 0x0, 0x8, 0x8}, 0x0, 0x0, 0x0) (async) r2 = syz_open_pts() close(r2) (async) fcntl$lock(r2, 0x9, 0x0) (async) close(0x3) (async) ioctl$DIOCSETSYNCOOKIES(r1, 0xc0014462, &(0x7f0000000040)=0x2) (async) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xe8, 0x0) sysctl$net_inet_udp(&(0x7f0000000080)={0x4, 0x2, 0x11, 0x2}, 0x4, &(0x7f0000000100)="223ab93f3a69704b7b1b44500ddef192c1d4cbd0defd2fb17fd9f8f580969b139afc120a066ccf2fda58ddf179166ef594549409c062550cd61f98c9ed77002e2ee79d59599f1a090b", &(0x7f0000000180)=0x49, &(0x7f0000000280)="3d718f76b96ccd68d371a65ba85f27c3c3e26cf43cdb2290d65df4266ea33ed258814afe158e733892aae17fa3f913375e6834d36d7d46d2cc93d7548fc2cc6e62e7f72c9e65017f9c1a0ebe77839b21e7f6a135df7dd086f767605639796c900147415ba2d2e2993a12586335bc165b48899e2f99adbd14ea6ea747b07efbc782206fdf8f59770e86485c7efa412e04c6b6a73c43507312b258854396c92bb77df0b599e2bf666c756837c3916f00fd125f2590b89c93dec6fa52ce48698d79d45c2d82b57f66ec0c88aa6b0d8071e55a3ad36359b490cf5a67e49bf8", 0xdd) (async) chmod(&(0x7f0000000040)='.\x00', 0x35e) (async) setuid(0xee01) (async, rerun: 32) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) (rerun: 32) chflags(&(0x7f0000000080)='./file1\x00', 0x10000) (async) r4 = fcntl$dupfd(r3, 0x3, 0xffffffffffffffff) ioctl$WSKBDIO_GETMAP(r4, 0x8004667d, &(0x7f0000000240)={0xffffffffffffff82, 0x0}) ioctl$DIOCSTOP(r1, 0x20004402) 199.886448ms ago: executing program 0 (id=21): kqueue1(0x4) (async) sysctl$net_inet_ip(&(0x7f0000000ac0)={0x4, 0x2, 0x0, 0x20}, 0x4, 0x0, 0x0, 0x0, 0x0) (async) r0 = socket$inet(0x2, 0x1003, 0x9) (async) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x100000000000000, 0x10000100000001}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) (async) r1 = socket(0x18, 0x3, 0x0) setsockopt(r1, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) (async) connect(r1, &(0x7f0000000080)=@in6={0x1c, 0x18, 0x3, 0x6, "e7c152abe701e9216acd72d58c40979c", 0x7}, 0x1c) write(r1, 0x0, 0x0) (async) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r2 = syz_open_pts() close(r2) (async) r3 = syz_open_pts() ioctl$TIOCSETA(r3, 0x802c7414, &(0x7f0000000040)={0x2000000, 0x5, 0x7, 0xffffffff, "43662061dd530a50521c8e0c430741272a39e52a", 0x1, 0x5}) ioctl$TIOCSETD(r2, 0x8004745f, &(0x7f0000000000)=0x1d) (async) connect(r0, &(0x7f0000000040)=@un=@file={0x7, 0x0, './file0\x00'}, 0xa) (async) getsockopt(r1, 0x4, 0x2, &(0x7f00000000c0)=""/191, &(0x7f0000000180)=0xbf) 199.38175ms ago: executing program 1 (id=22): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x80000000, 0xffff63de, 0x8000005, 0xffe, 0x8, 0x3, 0xf7, 0x10, [{0x8, 0xb, 0xfffff116, 0x80000001}, {0x3, 0xffffffff, 0x4, 0xfff}, {0x4, 0x4baa, 0x3, 0xd}, {0x17, 0xe2, 0xf, 0x100}, {0x3, 0xfffff800, 0x5, 0xffffffff}, {0x7890, 0xfffb, 0x8, 0x2}, {0x3, 0x800, 0x3, 0xfffffffa}, {0x204, 0xffffffff, 0x27ffc, 0xffffe2e9}, {0x9, 0x1000, 0x6, 0x7fff}, {0x3, 0x11, 0x0, 0x8bfd}, {0xfffffffd, 0x0, 0xc, 0x6}, {0x9, 0x4, 0x800000, 0x5}, {0x401, 0x4, 0x40000b, 0x2}, {0x3, 0x6e2, 0x1, 0x6f5fc48f}, {0x3, 0x101, 0x3, 0x9}, {0x8ff9, 0x1, 0x100000, 0x400}]}) r0 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$WSMOUSEIO_SETPARAMS(r0, 0x80105727, &(0x7f0000000080)={0x0}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x49}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0xfffffffffffffe3c, 0x0, 0x37) 197.946449ms ago: executing program 4 (id=23): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0e99db6de761f86, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x2, 0x0) ioctl$FIOASYNC(r0, 0x8004667d, &(0x7f0000000180)=0xffff945f) closefrom(r0) r1 = socket$inet(0x2, 0x1, 0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) pread(r2, &(0x7f0000000180)='+', 0x1, 0x8000000000000000) sysctl$net_inet_ip(&(0x7f0000000100)={0x4, 0x2, 0x0, 0x1d}, 0x4, &(0x7f0000000140)='\\#', &(0x7f0000000180)=0x2, &(0x7f00000001c0)="208882db644cccc69e9c8261c99f9535882c05ea", 0x14) ioctl$BIOCSFILDROP(r2, 0x80044279, &(0x7f0000000040)=0x8) bind$inet(r1, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r1, 0x7fff) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3d, 0x2c, 0x67, 0x0, 0x40, 0x6, 0x0, @rand_addr, @local={0xac, 0x14, 0x0}}, @tcp={{0x2, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x81fe, 0x0, 0xfffc, {[@generic={0x8, 0x2}]}}}}}}}) 130.899081ms ago: executing program 0 (id=24): utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={{0x9, 0x1}, {0x5, 0x3}}) r0 = socket$unix(0x1, 0x2, 0x0) accept$unix(r0, 0x0, &(0x7f0000000080)) r1 = openat$pf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) link(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') ftruncate(r0, 0x182) r2 = openat$pf(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$DIOCGETQUEUES(r2, 0xc148445e, &(0x7f00000001c0)={0x75, 0x40, {'\x00', './file0\x00', './file0\x00', './file0\x00', {{0x7ff, 0x79d36b64}, {0x5, 0x3a}, 0x6}, {{0x9, 0x6f52}, {0x2, 0x3ff}, 0x5}, {{0x8001, 0x3}, {0x1, 0x8}, 0x99be}, {0xc4bd, 0xb475, 0x4, 0x5}, 0x0, 0x3, 0x10, 0x9, 0x3}}) mkdir(&(0x7f0000000340)='./file0\x00', 0x61) bind$unix(0xffffffffffffffff, &(0x7f0000000380)=@file={0x0, 0x0, './file0\x00'}, 0xa) select(0x40, &(0x7f00000003c0)={0x7fffffffffffffff, 0x7a770ace, 0x4, 0x1, 0x5, 0x0, 0x0, 0x2}, &(0x7f0000000400)={0xfffffffeffffffff, 0x800, 0x9, 0xb6, 0x7fff, 0x8, 0x3, 0x1}, &(0x7f0000000440)={0x8e0c, 0x5, 0x0, 0x5, 0x200, 0xffff, 0x3ff, 0x92}, &(0x7f0000000480)={0x80000001, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffff9c, 0xc01864c6, &(0x7f0000000500)={&(0x7f00000004c0)=[0x7, 0xfffffffd, 0xef7, 0xffff, 0xe], 0x5, 0x0, 0x0, 0xffffffffffffffff}) r4 = accept$inet(0xffffffffffffffff, &(0x7f0000000540), &(0x7f0000000580)=0x10) r5 = fcntl$dupfd(r3, 0xc, r4) ioctl$DIOCGETRULESETS(r1, 0xc444443a, &(0x7f00000005c0)={0x2, './file1\x00', './file0\x00'}) r6 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000a40), 0x1, 0x0) poll(&(0x7f0000000a80)=[{r3, 0x40}, {r3, 0x10}, {r6, 0x4}, {r4, 0x40}, {r0, 0x4}, {r1, 0x80}, {r5, 0x103}], 0x7, 0x5e) r7 = openat$pf(0xffffffffffffff9c, &(0x7f0000000ac0), 0x20000, 0x0) r8 = fcntl$dupfd(r3, 0xa, r1) accept$inet6(r8, 0x0, &(0x7f0000000b00)) setrlimit(0x8, &(0x7f0000000b40)={0x7f, 0x4}) setrlimit(0x3, &(0x7f0000000b80)={0x9, 0x4f2c}) readlinkat(r5, &(0x7f0000000bc0)='./file1\x00', &(0x7f0000000c00)=""/100, 0x64) msgget$private(0x0, 0x2) ioctl$WSDISPLAYIO_ADDSCREEN(r8, 0x80245753, &(0x7f0000000c80)={0x800, './file0\x00', './file0\x00'}) readlink(&(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)=""/214, 0xd6) ioctl$DIOCKILLSTATES(0xffffffffffffff9c, 0x0, &(0x7f0000000e00)={{0x0, 0x21}, 0x1a, '\x00', 0xfffffff9, {@any={'\x00', 0x0, 0x1, 0x80}, [0x245, 0x9], 0xb7, 0x9, 0x7}, {@any={'\x00', 0x0, 0x5, 0xb}, [0x5, 0xfe00], 0x3, 0x6, 0x3}, './file0\x00', './file0\x00', 0xc, 0x5}) ioctl$DIOCKILLSTATES(r7, 0x0, &(0x7f0000000f00)={{0x3, 0x5bf, 0x3}, 0x1a, '\x00', 0xd4, {@any={'\x00', 0x0, 0x1}, [0x8001, 0x9], 0x5, 0x8, 0x4}, {@any={'\x00', 0x0, 0x4, 0x40}, [0x80, 0x828e], 0x0, 0x7, 0xffff}, './file0\x00', './file1\x00', 0x19, 0x76e}) closefrom(r4) ioctl$DIOCGETRULESETS(r7, 0xc444443a, &(0x7f0000001000)={0xc5f, './file0\x00', './file0\x00'}) 130.133456ms ago: executing program 4 (id=25): mknod(&(0x7f0000000400)='./file0\x00', 0x2000, 0x5c4a) r0 = open(&(0x7f0000000080)='./file0\x00', 0xc2, 0x0) r1 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r2 = socket$inet6(0x18, 0x3, 0x2) setsockopt$sock_int(r2, 0xffff, 0x1000, &(0x7f0000001300)=0x3, 0x4) sendmsg$unix(r0, &(0x7f0000000ac0)={&(0x7f00000001c0)=@abs={0xfe, 0x0, 0x0, 0x1}, 0x8, &(0x7f0000000a40)=[{&(0x7f0000000200)="0929f5619c341d821442036e57964d509883dedc4a17a4b71427468b3c40bc894457842c042c33c53467fcfa72c4c966e754490d7533474bad8f931b1a18c2ca841f5f7820ef59f6fa", 0x49}, {&(0x7f0000000700)="0760261fde9b0b25ee9b2bd659f8e6d37726", 0x12}, {&(0x7f0000000740)="713191c3a3751a82a0c0c5af7be29d98ab9a1bf555d0aaaf93fdd7e695e09dc6dd1dc6dc38312aafd8676c84666fed14024041221e1cb94982973b4d10158aaa69ba0c3ccd2b00003ed9fc9e17b0b324286e0df68bedf513b2acbdf0cfe679effa3a9cdad24398599c39537443568d9a03638059d6ad48dd9588c437d0d1c4016e2619c9dc0a124348ed3c396643ea2270ec440316eb24f4aeadde7d364399eeb69d4c57ba9c2635d9", 0xa9}, {&(0x7f0000000800)="1aae5e1875d6d76fa3feadbeae8b5212deb1eefc99b91632a93c3c6f39faab1173bd856c4c3b722ec0b27e6013680143bacccdce5c7dbb8b3b2ad524f5bca55e7dc0388c5bbf49fbc535225bbfae2b1fc5741040d35b41460e48f171ee06216139efa87398826871b8d2f28ebc5b937d3f4cf0e35c581f3b", 0x78}, {&(0x7f0000000880)="d645e542798dadabfe590ed5398e23ae46dc54c37d09671413c3a7fdd7ad03381c66533949c1d052da96d4cfc3fe64d17ecf45587cd4b8f1472e3766e8ae2c313b4091ec949cc39f56a6a5cd2f3f4cf47c51846edb90823199efbadc179fee13843fe4e12f835b45abcb6c46783fbc077f6848fdc88777741e71048db577f9e12f4037bf6a7be521b09593e4491a9bd14d507ef2c577a0fa82b531e31f67ca0e0872c89554ea1a938ccbeabcb8d6fb276cc5590ec56ce1", 0xb7}, {&(0x7f0000000940)="5e31e17b226699447f8a3180c69cf5e17ce772155cb3d4a9db80853dc6ca6282bd5c7e19474a655f2d06c16c160c931fb0a659ebc65d19b77942611dc333fff7c58694a47d07598bb6ce5847a634452d69cd538316f5476a60005b3c5732cb5ed12ec593851dbb45ef5c23a42846b01ee9959903835d30033acb6013e779c30b2797733819e6723f95f4d35f72509de24a2dbcb858dbc438187882753a8a7d736d8105616afbcde3bd09d44b7e9633da30dcfb335937951c7a32f1450e06af65d8a814a440bd455965e614793a9c9d8d7ffb18a26c0c93", 0xd7}], 0x6, 0x0, 0x0, 0xc}, 0x8) bind$inet6(r2, &(0x7f0000000040)={0x1c, 0x18, 0x2, 0x7, "000000000000005600000008065f00", 0x9}, 0x1c) syz_emit_ethernet(0x1000e, &(0x7f0000000140)=ANY=[]) openat$speaker(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) sysctl$kern(&(0x7f0000000000)={0x1, 0x30}, 0x2, &(0x7f0000001940), 0x0, 0x0, 0x0) writev(r1, &(0x7f0000003780)=[{&(0x7f0000000080)="4bd5834f4cedaaf8103e31fec00201b234b8d582abcd38b2bb6d3e3cd4f6dc0f0f9b9cfd33b8257e8bba0b3dc7845dd27754ca9829607091dd9fb6b1eac14167047880fa672d", 0x46}], 0x1) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$DIOCRSETTFLAGS(r3, 0xc450444a, &(0x7f0000000280)={{'./file0\x00', './file0\x00', 0x7, 0x2}, 0x0, 0x0, 0x0, 0x1, 0xf5b8, 0x2d, 0x6f8, 0xc6}) close(r1) fcntl$dupfd(r1, 0xa, r1) unveil(0x0, &(0x7f0000004c40)='c\x00') bind$inet6(r2, &(0x7f0000000100)={0x1c, 0x18, 0x0, 0xfffffffe, "0b4b88128cfeaede16a6dd47fcc3e034", 0xfffffff8}, 0x1c) symlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') 125.540702ms ago: executing program 7 (id=26): mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x12, 0xffffffffffffffff, 0x3) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000000)={0x4, 0x0, 0xffffffffffffffff}) listen(r0, 0xfa8f) futimes(r0, &(0x7f0000000040)=[{0x0, 0x800}, {0x1, 0x4}]) (async) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3) (async) r1 = shmget(0x3, 0x3000, 0x4b0, &(0x7f0000ffd000/0x3000)=nil) shmat(r1, &(0x7f0000ffd000/0x1000)=nil, 0x0) shmat(r1, &(0x7f0000ffd000/0x1000)=nil, 0x3000) (async) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) (async) fstatat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x8) (async) getresuid(&(0x7f00000001c0)=0x0, &(0x7f0000000200), &(0x7f0000000240)) getsockopt$SO_PEERCRED(r0, 0xffff, 0x1022, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0xc) r6 = fcntl$getown(r0, 0x5) shmctl$IPC_SET(r1, 0x1, &(0x7f00000002c0)={{r2, r3, r4, r5, 0x28f, 0x6, 0x0, 0x0, 0xfffffffffffffe13}, 0xff, 0x0, r6, 0x294, 0x0, 0x1ff, 0x9, 0x7, 0xffff, 0x686ecd3f}) (async) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0) (async) ioctl$DRM_IOCTL_MODE_GETGAMMA(r0, 0xc02064a4, &(0x7f0000000400)={0x0, 0x1, &(0x7f0000000340)=[0x8000], &(0x7f0000000380)=[0x9, 0x5, 0xf, 0x9, 0x9, 0x40, 0x0, 0x5], &(0x7f00000003c0)=[0x7ff, 0x9, 0x0]}) ioctl$DRM_IOCTL_MODE_CLOSEFB(r0, 0xc00864d0, &(0x7f0000000440)={0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000480)={r7, r8, 0x2, 0x0, 0x41b}) (async) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) (async) r9 = openat$wsdisplay(0xffffffffffffff9c, &(0x7f00000004c0), 0x80, 0x0) pread(r9, &(0x7f0000000500)="e36dea9de4779f911895fbe9c9f9a4d006bf89c6877ff0e3b3b4b166a4b0bd9456725d00c737797d", 0x28, 0x3) (async) shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x1000) r10 = accept$inet(r0, &(0x7f0000000540), &(0x7f0000000580)=0x10) setsockopt(r10, 0x6, 0x8, &(0x7f00000005c0)="6258f3d7fad1b7f7c94b9f4571039ba5", 0x10) setsockopt$sock_int(r10, 0xffff, 0x200, &(0x7f0000000600)=0x7fffffff, 0x4) (async) fcntl$setown(r0, 0x6, r6) (async) shmget(0x3, 0x3000, 0x200, &(0x7f0000ffa000/0x3000)=nil) (async) ioctl$FIONREAD(r0, 0x4004667f, &(0x7f0000000640)) r11 = shmget(0x3, 0x2000, 0x100, &(0x7f0000ffd000/0x2000)=nil) shmctl$IPC_STAT(r11, 0x2, &(0x7f0000000680)=""/76) 122.365732ms ago: executing program 7 (id=27): r0 = syz_open_pts() r1 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(0x0, r3, 0x0) semctl$IPC_SET(0x0, 0x0, 0x1, 0x0) semctl$GETPID(r1, 0x3, 0x4, &(0x7f0000000240)=""/197) r4 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) writev(r4, &(0x7f0000003780)=[{&(0x7f0000000080)="4bd5834f4cedaaf8103e31fec00201b234b8d582abcd38b2bb6d3e3cd4f6dc0f0f9b9cfd33b8257e8bba0b3dc7845dd27754ca9829607091dd9fb6b1eac14167047880fa672d", 0x46}], 0x1) unveil(0x0, &(0x7f0000004c40)='c\x00') setgroups(0x0, 0x0) setuid(0xffffffffffffffff) semop(r1, 0x0, 0x0) close(r0) writev(r0, &(0x7f0000000000)=[{&(0x7f00000009c0)="2aef1ba69986bfa8bdbecbcad1f3c1622163c1f5228fdb7c32bca7f3fbb73f4dc3a6f65d935878b1eb253cd096f8cc79616313b32f5322e0b353900f16", 0x3d}], 0x1) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r5) kill(0xffffffffffffffff, 0x1) 63.470044ms ago: executing program 5 (id=28): r0 = socket(0x18, 0x1, 0x0) ioctl$FIONREAD(r0, 0x80206982, &(0x7f00000001c0)) r1 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(0x0, r4, 0x0) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000780)={{0x0, 0x0, r3, r4, 0x8f, 0x9, 0x0, 0x0, 0xfffffffffffffffb}, 0x0, 0x6, 0x0, 0x0, 0x6, 0x0, 0x8}) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r3, r5) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xe8, 0x0) r7 = fcntl$dupfd(r6, 0x3, 0xffffffffffffffff) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r8 = accept(r6, &(0x7f00000002c0)=@un=@file={0x0, 0x0, ""/21}, &(0x7f00000000c0)=0x17) getsockopt(r8, 0xffffffff, 0x8, &(0x7f0000000100)=""/175, &(0x7f00000001c0)=0xaf) pread(r7, &(0x7f0000000200)="3a28613e0000000000000081136aa8d12d15faccd5a1e0cedc56b776ee098b2f8b37f51447b42125768ca572eb14775536ab9ac61e8612", 0x37, 0x81) 62.392961ms ago: executing program 0 (id=29): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xfe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000340)={0x3, &(0x7f0000000300)=[{0xa4, 0x6, 0x3, 0x7}, {0x50, 0x4, 0x8, 0x264}, {0x6, 0x9, 0x2, 0x801}]}) write(r0, &(0x7f00000003c0)="f81ad30100060000000100000000", 0xe) ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f00000000c0)={0xa, 0x8000148, {[0x4, 0x40, 0x6, 0x6, 0xd, 0x8000, 0x0, 0x40000000000, 0x7, 0x400000001, 0x9, 0x91c, 0x8, 0x2000180, 0x0, 0xd3, 0x76, 0xffffffffffffbff7], [0x5438b94c, 0x5, 0x1004, 0x7, 0x1, 0x1, 0x9, 0x3, 0xffffffffffffffff, 0x3], [0x6, 0x8000000, 0x6, 0x8000000008, 0x10000, 0x200000000000210, 0x1000002], [0xfff, 0x10801, 0x3, 0x8, 0x3], [{0x2, 0x7, 0xfffffbfb, 0x5}, {0x2, 0x925, 0x3, 0x338}, {0x1000, 0x7fffffff, 0x0, 0x7f}, {0xb, 0xfffffbff, 0x2, 0xfffffffffffffffd}, {0x1, 0x3, 0x2, 0x8}, {0x1f, 0x6, 0x0, 0x7}, {0xe4, 0xffffff81, 0x1ff, 0x1}, {0x3, 0x10000, 0x8001, 0x5}], {0x8, 0x3, 0x401, 0x8}, {0x7ffb, 0xffffbfc0, 0x8}}}) (async) ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f00000000c0)={0xa, 0x8000148, {[0x4, 0x40, 0x6, 0x6, 0xd, 0x8000, 0x0, 0x40000000000, 0x7, 0x400000001, 0x9, 0x91c, 0x8, 0x2000180, 0x0, 0xd3, 0x76, 0xffffffffffffbff7], [0x5438b94c, 0x5, 0x1004, 0x7, 0x1, 0x1, 0x9, 0x3, 0xffffffffffffffff, 0x3], [0x6, 0x8000000, 0x6, 0x8000000008, 0x10000, 0x200000000000210, 0x1000002], [0xfff, 0x10801, 0x3, 0x8, 0x3], [{0x2, 0x7, 0xfffffbfb, 0x5}, {0x2, 0x925, 0x3, 0x338}, {0x1000, 0x7fffffff, 0x0, 0x7f}, {0xb, 0xfffffbff, 0x2, 0xfffffffffffffffd}, {0x1, 0x3, 0x2, 0x8}, {0x1f, 0x6, 0x0, 0x7}, {0xe4, 0xffffff81, 0x1ff, 0x1}, {0x3, 0x10000, 0x8001, 0x5}], {0x8, 0x3, 0x401, 0x8}, {0x7ffb, 0xffffbfc0, 0x8}}}) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) socket(0x2, 0x3, 0x4) (async) r1 = socket(0x2, 0x3, 0x4) ioctl$FIONREAD(r1, 0x8020690e, &(0x7f00000001c0)) sysctl$kern(&(0x7f0000000080)={0x1, 0x2c}, 0x2, &(0x7f0000000400)="59dcc85c5de01cc941637e07bb91eac3f81c32d6bd2712565f049a1b3c908f56bc5098f8128e00c6281b22f9b315ef4a9681e84b7e7df191a56fcf422954f59c4c8e658e2cd8dcebd7b043144511aa488585d7edf032e50bdfecf15e66fd339640af3230a772446ced80e7e051", &(0x7f0000000480)=0x6d, &(0x7f00000004c0)="abb430bb09abefb82cba866c6da0845f7c38c7db89683426432f5ab728f38cc3065c02466c3b51405f870e063bc699103f9abc8191d568b5b021e33cb3228c01035c2942cf5b79c8242930e8b39ab2f66cb9225bd06c4b5ac5215f5b5e8fc20247526895ce2088dd7325a8f3c6e7f8be75cdf6ca2b00a931fb83eeab1f16ec430d6556487a2778dfd6ed3c3c83", 0x8d) (async) sysctl$kern(&(0x7f0000000080)={0x1, 0x2c}, 0x2, &(0x7f0000000400)="59dcc85c5de01cc941637e07bb91eac3f81c32d6bd2712565f049a1b3c908f56bc5098f8128e00c6281b22f9b315ef4a9681e84b7e7df191a56fcf422954f59c4c8e658e2cd8dcebd7b043144511aa488585d7edf032e50bdfecf15e66fd339640af3230a772446ced80e7e051", &(0x7f0000000480)=0x6d, &(0x7f00000004c0)="abb430bb09abefb82cba866c6da0845f7c38c7db89683426432f5ab728f38cc3065c02466c3b51405f870e063bc699103f9abc8191d568b5b021e33cb3228c01035c2942cf5b79c8242930e8b39ab2f66cb9225bd06c4b5ac5215f5b5e8fc20247526895ce2088dd7325a8f3c6e7f8be75cdf6ca2b00a931fb83eeab1f16ec430d6556487a2778dfd6ed3c3c83", 0x8d) syz_emit_ethernet(0x42, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaabbaaaaaaaaaabb88a83e008100250008004607002c00640004ba379078e00000027f000001000000004e234e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0000000000000000264c48f80839f5b16b837704b511d097da86fce335757d739101042e53611e68b383ce353d1c8ce430321df3d8cea37aa91047f62ee93425548e95dfcb3be8"]) 54.723159ms ago: executing program 7 (id=30): sysctl$ddb(&(0x7f0000000000)={0x9, 0x6}, 0x2, 0x0, &(0x7f0000000080), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$kern(&(0x7f0000000000)={0x1, 0xe}, 0x2, &(0x7f00000011c0), &(0x7f0000000080), 0x0, 0x0) munmap(&(0x7f00001db000/0x1000)=nil, 0x1000) 52.668154ms ago: executing program 4 (id=31): select(0x40, &(0x7f0000000180)={0xfffffffffffffffd, 0x44809e9d, 0xfffffffffffffffb, 0x9, 0x2000000000000000, 0x210, 0x8, 0x3}, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file0\x00', 0x2000, 0x205b9a) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x1) r2 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x10, 0x0) ioctl$DIOCRGETTABLES(r3, 0xc450443f, &(0x7f0000000f80)={{'./file1\x00', './file0\x00', 0x23d8699d9d59d26e, 0x46}, 0x0, 0x428, 0xfffffebd, 0x31d0, 0x80000001, 0x280, 0x7bd, 0x40, 0x4}) ioctl$WSMOUSEIO_SETPARAMS(r2, 0x80105727, &(0x7f0000000080)={0x0}) mknod(&(0x7f0000000000)='./file1\x00', 0x2000, 0x285b9a) r4 = open(&(0x7f0000000080)='./file1\x00', 0x40, 0x132) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$hw(&(0x7f00000000c0)={0x7, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sysctl$kern(&(0x7f0000000040)={0x1, 0x3e}, 0x2, 0x0, 0x0, &(0x7f0000000340), 0x0) ioctl$BIOCSRTIMEOUT(r4, 0xc0307006, &(0x7f0000000040)={0x2, 0x8000000000000001}) 3.760518ms ago: executing program 5 (id=32): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000b40)="825a4f47c21e6ed7eda0f5903abf65b18d7c51f78b06ccffb405000000000000160000002d69e639776665d4cd12c63d34", 0x31}], 0x1}, 0x2) syz_emit_ethernet(0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffff15"]) syz_emit_ethernet(0x56, &(0x7f0000000100)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x20, 0x0, 0x0, @empty, @local={0xfe, 0x80, '\x00', 0x0}, {[@dstopts={0x3a}], @icmpv6=@ndisc_ns={0x87, 0x0, 0x0, 0x0, @loopback}}}}}}) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x2000, 0x4800) r0 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x9) ioctl$TIOCFLUSH(r0, 0xc0187009, &(0x7f0000000080)) ioctl$DIOCRGETTSTATS(0xffffffffffffffff, 0xc4504440, &(0x7f0000000700)={{'./file0\x00', './file0aaaaaaaaaaaaaaaaaaaaaaaaa', 0x0, 0x2}, 0x0, 0x4d0, 0x0, 0x800004, 0x8, 0xff, 0x20401, 0x5e, 0xf}) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$TIOCSETA(r1, 0xc4504445, &(0x7f0000000740)={0x20008, 0x3, 0x2, 0x20000023, "040000000000000100", 0x5, 0x2}) sysctl$net_inet_tcp(&(0x7f0000000000)={0x7, 0x2, 0x2, 0x11}, 0x40000000000001fd, 0x0, 0x0, 0x0, 0x25) 3.263823ms ago: executing program 2 (id=33): setresuid(0xffffffffffffffff, 0x0, 0xee00) r0 = syz_open_pts() r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x20, 0x0) r2 = syz_open_pts() setsid() ioctl$TIOCSCTTY(r2, 0x20007461) socket$inet6(0x18, 0x4000, 0x1) ioctl$TIOCSCTTY(r2, 0x20007461) ioctl$DIOCXEND(r1, 0xc0044464, &(0x7f0000000080)=0x92) ioctl$TIOCSETAW(r0, 0x802c7415, &(0x7f0000000000)={0x2, 0x7fff, 0x2, 0x0, "4a0100000069843ba0951a49f61891e10600", 0xc, 0x80000001}) 2.540955ms ago: executing program 1 (id=34): setuid(0xffffffffffffffff) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000100)='./bus\x00', 0x2000, 0xd02) r0 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x139) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/104}, {&(0x7f0000000140)=""/192, 0x100000}, {&(0x7f0000000340)=""/175}, {&(0x7f0000000000)=""/18}], 0x10000000000002b8, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x820007f, 0x40a, 0x9, 0x0, 0x4, 0xd86, 0x40, 0x2, 0x0, 0x100002000642}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0xba) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0x400001, 0x7, 0x3, 0xa, 0x8, 0x9a, 0x10, [{0x5, 0x6, 0x1, 0x7ff}, {0x7, 0x4, 0xffb, 0x4}, {0x10000006, 0x2000f87, 0x0, 0x40007}, {0x4, 0x800, 0x7, 0xffffff}, {0xb, 0x8000006, 0x9, 0x10003}, {0x6, 0xe, 0x0, 0x8000094}, {0x9, 0xfffffffd, 0x1003, 0x71}, {0x1f, 0x10008805, 0x14, 0x8}, {0x2, 0x81, 0x1, 0x9}, {0x6, 0x8001, 0x1, 0x800000b}, {0x4, 0x5, 0x3, 0x3}, {0x20000000, 0x43, 0x400008, 0x4}, {0xe0, 0x4, 0x5, 0x3}, {0xffff0354, 0x1, 0x7, 0x100006}, {0x0, 0x5, 0x7, 0x1ffffffb}, {0x6, 0x1, 0x80000001, 0xc3}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0x2000007, 0xfffffffffffffffd, 0x27ffffffffffffff, 0x181c, 0xc, 0x401}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) r3 = syz_open_pts() syz_open_pts() ioctl$TIOCSETD(r3, 0x8004741b, &(0x7f0000000000)=0x8) 2.160886ms ago: executing program 7 (id=35): r0 = open(&(0x7f0000000000)='./file0\x00', 0x615, 0x166) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0xc8) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240)=[&(0x7f0000000100)='),#\x00', &(0x7f0000000140)='[\x00', &(0x7f0000000180)='\xe1\\{[\'[$-:\x00', &(0x7f00000001c0)='}&^\x00'], &(0x7f00000002c0)=[&(0x7f0000000280)='\x00']) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r1, 0x0) ioctl$WSDISPLAYIO_GETEMULTYPE(r0, 0xc014575e, &(0x7f0000000300)={0x85a9, './file1\x00'}) ioctl$FIONREAD(r0, 0x4004667f, &(0x7f00000000c0)) r2 = kqueue() kevent(r2, &(0x7f0000000440), 0x3fc, 0x0, 0x8000800, 0x0) ioctl$DIOCGETRULE(r1, 0xcd604407, &(0x7f0000000340)={0x3, 0xebb7, 0x8, './file1\x00', './file2\x00', 0x0, "d6872a748309c15602b3c472dd6fe1309079b3b2ba7ddd451efc73b6ea43a283703865bba05850b8085a99fde26105ba7d3812becc8813362c06a20436e160f2d4e81f6e0f8bbba9a4ded5d14d4206568d42e042b82099eb3386cebc659ca8bf52eff0f67d38a5f84e1de19f41752e81bd7df2d802a8e40adb93c732952b9231b598522b17f5235989e474e0a5d2095c549f647c878a4ee2fa502010beb5a186c9bc09be6edeee91b9a329937423d661d455c7aed5762d820db15a5b51d6d15ab0e30f97af577b761239ee56b6ce98bed42830d8a86e59dc195ca86a97887012546c32aa27320e77b6d0b4bf266eb9b7ed11fb72c7eaf02f432321fc93fc92208f6c538a2247bb854159ca184f3eac18103dfa771c31619f43186ac201b5a20d758089be42f839d487b8d532cd32fa5521eca938f503c896c85d29946012df241e213a494e5e3fdac4946c432b1eaa8507e5780ac85dbbc033c0aec123d44a1d67a92cfc3cbdc78f95fc131ef764fd283758b6ab5cad0b468a9d04b5336fa630e6667f73c91ac2c50ab6be967bd085be4991b292b4bdabd600800f4345ef13e4ef22cbd164b34051cecd0372d3f7aafaab19a8d0d1f775fdf6c281ec563b18aa81900f35296e1981d64f262f4ac423279548540b859eb832984d64592c6b01a6a06495b41793d457e0291e9f9b04839e6cb7e6fcb3eb132017699283144be3d48c80d99168f0cf4d1d858cd5bfeea112867bfb5f06388b515189cf4650b2775cc7e179af29103c315859d2f827f7cd19e4c731f964e078ded598be76d215f889d0c1aa239ad4c86f3fbbc99b2ca0cfe5bfbdf809b58a5c48a06452f5eeb103810d315afc1389b4bd73f8328b310505db961b5ce6791902e58c08b3fe619ae86d619c135603ac6514a1249ae617392a2368f9244bfcdd50efccacbaf577dbc359a76800c11d6f674fb5d6515c864b45a026d06483f1fd9e73d79c8a680e7cb7fdea9b10260976f0c31ad761c36185bdd528736812dd0d79f5149e81bc5bdcf5d9bfe8736c00a9f842170c2d0a2c36c8564605e11d3f6675cea80139dc553d8a4c5b767554daa27dccc440fd06a6ebadb729542eaf079573dcfe78e0ddab904951f59612abb681ae9e8a40df8514e9704b85f7ba221e82ed568e01c36a80980a21861671582b73572fae8957e4e48ccce69acc33710d8a040c9261b85d97bfc05f5213481b5171109ea26b7da2339bc913be07a9762d7529f7d5debb3441d3127b5c20d99edfb3ed899e613a81305cef09590ad4095acb432e71cab9fbf9f65d4845a34373a93cb7158339efe6142161cb3e2072c81fd9309b0f64977531d068ad4a53cca041b98d3470ebbb81cd0ba4ee55a1476dd315bc7a601f8d943308b5a33ca7e7322ca0d383acd335fd8de09b3f6b727a282aab80f8c3265073fa3f1bb87811d645d07fb7449cab740dd4003736660347474b4f9f748f452d5442bf962e473889581d21174a2b25a72aa2cfb7df994aa1984a6fb446ebef9a0cf0168f10af1aacd1b5f2dacd7fada15f6e043777d96c1325443f946f99410d6c30c7615966745d9c62dcd721911f36774c38d147da4e724e53dcc2612771b1cd54aaf791f537b7d2866aa78251a8d7e22b0eedf6428d1a3e7e5891c3225cd80d9629e6bfca032d6ede233b82ea3a66e59bc8dc1c053eacf9fe06845879d62ede9718a36efd981c8652d396a49342efc97a36acffc8a63a45b9439e193d23e91c1bb579068b69f74a1939295e9ffb06a4cd5d2c1d9d61f3e30f7d909f3067c9acd9513942a76b33989791fb35ce1583d6bf3fe04288dd95c8426ff28ee1261482898bfe22d2762950bd3b13ba4cf0098fd9ff95bea2b04b676696162be9ade1030797a877c70db6a14142b1cc5319fac643b86cd5"}) madvise(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4) syz_emit_ethernet(0x1000e, &(0x7f00000015c0)=ANY=[]) 0s ago: executing program 0 (id=36): r0 = socket$inet6(0x18, 0x3, 0x6) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5900) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$BIOCSETIF(r1, 0x80084904, &(0x7f0000000380)={'tap', 0x0}) r2 = socket(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0xffff, 0x1021, 0x0, 0x0) ioctl$BIOCSETIF(r1, 0x40384900, 0x0) ioctl$WSDISPLAYIO_GETEMULTYPE(r1, 0x801c4903, &(0x7f00000000c0)={0x0, './file0\x00'}) bind$inet6(r0, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000000000000000000000000001", 0x9}, 0x1c) openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) r3 = semget$private(0x0, 0x4, 0x661) semop(r3, &(0x7f0000001000)=[{0x0, 0x6, 0x1800}, {0x3, 0x7, 0x1000}], 0x2) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x281, 0x0) write(r4, 0x0, 0x0) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000000c0)={0x10, 0x800000004, [{&(0x7f000014c000/0x4000)=nil, &(0x7f00000b7000/0x3000)=nil, 0x200007fffffffffe}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000124000/0x3000)=nil, 0x7fffffffffffffff}, {&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000795000/0x2000)=nil, 0xb93a}, {&(0x7f00001da000/0x4000)=nil, &(0x7f00006d4000/0x2000)=nil, 0xfdfffffffffffff9}, {&(0x7f0000312000/0x2000)=nil, &(0x7f0000025000/0x3000)=nil, 0x4001}, {&(0x7f000064c000/0x4000)=nil, &(0x7f0000095000/0x3000)=nil, 0x1}, {&(0x7f0000123000/0x3000)=nil, &(0x7f000014d000/0x4000)=nil, 0x4}, {&(0x7f00002f3000/0x3000)=nil, &(0x7f000063b000/0x2000)=nil, 0xffffffffffffffff}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000026000/0x4000)=nil, 0x6}, {&(0x7f00001dc000/0x1000)=nil, &(0x7f00001db000/0x3000)=nil, 0x8}, {&(0x7f0000392000/0x1000)=nil, &(0x7f00003a6000/0x3000)=nil, 0x1000}, {&(0x7f00006b8000/0x4000)=nil, &(0x7f0000688000/0x4000)=nil, 0x6}, {&(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x51c}, {&(0x7f000068b000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0xfffffffffffffff9}, {&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0xc0}, {&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000754000/0x4000)=nil, 0x4000009e}], './file0\x00', 0xfffffffa, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4339, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x1, 0xfffffffe, 0x0, 0x0, 0x8, 0xfffffe33, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x6, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x69, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffd, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaac8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd083, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0xffffffff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0xfffffffc]}) r5 = openat$pf(0xffffffffffffff9c, 0x0, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mknod$loop(&(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x1) ioctl$TIOCSETA(r5, 0xc1084425, 0x0) r6 = semget$private(0x0, 0x4, 0x661) semop(r6, &(0x7f0000001000)=[{0x0, 0x6, 0x1800}, {0x3, 0x4, 0x1000}], 0x2) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x18, 0x0, 0xe, "00000000f600", 0x2000003}, 0x1c) writev(r0, &(0x7f00000003c0)=[{0x0}], 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts. load: 0.13 cmd: getty 65491 [ttyin] 0.00u 0.02s 0% 327k malloc(): allocation too large, type = 127, size = 1476395004 pppx: unable to set addresses for pppx1, error=17 panic: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 959 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 128746 23961 0 0x14000 0x200 0 reaper db_enter() at db_enter+0x25 panic(ffffffff834bb849) at panic+0x1e5 __assert(ffffffff834fa63f,ffffffff8350dfa1,3bf,ffffffff83537012) at __assert+0x29 refcnt_finalize(ffff80003c3b64f8,ffffffff834b4305) at refcnt_finalize+0x1e7 pppx_if_destroy(205b9a,ffff80003c3b64f0) at pppx_if_destroy+0x3d pppxclose(205b9a,1,2000,ffff80003939da18) at pppxclose+0xa0 spec_close(ffff800033b91850) at spec_close+0x417 VOP_CLOSE(fffff500623c96e0,1,fffff500097fd478,ffff80003939da18) at VOP_CLOSE+0x132 vn_closefile(fffff500623b54a8,ffff80003939da18) at vn_closefile+0x12b fdrop(fffff500623b54a8,ffff80003939da18) at fdrop+0x121 closef(fffff500623b54a8,ffff80003939da18) at closef+0x192 fdfree(ffff80003939da18) at fdfree+0x116 exit1(ffff80003939da18,0,0,1) at exit1+0x595 sys_exit(ffff80003939da18,ffff800033b91bc0,ffff800033b91b10) at sys_exit+0x1a end trace frame: 0xffff800033b91bb0, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 959 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff834bb849) at panic+0x1e5 __assert(ffffffff834fa63f,ffffffff8350dfa1,3bf,ffffffff83537012) at __assert+0x29 refcnt_finalize(ffff80003c3b64f8,ffffffff834b4305) at refcnt_finalize+0x1e7 pppx_if_destroy(205b9a,ffff80003c3b64f0) at pppx_if_destroy+0x3d pppxclose(205b9a,1,2000,ffff80003939da18) at pppxclose+0xa0 spec_close(ffff800033b91850) at spec_close+0x417 VOP_CLOSE(fffff500623c96e0,1,fffff500097fd478,ffff80003939da18) at VOP_CLOSE+0x132 vn_closefile(fffff500623b54a8,ffff80003939da18) at vn_closefile+0x12b fdrop(fffff500623b54a8,ffff80003939da18) at fdrop+0x121 closef(fffff500623b54a8,ffff80003939da18) at closef+0x192 fdfree(ffff80003939da18) at fdfree+0x116 exit1(ffff80003939da18,0,0,1) at exit1+0x595 sys_exit(ffff80003939da18,ffff800033b91bc0,ffff800033b91b10) at sys_exit+0x1a syscall(ffff800033b91bc0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x76aee7d4a790, count: -16 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff800033b91610 rbx 0xffff80002999ee07 rdx 0 rcx 0xffff80003939da18 rax 0xffff80002999dff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0xed40c3404c6cf66c r11 0xca6900474ab9587e r12 0xffff80002999ec08 r13 0 r14 0 r15 0x1 rip 0xffffffff810ddf05 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff800033b91600 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=58167 pid=64993 tcnt=0 stat=onproc flags process=1008 proc=2000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80003939da18 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80003939d4e8,0xffff80003939c2d0 process=0xffff80003c3d49c0 user=0xffff800033b8c000, vmspace=0xfffff5006cd435d0 estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 84699 4693 75120 0 2 0 syz-executor 76289 183528 17858 0 2 0 syz-executor 76289 250789 17858 0 3 0x4000000 smrbar syz-executor 59404 378176 44103 0 2 0 syz-executor 59404 464651 44103 0 3 0x4000080 fsleep syz-executor 43191 354252 88612 0 2 0 syz-executor 43191 406953 88612 0 3 0x4000080 fsleep syz-executor 95347 230250 75082 -1 2 0x10 syz-executor 95347 116766 75082 -1 3 0x4000090 fsleep syz-executor 94356 364302 69206 0 2 0 syz-executor 94356 322995 69206 0 2 0x4000000 syz-executor 29364 453633 69744 0 2 0 syz-executor 29364 130469 69744 0 3 0x4000080 msgwait syz-executor 29364 380001 69744 0 3 0x4000080 fsleep syz-executor 29364 66673 69744 0 3 0x4000080 fsleep syz-executor 88612 456540 35920 0 3 0x82 nanoslp syz-executor 17858 12640 35920 0 3 0x82 nanoslp syz-executor 69206 114107 35920 0 3 0x82 nanoslp syz-executor 75314 360535 35920 0 3 0x82 nanoslp syz-executor 69744 506689 35920 0 2 0x2 syz-executor 75120 238096 35920 0 3 0x82 nanoslp syz-executor 75082 324571 35920 0 3 0x82 nanoslp syz-executor 44103 416839 35920 0 3 0x82 nanoslp syz-executor 35920 6286 53195 0 3 0x82 kqread syz-executor 53195 451832 28801 0 3 0x10008a sigsusp ksh 28801 283764 53754 0 3 0x98 kqread sshd-session 53754 192658 60165 0 3 0x92 kqread sshd-session 65491 329661 1 0 3 0x100083 ttyin getty 60165 25179 1 0 3 0x88 kqread sshd 29154 350571 22463 74 3 0x1100092 bpf pflogd 22463 335752 1 0 3 0x80 sbwait pflogd 17240 408940 91009 73 3 0x1100090 kqread syslogd 91009 213346 1 0 3 0x100082 sbwait syslogd 24955 209639 1 0 3 0x100080 kqread resolvd 63097 288834 64540 77 3 0x100092 kqread dhcpleased 16727 52385 64540 77 3 0x100092 kqread dhcpleased 64540 455177 1 0 3 0x80 kqread dhcpleased 73150 358204 0 0 3 0x14200 bored smr 45843 77495 0 0 2 0x14200 zerothread 92963 296591 0 0 3 0x14200 aiodoned aiodoned 9741 300813 0 0 3 0x14200 syncer update 92176 441278 0 0 3 0x14200 cleaner cleaner 23961 128746 0 0 7 0x14200 reaper 81471 306325 0 0 3 0x14200 pgdaemon pagedaemon 67861 307290 0 0 3 0x14200 bored viomb 64903 257929 0 0 3 0x40014200 acpi0 acpi0 75350 230208 0 0 3 0x40014200 idle1 27065 479259 0 0 3 0x14200 bored softnet1 39367 277727 0 0 3 0x14200 bored softnet0 49365 226343 0 0 3 0x14200 smrbar systqmp 61666 325516 0 0 3 0x14200 bored systq 57353 58383 0 0 3 0x14200 tmoslp softclockmp 45803 444035 0 0 3 0x40014200 tmoslp softclock 59187 409741 0 0 3 0x40014200 idle0 1 111075 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks CPU 0: exclusive mutex vmmpekpl r = 0 (0xffffffff83a344d0) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 pool_put+0xa6 #3 uvm_unmap_detach+0x1af #4 uvm_unmap+0x17c #5 km_free+0x85 #6 uvm_uarea_free+0x4f #7 reaper+0x1ca #8 proc_trampoline+0x10 Process 49365 (systqmp) thread 0xffff800045ffea60 (226343) shared rwlock systqmp r = 0 (0xffffffff839b1768) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11062 12094K 12225K 166960K 12180 0 pcb 19 12K 12K 166960K 27 0 rtable 241 7K 7K 166960K 364 0 pf 39 18K 24K 166960K 70 0 ifaddr 48 8K 8K 166960K 53 0 ifgroup 64 2K 2K 166960K 68 0 sysctl 1 1K 9K 166960K 5 0 counters 78 37K 37K 166960K 82 0 ioctlops 0 0K 4K 166960K 1495 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1297 82K 82K 166960K 1389 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 5 0K 0K 166960K 5 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 18 65K 93K 166960K 168 0 proc 71 115K 196K 166960K 556 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 1 0 in_multi 100 7K 7K 166960K 101 0 ether_multi 2 0K 0K 166960K 2 0 mrt 1 0K 0K 166960K 4 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 37 175K 175K 166960K 37 0 exec 0 0K 1K 166960K 394 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 232 167K 178K 166960K 3331 0 UVM aobj 4 2K 2K 166960K 4 0 pinsyscall 43 86K 106K 166960K 1354 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 2 0 NDP 14 0K 2K 166960K 32 0 temp 36 9114K 9120K 166960K 4357 0 kqueue 13 20K 24K 166960K 30 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 37 0 34 1 0 1 1 0 8 0 rtentry 176 113 0 2 6 0 6 6 0 8 0 unpcb 144 58 0 40 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 13 0 9 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 89 0 80 2 0 2 2 0 8 1 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 4 0 2 1 0 1 1 0 8 0 pppxif 1576 2 0 0 1 0 1 1 0 8 0 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfanchor 1288 2 0 0 1 0 1 1 0 8 0 pfstitem 24 20 0 0 1 0 1 1 0 8 0 pfstkey 128 20 0 0 1 0 1 1 0 8 0 pfstate 448 20 0 0 3 0 3 3 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 458 0 0 29 0 29 29 0 8 0 art_table 40 459 0 0 5 0 5 5 0 8 0 art_node 32 113 0 11 1 0 1 1 0 8 0 semapl 72 3 0 0 1 0 1 1 0 8 0 shmpl 112 1 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1627 0 155 93 0 93 93 0 8 0 ffsino 296 1627 0 155 114 0 114 114 0 8 0 nchpl 144 1868 0 162 64 0 64 64 0 8 0 vnodes 216 1731 0 0 97 0 97 97 0 8 0 namei 1024 5728 0 5728 2 0 2 2 0 8 2 percpumem 16 57 0 2 1 0 1 1 0 8 0 kstatmem 264 35 0 4 3 0 3 3 0 8 0 scxspl 216 6310 0 6310 4 3 1 3 1 8 1 plimitpl 152 33 0 16 1 0 1 1 0 8 0 sigapl 424 494 0 446 7 0 7 7 0 8 1 knotepl 120 58 0 0 2 0 2 2 0 8 0 kqueuepl 224 30 0 21 1 0 1 1 0 8 0 pipepl 344 130 0 103 3 0 3 3 0 8 0 fdescpl 528 478 0 446 3 0 3 3 0 8 0 filepl 160 1731 0 1512 10 0 10 10 0 8 0 lockfpl 104 38 0 33 1 0 1 1 0 8 0 lockfspl 48 18 0 13 1 0 1 1 0 8 0 sessionpl 144 25 0 16 1 0 1 1 0 8 0 pgrppl 48 34 0 17 1 0 1 1 0 8 0 ucredpl 104 116 0 102 1 0 1 1 0 8 0 zombiepl 144 447 0 446 1 0 1 1 0 8 0 processpl 1232 494 0 446 5 0 5 5 0 8 0 procpl 664 554 0 498 6 0 6 6 0 8 1 sockpl 752 184 0 154 4 0 4 4 0 8 0 mcl64k 65536 3 0 0 1 0 1 1 0 8 0 mcl16k 16384 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 131 0 0 17 0 17 17 0 8 0 mcl2k 2048 27 0 0 4 0 4 4 0 8 0 mextrefs 64 27 0 0 1 0 1 1 0 8 0 mtagpl 96 1 0 0 1 0 1 1 0 8 0 mbufpl 256 205 0 0 13 0 13 13 0 8 0 bufpl 272 2336 0 105 149 0 149 149 0 8 0 anonpl 32 3562 0 0 30 1 29 30 0 247 0 amapchunkpl 152 8818 0 8346 21 0 21 21 0 158 2 amappl16 200 632 0 609 3 1 2 3 0 8 0 amappl15 192 2 0 2 1 1 0 1 0 8 0 amappl14 184 434 0 433 1 0 1 1 0 8 0 amappl13 176 123 0 111 1 0 1 1 0 8 0 amappl12 168 732 0 702 2 0 2 2 0 8 0 amappl11 160 3 0 2 1 0 1 1 0 8 0 amappl10 152 64 0 50 1 0 1 1 0 8 0 amappl9 144 279 0 279 1 1 0 1 0 8 0 amappl8 136 106 0 103 1 0 1 1 0 8 0 amappl7 128 166 0 153 1 0 1 1 0 8 0 amappl6 120 159 0 158 1 0 1 1 0 8 0 amappl5 112 126 0 116 1 0 1 1 0 8 0 amappl4 104 323 0 304 1 0 1 1 0 8 0 amappl3 96 1696 0 1586 4 0 4 4 0 8 0 amappl2 88 560 0 502 2 0 2 2 0 8 0 amappl1 80 10828 0 10214 15 0 15 15 0 8 1 amappl 88 2575 0 2415 4 0 4 4 0 92 0 uvmvnodes 80 101 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 0 1 0 1 1 0 8 0 uaddrrnd 24 478 0 446 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 478 0 446 1 0 1 1 0 8 0 vmmpekpl 168 5979 0 5945 2 0 2 2 0 8 0 vmmpepl 168 39119 0 37179 88 0 88 88 0 357 2 vmsppl 488 477 0 446 5 0 5 5 0 8 1 rwobjpl 80 13854 0 12834 24 0 24 24 0 8 0 pdppl 4096 963 0 892 99 20 79 85 0 8 8 pvpl 32 10807 0 0 88 0 88 88 0 265 0 pmappl 256 477 0 446 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 426 0 23 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff8398fff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 mtx_leave(ffffffff83909ce0) at mtx_leave+0x42 msleep_nsec(ffffffff83909d18,ffffffff83909ce0,4,ffffffff834cb519,ffffffffffffffff) at msleep_nsec+0x19b reaper(ffff800045ffdc90) at reaper+0x15b end trace frame: 0x0, count: 9 ddb{0}> trace x86_ipi_db(ffffffff8398fff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 mtx_leave(ffffffff83909ce0) at mtx_leave+0x42 msleep_nsec(ffffffff83909d18,ffffffff83909ce0,4,ffffffff834cb519,ffffffffffffffff) at msleep_nsec+0x19b reaper(ffff800045ffdc90) at reaper+0x15b end trace frame: 0x0, count: -6 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff834bb849) at panic+0x1e5 __assert(ffffffff834fa63f,ffffffff8350dfa1,3bf,ffffffff83537012) at __assert+0x29 refcnt_finalize(ffff80003c3b64f8,ffffffff834b4305) at refcnt_finalize+0x1e7 pppx_if_destroy(205b9a,ffff80003c3b64f0) at pppx_if_destroy+0x3d pppxclose(205b9a,1,2000,ffff80003939da18) at pppxclose+0xa0 spec_close(ffff800033b91850) at spec_close+0x417 VOP_CLOSE(fffff500623c96e0,1,fffff500097fd478,ffff80003939da18) at VOP_CLOSE+0x132 vn_closefile(fffff500623b54a8,ffff80003939da18) at vn_closefile+0x12b fdrop(fffff500623b54a8,ffff80003939da18) at fdrop+0x121 closef(fffff500623b54a8,ffff80003939da18) at closef+0x192 fdfree(ffff80003939da18) at fdfree+0x116 exit1(ffff80003939da18,0,0,1) at exit1+0x595 sys_exit(ffff80003939da18,ffff800033b91bc0,ffff800033b91b10) at sys_exit+0x1a end trace frame: 0xffff800033b91bb0, count: 0 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff834bb849) at panic+0x1e5 __assert(ffffffff834fa63f,ffffffff8350dfa1,3bf,ffffffff83537012) at __assert+0x29 refcnt_finalize(ffff80003c3b64f8,ffffffff834b4305) at refcnt_finalize+0x1e7 pppx_if_destroy(205b9a,ffff80003c3b64f0) at pppx_if_destroy+0x3d pppxclose(205b9a,1,2000,ffff80003939da18) at pppxclose+0xa0 spec_close(ffff800033b91850) at spec_close+0x417 VOP_CLOSE(fffff500623c96e0,1,fffff500097fd478,ffff80003939da18) at VOP_CLOSE+0x132 vn_closefile(fffff500623b54a8,ffff80003939da18) at vn_closefile+0x12b fdrop(fffff500623b54a8,ffff80003939da18) at fdrop+0x121 closef(fffff500623b54a8,ffff80003939da18) at closef+0x192 fdfree(ffff80003939da18) at fdfree+0x116 exit1(ffff80003939da18,0,0,1) at exit1+0x595 sys_exit(ffff80003939da18,ffff800033b91bc0,ffff800033b91b10) at sys_exit+0x1a syscall(ffff800033b91bc0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x76aee7d4a790, count: -16