program: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000001080)=@newpolicy={0xb8, 0x13, 0x1, 0x70bd2c, 0x0, {{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x100000002, 0x0, 0x0, 0x0, 0x0, 0x8000000000}}}, 0xb8}}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000200000000000000000000008500000036000000850000002a00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r4, r3, 0x25, 0x0, @val=@tracing}, 0x40) sendmsg$inet(r1, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000080)="b711a716f40cb8faea73b29539485974a60800811cf6edf05ca4adbc788c188072ab125a553370de16641f9bf1e42604a7429bdf3aeda64cdd2e3a4421977b9e0f77f38cef9da83683891815cec547180ed467d755b274f311ea63f9dc56f2a3ae964ebc1e379fd462f397f32f940364d089829e25b6ff2084c7c9dd507443b43d47db704eb32895e279b6eef51ca7330a4dc7abe97d6c6b05534f8da74995815403f4d97b9defcf241db9342772e38fdd3b7b643b7da6599bb453495d0006e4466ddf1cedc078c9fa5e1f159227492c53d3b7d92f2cc701276178ab8561e9a3ac6d43a276975ef96c0bfcfb672e3c4ee4576a884056fb815923845d7864ef", 0xff}], 0x1, &(0x7f00000001c0)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @remote, @remote}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xb4}}, @ip_ttl={{0x14, 0x0, 0x2, 0x9}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xe}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}], 0xc8}, 0x20000008) syz_mount_image$ext4(&(0x7f0000000580)='ext3\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f00000006c0)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x4}}, {@mblk_io_submit}, {@resuid}, {@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@lazytime}, {@usrquota}, {@data_err_abort}, {@data_err_abort}], [{@obj_role={'obj_role', 0x3d, 'data_err=abort'}}, {@pcr={'pcr', 0x3d, 0x3b}}]}, 0x1, 0x5f5, &(0x7f0000001100)="$eJzs3c9vFdUeAPDv3P6mvNdCXt57vMWjycsLJO/R0gKGGBewNaTBH3FjTKy0IFKgoTVaJFIS3JgYN8aYuHIh/hdKZMtKVy7cuDIkRAlLjdfM7Uzpbee29NJ2GubzSS49M+cO50xvv/ecOfecuQFU1lD6Ty1iX0TMJBEDycJSXmdkmUOLz3v44NqZ9JFEvf7SL0kk2b78+Un2sz87uDcivvs2ib0dq8udnb96YWJ6eupKtj0yd3FmZHb+6qHzFyfOTZ2bujT2zNjxY0ePHR893NZ5XS/Yd+rmW+8MfDj+6pef/5aMfvXjeBIn4vnsicvPY7MMxVDjd5Kszuo/vtmFlaQj+ztZ/hInnSVWiA3JX7+uiPhHDERHPHrxBuKDF0qtHLCl6klEHaioRPxDReX9gPza/uGDa02Xq7VSeiXAdrh/cnEAYFn8Z+NgnYtjg9HbGBvY9TCJ5cM66ZtEeyNzzXZHxN074zfP3hm/GVs0DgcUW7gREf8siv+kEf+D0RuDjfivNcV/2i84/X7P0vaLbZa/cqhY/MP2WYz/3jXjP1rE/+vZz3T/G22WP/Qo+WZfU/z3tXtKAAAAAAAAUFm3T0bE/4s+/68tzf+Jgvk//RFxYhPKH4p4bWDZ9urP/2v3NqEYoMD9kxHPRXH8Z7N/Bzuy1F8a8wG6krPnp6cOR8RfI+JgdPWk26NrlHHoo72ftcobyub/5Y+0/LvZXMCsHvc6e5qPmZyYm3jS8wYi7t+I+Ffh/N9kqf1PCtr/9P1g5jHL2PvfW6db5a0f/8BWqX8RcaCw/X+0DChZ+/4cI43+wEjeK1jt3+99/HUjUbCYqN34d4sJeHJp+79r7fgfTJbfr2e2Z8NlHJnvrLfKa7f/35283LjlTHe2792JubkroxHdyamOdG/T/rENVxmeSnk85PGSxv/B/6w9/lfU/++LiIUV/3fya/Oa4tzf/+j/qVV99P+hPGn8T26o/d94YuzW4Detyn+89v9oo60/mO0x/geLPs3DtLt5f0E4dhZlbXd9AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBpUIuI3ZHUhpfStdrwcER/RPwtdtWmL8/O/e/s5bcvTaZ5je//r+Xf9DuwuJ3k3/8/uGx7bMX2kYjYExGfdPQ1tofPXJ6eLPvkAQAAAAAAAAAAAAAAAAAAYIfob7H+P/Vzx3pHr/sEYKfrLLsCQGkK4v/7MuoBbD/tP1SX+IfqEv9QXeIfqkv8Q3WJf6gu8Q/VJf4BAAAAAOCpsmf/7R+SiFh4tq/xSHVneV2l1gzYarWyKwCUxh18oLpM/YHqco0PJOvk97Y8aL0j1zJz5gkOBgAAAAAAAAAAAIDKObDP+n+oKuv/obqs/4fqytf/7y+5HsD2c40PxDor+QvX/697FAAAAAAAAAAAAACwmWbnr16YmJ6euiLxys6oxnYm6vX69fSvoORq/F5ftFN+Le0m8qnwO6U+KxL5Wr/HO6q89yQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDZnwEAAP//F48p2g==") mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)={0x30, r6, 0x1, 0x70bd34, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x2004c000}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x30, r8, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x2004c010}, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x40046207, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x1802, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f00000003c0)=[@increfs], 0x0, 0x0, 0x0}) r11 = dup3(r10, r9, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000240)={0x10, 0x0, &(0x7f00000002c0)=[@request_death={0x400c6313}], 0x0, 0x0, 0x0}) setxattr$incfs_id(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/custom1\x00', 0x800, 0x0) removexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)=@known='user.incfs.id\x00') syz_emit_ethernet(0x66, &(0x7f0000000440)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000086dd6002adf7000000800000000000000000000103007f780000000060fd906300003a0000000000000000000000ffffac0b14aaff02000000000000000100000000000000000000000000004f3e39e113f44a5e6f6ab634dc3ffdb6c70815aae4c16648d14f07336fb0407fdd04a175a9412cfdbba8ee72ea9404b99c66cd538fc3d5e4fce640341edfbf2763b1c0079911f7678f28db7740d74bd1e94d3dc20ff98084a65270a98efa90000000000000e13b55eaccdfc76116ce2c"], 0x0) r12 = gettid() ptrace$setopts(0x4206, r12, 0x0, 0x30002e) syz_mount_image$bcachefs(&(0x7f00000058c0), &(0x7f0000000040)='./file0\x00', 0x281010, &(0x7f0000000300)=ANY=[@ANYRES64=r10, @ANYRESHEX=r1], 0x1, 0x598e, &(0x7f0000005900)="$eJzs3X2QHGX9IPCnZ2azk928bAJIBNksgSiCmA1vhS+l0fOtAKlYWEq4KFnIBqNJSCVBIKAEDxQKsNDSUtQ/0ELq0GhRBadESgxwCacoxelRV0id3qF/eIUcKYEcZ3Hur2ane3amZ3p7dnY2L/D5VLI9zzM933766Wd6+vvM7E4AAADgdWHvjVv3n3/MB3/zpdGXr/vILzZeH/qL4/XlZIWBeHnVwWohB1JvadH4Mj0u3nLNj/46dOn7f31v3w9f2bP2+HV//MARlz742XN23fHdh1+ae/+/ns2Lm4ynkyfK0fNRCOVf7vvml/c8fnSlLgohFKOBHSEsiBY+vCBKhRj+ZwhhbVzoKzXeed/Lp6+rLK+/pbehfn4qiPH++laOx9n2/VeeEv70vlU3/G7xT3/Ss/O5HROrROW68RTCvDX1j+8JIcyO/1cko21R8uAQQmVorqyM0brHnZ3TrhPabP+yjPKx8XJWvOzPiZPcvyRVLoz//Mrc0FBu1pNa9uU1fFb2Xd8+9cRJ7p28HZ2ul2dOqpw+GU1XVjuT+gXx8ufx8uQpxi8m/6NQiEKp1vwNUeOhSI5bFKLxY1mulQu1Yxvi/U+Vo1S5kCoXe1L7Nb7deKAVo6ixPlkvVZ+cjktx/fH15+oWLsiof2O8LMdP1FeSckjfqOpvulHbr3FJu/ZN0pYDoVB3DhpXbqyvHfj4YPTHdf3RwqZYYy0k9+1ZdevS4upH9g5ktCO6N4rjRxPxL1redvztv10w59M/vvmKRVnx1xTi+IWO2v/nc5944aKbf/CdzPi3J/GLHcU/7aG+58999MYlmf2zL+mfUkfxR5597LbFR16yM7P9dybxyx3FX7Hrid65+x/andn+4aR/ZncU/5l3fegv9zz1wHOZ8eOzQH/o6yj+6l2bv9o7uP+kzPi7k/7p72z8vLjzrKcHB/82lBX/yST+3I7i373jjnfeNf+WczKP78qk/wc6in/eiQ/eMGf/A8eVq5cnzfHv7NYrJ8Dr0xHxNdZNcTkjz4xSeWalvKab7ajLF749VKpuYE78f243N5RS2c68GYwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOvTUaf8lw//r08MPF+Ky73xjWcK1WVSPyuEaHYIYeu2kS3b1m+6bOizl1+xZdPIhqGRbUOjm7ZtuXrojLcNbRndvGHk6sq9w6eeXn3cwhBVl9FxTdseGxsbKww01iXb+3cn7vzT0rP/999DGD7qD4OlzPYvu2PjXUe2+Fmv0vYVY+/deMX5fzjz+/F+DcTtGshoV8ho1/+58NW7vr7vryeFMPyGydr12DPv+VVDg8YrJuLECr2h2qDeqK9lO2qtjtuT9Fdp3foNo8P5/VvM2I9/f81z/1x31dderfZvOXM/2unfEMLsFWMbCt9add7//9a11YquHffCtNrVdNzz+jvZi6R9Sf+V4/6eF+/XvIz9KmXs142/2/3UL4+5+aUdYbj04uLmbeftV088AHqiN7a13WQLfdGChvpyvH5yxJPHLdu2cfOyrVdvP3X9xpHLRi8b3fSO5WcsP2v4zLPOXDa+58ta7v9Ax/ufbP/Nbe7/gTmPzP/8jp8nP9sbT3ntyuuPSrvy+6O+RVnPv74LvvyNd9zx6PnVirxxnqxdO5/Ey77KcV4e6sZbc1+12q+8fgghDLXqhxdeOicc/d/X35B3Hqo/MvU/U6IVY48v+cf3z/7eondXKw7Ieb6+QR2e52utnmjPeH+V4+NxqPZvbyjG+9XfsGJv3K7ljz/ac+vev3+h1r5Zs8JVI9u2bVle/Tknbumc6NiW7UrXJvu1ePxnMcTdEmrDtMV4regJ1falz5/J6ule7Y/v648WNsUaayG5b8+qW5cWVz+yN6uno3urW5wd5laX0Zsy1tyQemCx1uBW2z/cxkfSrsEPf+/+T9z/szOaxsdp1Z95+xVl7NdPn7r7Gz/82ld+1r39+vB7nhj4x//4zNJqxeFyXqm1Om5PVH9eOS2EvOff4tB6PzKffxnXa3nPv/R2JtZvHW8oVe4PxY6er6c91Pf8uY/euCTz+bqv3efrtQ2lYs7z9VAZPwfv+dUwUKIVY7++6YgdD1+38phqRd64rq3dalyf3kb+kbFfv7ro6cHLh/7Df+veeeNHb7vv4j+OrPhiteJQOe7luH/LGf1ba3WSd9b379svvXzD2mr9oXv9Gy9z8p/kVLL16u2fG9mwYXTL1vb2q93X02Q76V7u9PU0ObstzNmvQtN+zdyNdvqr3edb0v61HfdX4/OtP0QdvS5s/+2COZ/+8c1XDDQ9Kt7QmkIcv9BR/D+f+8QLF938g+9kxr89iV/qKP5ICLctPvKSnZnx74zi+OWO4q/Y9UTv3P0P7c6MP5y0f3ZH8Z9514f+8uriB57LjF8Z4bMr8fs76/8Xd5719ODg3zLjPxnF26lcI4Vw38unr6uWo9ATP9+SdvQ0tCuky1GqXEiVi/XlQnW+sraBYhQ11ifrxfXH17WllU9m1CdXYeVF1eUrSTmkb0xef6gp1J37W9XnXacCALzWJe//J9egyfv/o/GFUvZMA0yYSh42v785D1uUETfJwybmc2Y13L8ojp88PpkHHHx7GK4srx+qXuhPdZ4zeT6k5zmT7Zx0QmOMTuc58+bfl6TKSbuq8+Wlujw01pzXlEIb8+/N25l8/j21+/nz40M3NTVrqG7eKn38euIZs1afd0i1t1SJkDU+0vNiyec5BufF8/OhvfGR/hxNchzSn6NJtnNM6sTZ6edopjs+kmZPMj7Gm5z//kbz8QuT9O/E8WsdLX38pnC8y5X1Z/r92bbnDXc03nfozBvO7PthHc9LPvvYYT8vec9TOfOSh8G8YVKf7EepzfnET2TUd2s+MTldJO3aN0lbDgTzicBrVZL/J68Rlfy/cgH+f1Pr5V2Hpq8ak3iZnxMqtm5PXt7R/Dm9vo5ex1fv2vzV3sH9J2W81kVhd7uf+9ncUOrL+dxPXj8uTZVz+zFjgiYv30tvJ6/f05/L6A9zO+r3u3fc8c675t9yTub15crqC2l+v3+joTQ3p98PmXwhFf+g5Av/mljhdZAvzGq1meTOQyVfmO7nGBZlXKce9M8xxB98mql85OPpirgTppqP9DXdqO3XuMMuH+k5sO0CAA4fSf5fe/8szv//Z2q9vLz15FQ5iZeZt2Zcn2TlrR+Nl1el1u+Pf6NiqtfN55344A1z9j9wXGbecme7eeh/bCgN5Oah08ubM/OIldP8vHicZ2W+D1/Ls6aXJ2a2v5YnTi9Pz4xfy9Onl0dn9k8tj57ePEBT/DVx/No8wOH9vtgMzdeFaHdyfKefR7eMf7Dz6PjXZ2cqj74go36qeXR/043afo2TRwMAHFxJ/p9cxiX5/6Op9aZ73Z6ZF3Tpuj3990Bq8Z9sI6/8fy3ixxeH7eeVXc77kvhdev83P2+d6bx+puclDve8eKbnhWZuniySF8uLAQA4LCT5/+y4HOf/TZ8qn25+kpm/1fKTmX7fV37eMr78/IC8b32Q579qKfFMfU7mwOT/E7+cIv+fGfJ/AIDXtiT/T37tMfn7f/85Lqf/br08PSP+IZynl18jeXpP0zfO1cV/beTpB2CebWZ/X8bnAOJySN+oMg8AAMDB0DOeKTX/nv2n4mX69+yzfi//ooz121Ua/x37EC7ZtmV09OIrNq8d2TZ68abL145uvfjKLeu3bRvdVF1vuu/vZuYtcd7YE0pxf7ReL523zY8/IjE/4+8hpNdPwh47fqP57yGkNzs75+8ITBy/9tqbdfwKk6zfanxkHe+s+J/MWD9RO/6Xfua0i9dtvXj9pvXb1o9sWL99tHG9StbaN4XvzUy6ZUrfm5n60aQw9e/v7E47Ck3t6In7I+v72aNUOxbELVmQ9f0HGe3+zX/9+udPHHv1nhCGjyq+aVr9F60Y+08Xjn50294/bK60vzBp+2trxu3K+77S9PrJ/pQ2XL512ynrLr9iU/obJTuTzGcUauUZms+In/7FNucnVmfUT3V+oth049DU9vwEAAANkvf/k+vZ5P3Dr8UXUEl9+3n69N4/zszTh9vL09PfS5aXp6fXT/a33Ty9PM08Pb39vDy91fqt8vSsvDsr/scz1p+q9sfJ9D7nkTlO1rQ3TtLfZ5A3TtLrT22cjPVG0xwn6e3njZNW67caJ1nHPSv+xzLWz9L+eJje53Iyx8Pt7Y2Ht6bKeeMhvf5UzxuFaY6H9PbzxkOr9VuNh6zjmxX//Iz1W+XmrTSOj8rAGB8XoxdfefmWz9WtN9Pflzd5+yrr5LVvZr//o1Pt92/z63a5jfa3+7mvmW//zP7+18y3f3qfK8ts/5PTmwlrv/0z+/0unUrN1xZmbL42/rBZ3ufP8uZxV2XUT3Ued1bTjUOTeVw4eJL8P3m7J8n/b4mX3X4b6LD6nrT6+Ld35+/rv9a/93imr2MO2PuvXs874vUcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoD29pUXjy703bt1//jEf/M2XRl++7iO/2Hj9W6750V+HLn3/r+/t++Ere9Yev+6PHzji0gc/e86uO7778Etz7//Xs7mBB6qLk+NiOYTo+SiE8i/3ffPLex4/ulIXhRCK0cCOEBZECx9eEKUiDP8zhLC21s7GO+97+fR1leX1t/Q21M9PBUnvV+gvJu1paGe4KnePOAyV43G2ff+Vp4Q/vW/VDb9b/NOf9Ox8bsfESInKdeMphHlr6h/fE0KYHf+vSEbbouTB8XJlCKGv7nFn57TrhDbbvyyjfGy8nBUv+3PiJPcvSZULqfXS5URPatmXs73pympHp+vlmZMqp09G05XVzqR+Qbz8ebw8eYrxi8n/KBSiUKo1f0M0MUZC3XGLQjR+LMu1cqF2bEO8/6lylCoXUuViT2q/xrcbD7RiFDXWJ+ul6pPTcSmuP77+XN3CBRn1b4yX5fiJ+kpSDukbVf1NN2r7NS5p175J2nIgFOrOQa3qawc+Phj9cV1/tLDpMWMtJPftWXXr0uLqR/YOZLQjujeK40cdxd/+2wVzPv3jm69YlBV/TSGOX+go/p/PfeKFi27+wXcy49+exC92FP+0h/qeP/fRG5dk9s++pH9KHcUfefax2xYfecnOzPbfmcQvdxR/xa4neufuf2h3ZvuHk/6Z3VH8Z971ob/c89QDz7WI/+6e+HxTjd/XUfzVuzZ/tXdw/0mZ7d+d9E9/Z+PnxZ1nPT04+LehrPhPJvHndhT/7h13vPOu+beck3l8Vyb9M9BR/PNOfPCGOfsfOC7r3Bnd2a1XToDXpyPia6yb4nJznlkzaZ45XXX5wreHStVrvjnx/7nd3FBKZTvzZjA+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACvTb+/9oxPXfjej60qRSFEGeuMtZDcV5y1YsVQB9sdefax2xYfecnO+rpFHcQBAAAA8iV5eKFWUw6LwpXR7HBsy/WTOYJjk1LUWJ+eQ5g9sWYbcc7IjVPoUnuKXYpT6lKcni7FmdWlOL1dilPOiVMO7cWZPWmcQtvt6etSnP4uxZnTpThzuxRnXpfizJ9anEJWnIFJ47Q/Dhd0Kc7CLsU5oilOoaM4R3apPUflxQk7Wt6fjvOGLrXn6C7FSc8pT3U8z43XPCYrzviNYm6cUlSs3dFqPj3ZznHT3E5/m9tJz9k3bKcY8vu3ze2ckHpcYYr7U25zO2+e5naiNrfz1mlup5CznWTcXpVuX7KdpNTm+L+6S3G2dynONV2Kc22X4nyhS3G+2KU4100zDkC7kvx/It8bCL2ld4e++IyTngVI8t3F4z+bX++yTkhJvDel6mflxUsn6ql4i6favvQEQireklR9T0O8Ui0fmSReuT7e0tSdufubnlBIte/kVH1vXrz0xAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzKDfX3vGpy5878dWhShU/rU01kJyX3HWihVDHWx3z6pblxZXP7K3vq631EEgAAAAIFeSh/fUasqht7Q89EazGtYrx/MA5bhcHKguB+eFlZVlNFQYL/dFCyZ9XCl+3LJtGysP2H7q+o0jl41eNrrpHcvPWH7W8Jlnnbls3foNo8PVnyH05sQLIYxPP2y9evvnRjZsGN2ytVqZbv+i+HGL4nIUP27w7WG4srw+bv/CnO0VmrY3czfyjx4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBv7NpfqJtnHQfw501ykixbXWT/srKehv4ZVYe29Uw6HcsLgoOtLT0MJJkeR3EtDk/XsrWjzrgV3GaLImwUSqU3lTrcHN7sjxvi/lCozGrRU4tsQ3ehF8qmk270QjoiPSdvTpImzWmY7VY/n4v3TZ7n9zy/PKEUvm8OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwbk3VxyaqlfFaIQoh6lPT6CGZS2fjuDxE36++sOWHudETy9rHcpkhNgIAAAB6SbW/SXL4SGskH3KZdEiHq6ffLQptE2E29wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9/pupjE9XKeO3iKISoT02jh2QunY3jcvKmMPe+b7771OdeGx39e/tYaagTAAAAAIMkOTzVGsmHUlgcRqKrO+qSZwPzu9Z31yX7LJhjXXmOdYvnWHftHOs+MaBubfO+PQAAAMBHX5L/M62RYshl5vXN/4NyfVK3sKsu3bx3530AAADgfy/J/7nWSCnkMqVWXp9r3l/UVZesH/S7fbJ+aZ/1g37PX9O8+50eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD46pupjE9XKeC0dhRD1qWn0kMyls3FcHqLvyhcL/7z14MOL2sdymSE2AgAAAAZKcvhs9M6HXKYQRsLF07l/9OZ9z3z5mefGQggzMT+bDdvXb916z8qZa1K34vDBkR8cevs7p9WtmLmetwMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmKn62ES1Ml67KAoh6lPT6CGZS2fjuDxE3ze+8KW/PnHs+bfax0pD7AMAAAAMluTw2eyfD6WQDdlw5fS79qx/Sqprfb9nBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCF495v3f/N9ZOTG+7xwothX2T9Q7rwXpzv/5kAAIAP2sIQhcZZumrd+f7UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAh8FUfWyiWhmv5aMQoj41jR6SuXQ2jstD9I1fOJKbd+LFl9vHSkPsAwAAAAyW5PDZ7J8PpTASRsIV0+96PROYzv/Fc/ghAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA+VqfrYRLUyXpsXhRD1qWn0kMyls3FcHqLv4zv2fv7Apd+/pX0slxliIwAAAGCgJIdnWyP5kMt8MuTCNc33k50LonTz3vu5wOy6LR3LCnNeV+9Yl57zup2nLr8faa3MNE8zsy6f7FecubfWlXd2fSOZUG5bVwqt9uWOdWF3x6p5Az5n9/cOAAAA51KS/3OtkWLIZXJtOfenHfVFORcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6GOqPjZRrYzXoiiEqE9No4dkLp2N4/IQfe//7ccv+drPdm1rHysNsQ8AAAAwWJLDZ7N/PpTCgvCxsGA694diZ31S96/qyQOP/ftvy0JYfuXR0Uzf/X/9xk0vdV9CSHUWpUK4tNkv6tPvN3947L4ljZNPhLD8ivQ1Z9uvc8u48Wx1w5qth45uOcMXAwAAABeQJP+PtEaKIZe5u2/+T5L3WeX/S+/b8YvLm9dmIu9akSo2+6X69Pvikqf+snTVP94+lf/P1O8zezcduLyj4cxIlyhuVDZtW3v0+v2p5NQz/dNd/ZPv5Svffus/G7c/enKmfz7km+PzM736n37tclHcmEztqa1+f0+9s3+mz/kf/t3Lx341f9d7p/q/u7DQ6n/tGc5/5v6F2x7ZfcPeg2s7+4cQyr36v/PeLeGqP931UPf5C10bt3/z7dcuUdw4vOj4/lX7Sjd29o+6+iff/8+PPb77J49+77mkf/K3IssWz7V/qqv/qzsv2/HKg+vmd/ZP9Tn/S7e/Nrq5/N0/dp//zqHP/+R1T9/x+vr4ge4pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAC8tUfWyiWhmvpaIQoj41jR6SuXQ2jstD9H3z1iPv3L7rxz9qHysNsQ8AAAAwWJLDZ7N/PpRCNmRDYTr3P1vdsGbroaNbQnFmNmreM5Ob7936qY2bt91953n65AAAAMBcJfk/0xophlxmSRhp5v/Kpm1rj16/P5Xk/1SS/zfeNblheWjVvbrzsh2vPLhufus5QQjTfxaQP1X32dm6m286Ujz+528s7Vm3crbu8KLj+1ftK92Y1IX2uhWh9XziyeuevuP19fEDrc/XXvfpr2+ebD6eSPYt3PbI7hv2HlzbOkfzXmjum9RNpvbUVr+/p57UpZv3fPPcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDppupjE9XKeC2kQ4j61DR6SObS2TguD9F39ZJfPnTJiecXtI/lMkNsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/ZQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgr79RMaRxXHAfy93cRsd5M2aQWjYppWRakHi4KIXlRUpBUpeKoUqbb2IAqCiFIPJtKKpSpeBKuXIiqoUQoKNhZLq6Tiv+LFgwoK1YNQigHtUjyobPJmu5lmXJ1UQfv5wPD2vZn5zm/mvUx2AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+Uvp7hmfbQ9gebt5130yeP33P8sVveu3/8kkdf/2F00w0f76m/cmJq84otX9+4bNO+e9dM7nrx4C8D7/x2pGvwI7PNqtSthRCPxRBq708/98TUp+e0xmIIoRoHx0IYiksPDsVcwupfQwib23XO3fn28Su3tNrxnX1zxpfkQvL3FRrVrJ5Zg3Pr5f+lltbZ1ubDl4Vvr1+/7fPlb73ZO3F07OQhsdaxnkJYvLHz/N4QwqK0tWSrbTg7ObXrQgj1jvOu7lLXhX+x/ssL+uen9qzUNrrkZPtX5vqV3HH5fqY319a7XG+hiuooe1w3/bl+/mW0UEV1ZuNDqX03tav+Zn4122KoxNDTLv++eHKNhI55iyHOzGWt3a+05zak+8/1Y65fyfWrvbn7mrluWmjVGOeOZ8flxrPXcU8aX9H5rp7H7QXj56a2lv5QT2T9kP8wq3HKh/Z9zcjqmv6TWv4NlY530Hzj7YlPk9FIY4249JRzfp9Htm9q/VMXVzd8cGiwoI64J6b8WCp/62dD/Xe+seOh4aL8jZWUXymV/93awz/dseOlFwrzn83yq6Xyr9hfP7b2w+0rC5/PdPZ8ekrl33Xko6eXn333RGH9u7P8Wqn86yYP9w009x8orH919nwWlcr/5tqbv3/ty71HC/NDll8vlb9h8oFn+kaalxbmH4ghjLfyG+XWz88TV301MvLjaFH+F9nzHyiV/+rYrmteXrJzTeH8rsuez2Cp/Fsv2retv7n3gqJ3Z9x9uv5zApyZlqXvWE+mftnfmQvV8Xvh+dGe2e98/WkbOJ0XymldZ/E/mA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH+wAwckAAAAAIL+v25HoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBTAQAA///1KCWn") [ 78.215256][ T5336] syz.0.0 (5336) used greatest stack depth: 18680 bytes left [ 77.163888][ T4683] Bluetooth: hci0: command tx timeout [ 77.167927][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 77.170504][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 77.291338][ T5336] loop0: detected capacity change from 0 to 1024 [ 77.330330][ T5336] EXT4-fs: Ignoring removed mblk_io_submit option [ 77.337022][ T5336] ext3: Unknown parameter 'obj_role' [ 77.704976][ T5336] loop0: detected capacity change from 0 to 32768 [ 77.723428][ T5334] ================================================================== [ 77.726335][ T5334] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x2f/0x140 [ 77.729593][ T5334] Read of size 8 at addr ffff888052242108 by task kworker/0:5/5334 [ 77.732709][ T5334] [ 77.733777][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: kworker/0:5 Not tainted 6.12.0-syzkaller-10689-g7af08b57bcb9 #0 [ 77.738350][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 77.742141][ T5334] Workqueue: events binder_deferred_func [ 77.744238][ T5334] Call Trace: [ 77.745424][ T5334] [ 77.746498][ T5334] dump_stack_lvl+0x241/0x360 [ 77.748332][ T5334] ? __pfx_dump_stack_lvl+0x10/0x10 [ 77.750124][ T5334] ? __pfx__printk+0x10/0x10 [ 77.751758][ T5334] ? _printk+0xd5/0x120 [ 77.753260][ T5334] ? __virt_addr_valid+0x183/0x530 [ 77.755132][ T5334] ? __virt_addr_valid+0x183/0x530 [ 77.757049][ T5334] print_report+0x169/0x550 [ 77.758852][ T5334] ? __virt_addr_valid+0x183/0x530 [ 77.763047][ T5334] ? __virt_addr_valid+0x183/0x530 [ 77.764964][ T5334] ? __virt_addr_valid+0x45f/0x530 [ 77.766923][ T5334] ? __phys_addr+0xba/0x170 [ 77.768639][ T5334] ? __list_del_entry_valid_or_report+0x2f/0x140 [ 77.771067][ T5334] kasan_report+0x143/0x180 [ 77.772713][ T5334] ? __list_del_entry_valid_or_report+0x2f/0x140 [ 77.774988][ T5334] __list_del_entry_valid_or_report+0x2f/0x140 [ 77.777225][ T5334] binder_release_work+0xc7/0x480 [ 77.779068][ T5334] binder_deferred_func+0x1275/0x1460 [ 77.780996][ T5334] ? process_scheduled_works+0x976/0x1840 [ 77.783125][ T5334] process_scheduled_works+0xa66/0x1840 [ 77.785132][ T5334] ? __pfx_process_scheduled_works+0x10/0x10 [ 77.787454][ T5334] ? assign_work+0x364/0x3d0 [ 77.789308][ T5334] worker_thread+0x870/0xd30 [ 77.791180][ T5334] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 77.793460][ T5334] ? __kthread_parkme+0x169/0x1d0 [ 77.795330][ T5334] ? __pfx_worker_thread+0x10/0x10 [ 77.797312][ T5334] kthread+0x2f0/0x390 [ 77.798867][ T5334] ? __pfx_worker_thread+0x10/0x10 [ 77.800794][ T5334] ? __pfx_kthread+0x10/0x10 [ 77.802585][ T5334] ret_from_fork+0x4b/0x80 [ 77.804293][ T5334] ? __pfx_kthread+0x10/0x10 [ 77.806124][ T5334] ret_from_fork_asm+0x1a/0x30 [ 77.807964][ T5334] [ 77.809158][ T5334] [ 77.810088][ T5334] Allocated by task 5336: [ 77.811752][ T5334] kasan_save_track+0x3f/0x80 [ 77.813561][ T5334] __kasan_kmalloc+0x98/0xb0 [ 77.815358][ T5334] __kmalloc_cache_noprof+0x243/0x390 [ 77.817447][ T5334] binder_ioctl_write_read+0xe7f/0xb570 [ 77.819653][ T5334] binder_ioctl+0x436/0x1cb0 [ 77.821624][ T5334] __se_sys_ioctl+0xf5/0x170 [ 77.823439][ T5334] do_syscall_64+0xf3/0x230 [ 77.825180][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.827450][ T5334] [ 77.828390][ T5334] Freed by task 5334: [ 77.829991][ T5334] kasan_save_track+0x3f/0x80 [ 77.831818][ T5334] kasan_save_free_info+0x40/0x50 [ 77.833794][ T5334] __kasan_slab_free+0x59/0x70 [ 77.835390][ T5334] kfree+0x196/0x430 [ 77.836644][ T5334] binder_deferred_func+0x11df/0x1460 [ 77.838459][ T5334] process_scheduled_works+0xa66/0x1840 [ 77.840232][ T5334] worker_thread+0x870/0xd30 [ 77.841724][ T5334] kthread+0x2f0/0x390 [ 77.843455][ T5334] ret_from_fork+0x4b/0x80 [ 77.845311][ T5334] ret_from_fork_asm+0x1a/0x30 [ 77.847128][ T5334] [ 77.847778][ T5334] The buggy address belongs to the object at ffff888052242100 [ 77.847778][ T5334] which belongs to the cache kmalloc-64 of size 64 [ 77.852245][ T5334] The buggy address is located 8 bytes inside of [ 77.852245][ T5334] freed 64-byte region [ffff888052242100, ffff888052242140) [ 77.857411][ T5334] [ 77.858404][ T5334] The buggy address belongs to the physical page: [ 77.860791][ T5334] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888052242600 pfn:0x52242 [ 77.864389][ T5334] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 77.867865][ T5334] page_type: f5(slab) [ 77.869755][ T5334] raw: 04fff00000000200 ffff88801ac418c0 ffffea0000e1f890 ffffea000148bf90 [ 77.873133][ T5334] raw: ffff888052242600 000000000020001b 00000001f5000000 0000000000000000 [ 77.876902][ T5334] page dumped because: kasan: bad access detected [ 77.880161][ T5334] page_owner tracks the page as allocated [ 77.882892][ T5334] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5319, tgid 5319 (syz-executor), ts 67496399175, free_ts 0 [ 77.890239][ T5334] post_alloc_hook+0x1f3/0x230 [ 77.892059][ T5334] get_page_from_freelist+0x365c/0x37a0 [ 77.894378][ T5334] __alloc_pages_noprof+0x292/0x710 [ 77.896366][ T5334] alloc_pages_mpol_noprof+0x3e8/0x680 [ 77.898470][ T5334] alloc_slab_page+0x6a/0x140 [ 77.900367][ T5334] allocate_slab+0x5a/0x2f0 [ 77.902057][ T5334] ___slab_alloc+0xcd1/0x14b0 [ 77.903821][ T5334] __slab_alloc+0x58/0xa0 [ 77.905313][ T5334] __kmalloc_noprof+0x2e6/0x4c0 [ 77.907044][ T5334] tomoyo_encode+0x26f/0x540 [ 77.908740][ T5334] tomoyo_realpath_from_path+0x59e/0x5e0 [ 77.910738][ T5334] tomoyo_check_open_permission+0x258/0x4f0 [ 77.912882][ T5334] security_file_open+0xac/0x250 [ 77.914784][ T5334] do_dentry_open+0x328/0x1b70 [ 77.916592][ T5334] vfs_open+0x3e/0x330 [ 77.918224][ T5334] path_openat+0x2c84/0x3590 [ 77.919935][ T5334] page_owner free stack trace missing [ 77.921980][ T5334] [ 77.922927][ T5334] Memory state around the buggy address: [ 77.924987][ T5334] ffff888052242000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 77.927970][ T5334] ffff888052242080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 77.931031][ T5334] >ffff888052242100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 77.933842][ T5334] ^ [ 77.935308][ T5334] ffff888052242180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 77.937998][ T5334] ffff888052242200: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 77.940758][ T5334] ================================================================== [ 77.943785][ T5334] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.946144][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: kworker/0:5 Not tainted 6.12.0-syzkaller-10689-g7af08b57bcb9 #0 [ 77.949786][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 77.953833][ T5334] Workqueue: events binder_deferred_func [ 77.955875][ T5334] Call Trace: [ 77.957085][ T5334] [ 77.958187][ T5334] dump_stack_lvl+0x241/0x360 [ 77.960269][ T5334] ? __pfx_dump_stack_lvl+0x10/0x10 [ 77.962603][ T5334] ? __pfx__printk+0x10/0x10 [ 77.964299][ T5334] ? lock_release+0xbf/0xa30 [ 77.965947][ T5334] ? vscnprintf+0x5d/0x90 [ 77.967830][ T5334] panic+0x349/0x880 [ 77.969276][ T5334] ? check_panic_on_warn+0x21/0xb0 [ 77.971498][ T5334] ? __pfx_panic+0x10/0x10 [ 77.973234][ T5334] ? mark_lock+0x9a/0x360 [ 77.974830][ T5334] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 77.977064][ T5334] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 77.979226][ T5334] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 77.981455][ T5334] ? print_report+0x502/0x550 [ 77.983116][ T5334] check_panic_on_warn+0x86/0xb0 [ 77.984821][ T5334] ? __list_del_entry_valid_or_report+0x2f/0x140 [ 77.986878][ T5334] end_report+0x77/0x160 [ 77.988265][ T5334] kasan_report+0x154/0x180 [ 77.989849][ T5334] ? __list_del_entry_valid_or_report+0x2f/0x140 [ 77.991855][ T5334] __list_del_entry_valid_or_report+0x2f/0x140 [ 77.993485][ T5334] binder_release_work+0xc7/0x480 [ 77.995032][ T5334] binder_deferred_func+0x1275/0x1460 [ 77.996772][ T5334] ? process_scheduled_works+0x976/0x1840 [ 77.999013][ T5334] process_scheduled_works+0xa66/0x1840 [ 78.000857][ T5334] ? __pfx_process_scheduled_works+0x10/0x10 [ 78.003107][ T5334] ? assign_work+0x364/0x3d0 [ 78.004800][ T5334] worker_thread+0x870/0xd30 [ 78.006518][ T5334] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 78.008739][ T5334] ? __kthread_parkme+0x169/0x1d0 [ 78.010652][ T5334] ? __pfx_worker_thread+0x10/0x10 [ 78.012622][ T5334] kthread+0x2f0/0x390 [ 78.014171][ T5334] ? __pfx_worker_thread+0x10/0x10 [ 78.016110][ T5334] ? __pfx_kthread+0x10/0x10 [ 78.017873][ T5334] ret_from_fork+0x4b/0x80 [ 78.019647][ T5334] ? __pfx_kthread+0x10/0x10 [ 78.021463][ T5334] ret_from_fork_asm+0x1a/0x30 [ 78.023385][ T5334] [ 78.024733][ T5334] Kernel Offset: disabled [ 78.026230][ T5334] Rebooting in 86400 seconds..