last executing test programs: 1m52.700160275s ago: executing program 1 (id=1337): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(r1, 0x0, 0x3, &(0x7f0000000100)="09001000", 0x4) sendmsg$unix(r0, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001880)=ANY=[@ANYBLOB="10000000ffff000006"], 0x10}, 0x0) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x40002) 1m52.590762796s ago: executing program 1 (id=1343): socket$inet_sctp(0x2, 0x5, 0x84) kqueue() r0 = kqueue() kevent(r0, &(0x7f00000000c0)=[{0x4, 0xffffffffffffffff, 0x1}, {0x4, 0xffffffffffffffff, 0xc700, 0x0, 0x0, 0x0, [0x1, 0x0, 0x7fff]}], 0x2, &(0x7f00000002c0)=[{}], 0x1, 0x0) 1m52.547959933s ago: executing program 1 (id=1346): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x14040000) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x30, 0x0, 0x0, 0x6, 0x6, 0x0, @rand_addr=0x1ff, @local={0xac, 0x14, 0x0}}, @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x7, 0x0, 0x0, {[@window={0x3, 0x3}, @mss={0x2, 0x4, 0x5ab}]}}}}}}}) 1m52.547098131s ago: executing program 1 (id=1349): ktimer_create(0x0, 0x0, &(0x7f0000000240)) ktimer_create(0x0, 0x0, &(0x7f0000001b80)) ktimer_create(0x0, 0x0, &(0x7f0000000300)) ktimer_create(0x0, &(0x7f0000000140)={0x0, 0x0, @sigval_ptr}, &(0x7f00000000c0)) 1m52.533057023s ago: executing program 1 (id=1351): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) chflags(&(0x7f0000000080)='./file0\x00', 0x119304) mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000280)='./file0/file0\x00') 1m52.493200867s ago: executing program 1 (id=1354): open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) flock(r0, 0x2) flock(r0, 0x5) 1m52.487414643s ago: executing program 32 (id=1354): open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) flock(r0, 0x2) flock(r0, 0x5) 1m51.723814337s ago: executing program 3 (id=1382): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x14040000) syz_emit_ethernet(0x3a, &(0x7f0000000480)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x2c, 0x0, 0x0, 0x5, 0x6, 0x0, @rand_addr=0xf, @local={0xac, 0x14, 0x0}}, @tcp={{0x3, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x42, 0xa7, 0x0, 0x0, {[@mss={0x2, 0x4, 0x578}]}}}}}}}) 1m51.72262436s ago: executing program 3 (id=1391): r0 = socket(0x1c, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty}, 0x1c) r1 = kqueue() kevent(r1, &(0x7f0000000200)=[{0x3, 0xfffffffffffffffe, 0x183, 0xc0000045, 0xfffffffffffffff8, 0x0, [0x0, 0x0, 0x0, 0x4]}], 0x1, &(0x7f0000000080)=[{}], 0x1, 0x0) 1m51.323698481s ago: executing program 3 (id=1385): r0 = socket(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f00000000c0)={0xfffffffffffffe21, 0x2, 0x2, @loopback}, 0x10) sendto$unix(r0, 0x0, 0x0, 0x180, 0x0, 0x0) recvmsg(r0, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0xc0) 1m51.304536204s ago: executing program 3 (id=1386): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreqsrc(r0, 0x0, 0xc, &(0x7f0000000040)={@multicast1, @loopback}, 0x67) setsockopt$inet_mreqsrc(r0, 0x0, 0x48, &(0x7f0000000140)={@multicast1, @multicast2, @broadcast}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x48, &(0x7f0000000180)={@multicast1, @multicast1, @loopback}, 0xc) 1m51.286054309s ago: executing program 3 (id=1387): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) chflags(&(0x7f0000000080)='./file0\x00', 0x119304) mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000280)='./file0/file0\x00') 1m51.255400917s ago: executing program 3 (id=1388): open(&(0x7f0000000080)='./file0\x00', 0x80000000000209, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xaa480) r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x10000, 0x0) preadv(r0, &(0x7f0000001780)=[{&(0x7f0000000180)=""/184, 0x1b133353141e377d}], 0x10000000000000d1, 0x0) 1m51.254381034s ago: executing program 33 (id=1388): open(&(0x7f0000000080)='./file0\x00', 0x80000000000209, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xaa480) r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x10000, 0x0) preadv(r0, &(0x7f0000001780)=[{&(0x7f0000000180)=""/184, 0x1b133353141e377d}], 0x10000000000000d1, 0x0) 1m50.985855604s ago: executing program 5 (id=1399): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) chflags(&(0x7f0000000080)='./file0\x00', 0x119304) mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000280)='./file0/file0\x00') 1m50.957694643s ago: executing program 5 (id=1389): open(&(0x7f0000000200)='./file0\x00', 0x200, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xaa480) truncate(&(0x7f0000000080)='./file0\x00', 0x8000) truncate(&(0x7f0000000040)='./file0\x00', 0x4677) 1m50.890506917s ago: executing program 34 (id=1389): open(&(0x7f0000000200)='./file0\x00', 0x200, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xaa480) truncate(&(0x7f0000000080)='./file0\x00', 0x8000) truncate(&(0x7f0000000040)='./file0\x00', 0x4677) 2.58659606s ago: executing program 6 (id=3199): mkdir(0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) open(0x0, 0x200000, 0x26) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) 2.585365374s ago: executing program 0 (id=3207): r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) listen(r0, 0xb7c5) freebsd10_pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) accept4(r0, 0x0, 0x0, 0x0) kevent(r2, 0x0, 0x0, 0x0, 0x0, 0x0) 2.276710513s ago: executing program 6 (id=3208): r0 = socket$inet6_udp(0x1c, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1b, &(0x7f00000001c0), 0x4) setsockopt$sock_int(r0, 0xffff, 0x400, &(0x7f0000000300)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x48, &(0x7f0000000000)=0x7, 0x4) bind$inet6(r0, &(0x7f0000000140)={0x1c, 0x1c, 0x2, 0x10, @ipv4={'\x00', '\xff\xff', @local={0xac, 0x14, 0x0}}, 0xfffffffb}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000200)={@random="717dc35b11bf", @random="c61800b000", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}}, @udp={{0x0, 0x2, 0x8}}}}}}) 2.262121262s ago: executing program 6 (id=3209): ppoll(&(0x7f0000000200)=[{}], 0x209b, 0x0, 0x0, 0x0) fork() pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000100)="19", 0x4000}], 0x1) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) 1.642219399s ago: executing program 0 (id=3211): r0 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mmap(&(0x7f00000d3000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) extattr_set_link(&(0x7f00000000c0)='./file0\x00', 0x1, &(0x7f00000001c0)='\x90\xcf\xa3+\x00-=\\5\x81\xb2(\x8c&\xd9D\xbe\x97\xc7\"\xde\"\rZ\x04\x1eC\xd3\xcb&\xb6\xc9:PM\x16SU\xef\xe8\xd6T\\\x93\x1f\xce\x19\xa1#Y\x1c\f\xfa\\07\x11\xd1=\xb1\xc5\x9d\xb6M|\xc6@\x11H\xc4\x04\xaeQ\xffi\\\xa6?\xf2\x01O\xd6\xcc\xed[a\xf8u}\xad\x9a\xb8\x1d\x11\a\xa4\xf4o\xce \xe7\xafsZ\xb1.P\xa5\xc6.\xe9\"w$\x0f\xda\x81f\x83M&\x99\xcfn\xae\xe1p\x14\x95\xef\xabb9x\\\a\xf6\xcap\xbf\xe8?\xf5D\xad@\xe3\x13\xb3\xea\xecS\x1c6\xb4\xd9\xd7$/\x8bU\xe1\x88/C\xba\xb4}\x88\'+X\xf2R\xe1\x14\x81Q\xc0\xfb\x0f\xc8n\xa2\xecq\x94\xcf&\xcc\xe3\x11\xe1\xe2Q\xbc\xd4.4\xc1\xed\xac\xa8\x95\xb8\x99\xe7\x1c', &(0x7f0000000140)="60029ba40b17654701378516e4cde5beff4bb49b7f4a8eb42a6a810a8c7c6e776f226944f21879f180273e20f55c32d5fb000000000000000088fe71ed14272651c3629a468bf96f81", 0xff22) sendmsg$unix(0xffffffffffffff9c, &(0x7f0000003600)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) mount(&(0x7f0000000000)='ufs\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000140)) extattr_delete_link(&(0x7f0000000040)='./file0\x00', 0x1, &(0x7f00000003c0)='\x90\xcf\xa3+\x00-=\\5\x81\xb2(\x8c&\xd9D\xbe\x97\xc7\"\xde\"\rZ\x04\x1eC\xd3\xcb&\xb6\xc9:PM\x16SU\xef\xe8\xd6T\\\x93\x1f\xce\x19\xa1#Y\x1c\f\xfa\\07\x11\xd1=\xb1\xc5\x9d\xb6M|\xc6@\x11H\xc4\x04\xaeQ\xffi\\\xa6?\xf2\x01O\xd6\xcc\xed[a\xf8u}\xad\x9a\xb8\x1d\x11\a\xa4\xf4o\xce \xe7\xafsZ\xb1.P\xa5\xc6.\xe9\"w$\x0f\xda\x81f\x83M&\x99\xcfn\xae\xe1p\x14\x95\xef\xabb9x\\\a\xf6\xcap\xbf\xe8?\xf5D\xad@\xe3\x13\xb3\xea\xecS\x1c6\xb4\xd9\xd7$/\x8bU\xe1\x88/C\xba\xb4}\x88\'+X\xf2R\xe1\x14\x81Q\xc0\xfb\x0f\xc8n\xa2\xecq\x94\xcf&\xcc\xe3\x11\xe1\xe2Q\xbc\xd4.4\xc1\xed\xac\xa8\x95\xb8\x99\xe7\x1c') 1.584007711s ago: executing program 0 (id=3214): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0x1c, 0x1c, 0x2, 0x0, @loopback}, 0x1c) setgroups(0x4000000000000287, &(0x7f0000000000)=[0xffffffffffffffff]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(r1, 0x0, 0x2, &(0x7f0000000580)="7215a382", 0x4) r2 = dup(r0) sendmsg$unix(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xd0}, 0x0) 1.576012655s ago: executing program 0 (id=3215): setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000040)={@remote={0xac, 0x14, 0x0}, @loopback}, 0xc) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = socket(0x26, 0x2, 0x0) r1 = socket(0x26, 0x2, 0x0) bind(r1, &(0x7f0000000040)=@in6={0x22, 0x1c, 0x3, 0x300, @mcast1}, 0xc) bind(r0, &(0x7f0000000040)=@in6={0x22, 0x1c, 0x3, 0x0, @mcast1}, 0xc) 1.415712145s ago: executing program 0 (id=3219): rfork(0x85000) openat$bpf(0xffffff9c, &(0x7f0000000180), 0x200, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="04010000ffff000001"], 0x104}, 0x0) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=""/25, 0x19}, 0x80) vfork() 1.364148491s ago: executing program 4 (id=3220): mkdir(&(0x7f00000000c0)='./file0\x00', 0xb) r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = __specialfd$inotify(0x2, &(0x7f0000000040)={0x4}, 0x4) inotify_add_watch_at(r1, r0, &(0x7f0000000080)='./file0\x00', 0x84000008) extattr_set_link(&(0x7f00000000c0)='./file0\x00', 0x1, &(0x7f00000001c0)='\x90\xcf\xa3+\x00-=\\5\x81\xb2(\x8c&\xd9D\xbe\x97\xc7\"\xde\"\rZ\x04\x1eC\xd3\xcb&\xb6\xc9:PM\x16SU\xef\xe8\xd6T\\\x93\x1f\xce\x19\xa1#Y\x1c\f\xfa\\07\x11\xd1=\xb1\xc5\x9d\xb6M|\xc6@\x11H\xc4\x04\xaeQ\xffi\\\xa6?\xf2\x01O\xd6\xcc\xed[a\xf8u}\xad\x9a\xb8\x1d\x11\a\xa4\xf4o\xce \xe7\xafsZ\xb1.P\xa5\xc6.\xe9\"w$\x0f\xda\x81f\x83M&\x99\xcfn\xae\xe1p\x14\x95\xef\xabb9x\\\a\xf6\xcap\xbf\xe8?\xf5D\xad@\xe3\x13\xb3\xea\xecS\x1c6\xb4\xd9\xd7$/\x8bU\xe1\x88/C\xba\xb4}\x88\'+X\xf2R\xe1\x14\x81Q\xc0\xfb\x0f\xc8n\xa2\xecq\x94\xcf&\xcc\xe3\x11\xe1\xe2Q\xbc\xd4.4\xc1\xed\xac\xa8\x95\xb8\x99\xe7\x1c', 0x0, 0x0) extattr_delete_link(&(0x7f0000000580)='./file0\x00', 0x1, &(0x7f00000003c0)='\x90\xcf\xa3+\x00\x02=\\5\x81\xb2(\x8c&\xd9D\xbe\x97\xc7\"\xde\"\rZ\x04\x1eC\xd3\xcb&\x95\xe8X\xb6\x17\x99\xa6\xe4\xef\xe8\xd6T\\\x93\x1f\xce\x19\xa1#Y\x1c\f\xfa\\07\x11\xd1=\xb1\xc5\x9d\xb6M|\xc6@\x11H\xc4\x04\xaeQ\xffi\\\xa6?\xf2\x01O\xd6\xcc\xed[a\x9c\x14\xecRRn\ab\xe2\xf8u}\xad\x9a\xb8\x1d\x11\a\xa4\xf4o\xce \xe7\xafsZ\xb1.P\xa5\xc6\xcf\"w$\x0f\xda\x81f\x83M&\x99\xcfn\xae\xe1p\x14\x95\xef\xabb9x\\\a\xf6\xcap\xbf\xe8?\xf5D\xad@\xe3\x13\xb3\xea\xecS\x1c6\xb4\xd9\xd7$/\x8bU\xe1\x88/C\xba\xb4}\x88\'+X\xf2R\xe1\x14\x81Q\xc0\xfb\x0f\xc8n\xa2\x1eq\x94\xcf&\xcc\xe3\x11\xe1\xe2Q\xbc\xd4.4') 1.254090236s ago: executing program 4 (id=3223): open(&(0x7f0000000200)='./file0\x00', 0x200, 0x0) r0 = socket$inet6_icmp_raw(0x1c, 0x3, 0x3a) ioctl$SMB_READB(r0, 0xc02069f5, &(0x7f00000000c0)={0x0, 0x0, 0x0, @buf="dcbf", @buf="de32", 0x0, 0x0, 0x0, 0x0}) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9b, 0x0) cpuset_getaffinity(0x3, 0x6, 0x2, 0x0, 0xffffffffffffffff) cpuset_setaffinity(0x1, 0x8, 0x9, 0x8, &(0x7f0000000000)={[0x5d7]}) 1.252868162s ago: executing program 4 (id=3225): rfork(0x5000) openat$md(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) freebsd10_pipe(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) rfork(0x10010) rfork(0x50) close(r0) 1.224367041s ago: executing program 6 (id=3226): r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f00000002c0)=@file={0xa, 0x1, './file1\x00'}, 0xa) listen(r0, 0x2) r1 = socket$unix(0x1, 0x5, 0x0) accept$unix(r0, &(0x7f0000000040)=@abs={0x8}, &(0x7f0000000080)=0x8) connect$unix(r1, &(0x7f0000000000)=@file={0xa, 0x1, './file1\x00'}, 0xa) 1.094448432s ago: executing program 4 (id=3227): r0 = socket$inet6(0x1c, 0x1, 0x0) setsockopt(r0, 0x29, 0x40, &(0x7f0000000000)="60c6eabb", 0x4) bind$inet6(r0, &(0x7f0000000080)={0x1c, 0x1c, 0x0, 0x7, @ipv4}, 0x1c) sendmsg$inet6_sctp(r0, &(0x7f0000000480)={&(0x7f0000000100)=@in6={0x21, 0x1c, 0x0, 0x9, @loopback={0x0, 0xfffffffffffffffe}, 0xffffffff}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x20184}, 0x80) r1 = socket(0x1c, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0x1c, 0x1c, 0x0, 0x0, @loopback}, 0x1c) 1.093114329s ago: executing program 6 (id=3235): ppoll(&(0x7f0000000200)=[{}], 0x209b, 0x0, 0x0, 0x0) fork() pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000100)="19", 0x4000}], 0x1) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) 924.188421ms ago: executing program 2 (id=3228): r0 = socket$inet6_udp(0x1c, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1b, &(0x7f00000001c0), 0x4) setsockopt$sock_int(r0, 0xffff, 0x400, &(0x7f0000000300)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x48, &(0x7f0000000000)=0x7, 0x4) bind$inet6(r0, &(0x7f0000000140)={0x1c, 0x1c, 0x2, 0x10, @ipv4={'\x00', '\xff\xff', @local={0xac, 0x14, 0x0}}, 0xfffffffb}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000200)={@random="717dc35b11bf", @random="c61800b000", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0x0}, @local={0xac, 0x14, 0x0}}, @udp={{0x0, 0x2, 0x8}}}}}}) 922.802237ms ago: executing program 4 (id=3237): r0 = socket$inet_sctp(0x2, 0x5, 0x84) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2) ioctl$MDIOCATTACH(0xffffffffffffffff, 0xc1b46d00, &(0x7f00000003c0)={0x0, 0x7fffff7b, 0x0, 0x0, 0xfff, 0x4, 0x0, 0x26, 0x0, 0x0, 0x0, [0x0, 0x2, 0x3, 0x0, 0x40, 0x0, 0x3ff, 0x6, 0x1, 0xb32c, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0xe122, 0x8000000, 0x5, 0x42f, 0xfffffffd, 0x0, 0xffffffff, 0x80000000, 0xf, 0xfffffffd, 0x0, 0x3ff, 0xc4, 0x4, 0x0, 0xa7, 0xc37b, 0x7, 0x0, 0x9, 0x2, 0x2000, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6cdd1400, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xae, 0x0, 0x7, 0x1, 0x1000, 0x0, 0x4, 0x80000, 0x0, 0x2, 0x7fed, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x800006, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0xfffffffb]}) r1 = socket(0x1c, 0x1, 0x0) readv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000001740)=""/4091, 0xea6}], 0x2000000000000146) ioctl$KDGETMODE(r1, 0x40046676, 0x22e00000) 881.127762ms ago: executing program 2 (id=3229): r0 = socket(0x1c, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0x1c, 0x1c, 0x3, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty}, 0x1c) sendto$inet(r0, &(0x7f0000000200)="8b", 0x1, 0x20bf0022, 0x0, 0x0) setsockopt$inet_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f0000000040)={'bbr\x00', 0xf}, 0x24) setsockopt$inet6_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f0000000080)={'freebsd\x00', 0x87ea}, 0x5b) 824.178213ms ago: executing program 2 (id=3230): r0 = socket$inet6(0x1c, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0x1c, 0x1c, 0x0, 0x825, @loopback, 0x20}, 0x1c) r1 = socket(0x1c, 0x1, 0x0) setsockopt$sock_int(r1, 0xffff, 0x10000, &(0x7f0000000080)=0xb, 0x4) bind$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x0, 0x0, @empty}, 0x1c) rfork(0x1000) 823.972751ms ago: executing program 2 (id=3231): symlink(0x0, &(0x7f0000000040)='./file0\x00') chdir(&(0x7f0000000080)='./file0/file0/..\x00') syz_emit_ethernet(0x2a, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdir(&(0x7f0000000080)='./file1\x00', 0x20) 823.876252ms ago: executing program 2 (id=3232): r0 = open$dir(&(0x7f00000001c0)='.\x00', 0x0, 0x2) symlinkat(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') symlinkat(&(0x7f0000000480)='./file0\x00', r0, &(0x7f0000000180)='./file1\x00') freebsd11_mknod(&(0x7f0000000280)='./file0\x00', 0x672cda28f543e327, 0x3) unlink(&(0x7f0000000880)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') rename(&(0x7f0000000500)='./file1\x00', &(0x7f0000000f80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 822.763151ms ago: executing program 2 (id=3240): r0 = socket(0x1c, 0x1, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$crypto(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$CIOCGSESSION2(r1, 0xc030636a, &(0x7f0000000080)={0x17, 0x0, 0x10, &(0x7f0000000040)="ec7b00000900ff2425c1f0a58b519798", 0x0, 0x0, 0xfffffffe, 0xfdffff85, [0x0, 0x0, 0x7fe, 0xfffffffc]}) ioctl$CIOCCRYPT(r1, 0xc01c6367, &(0x7f0000000280)={0x0, 0x1, 0x76, 0x8a, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 818.44624ms ago: executing program 35 (id=3240): r0 = socket(0x1c, 0x1, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$crypto(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$CIOCGSESSION2(r1, 0xc030636a, &(0x7f0000000080)={0x17, 0x0, 0x10, &(0x7f0000000040)="ec7b00000900ff2425c1f0a58b519798", 0x0, 0x0, 0xfffffffe, 0xfdffff85, [0x0, 0x0, 0x7fe, 0xfffffffc]}) ioctl$CIOCCRYPT(r1, 0xc01c6367, &(0x7f0000000280)={0x0, 0x1, 0x76, 0x8a, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 8.356507ms ago: executing program 0 (id=3234): openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = freebsd12_shm_open(&(0x7f0000000000)='./file0\x00', 0x602, 0x0) ftruncate(r0, 0x3862) write(r0, &(0x7f0000000100)='iHQ', 0x3) ftruncate(r0, 0x9) 7.887054ms ago: executing program 4 (id=3236): r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f00000002c0)=@file={0xa, 0x1, './file1\x00'}, 0xa) listen(r0, 0x2) r1 = socket$unix(0x1, 0x5, 0x0) accept$unix(r0, &(0x7f0000000040)=@abs={0x8}, &(0x7f0000000080)=0x8) connect$unix(r1, &(0x7f0000000000)=@file={0xa, 0x1, './file1\x00'}, 0xa) 0s ago: executing program 6 (id=3238): vfork() rfork(0x85000) ktimer_create(0x0, 0x0, &(0x7f0000000140)=0x0) ktimer_settime(r0, 0x0, &(0x7f0000000040)={{0xfb4, 0x2}, {0x0, 0xecc}}, 0x0) rfork(0x1000) ktimer_settime(r0, 0x0, &(0x7f0000000100)={{0x7, 0x8}, {0x0, 0x1}}, 0x0) lio_listio(0x0, 0x0, 0x0, &(0x7f0000000080)={0x1, 0x13, @sigval_ptr=0x7, @ke_flags=0x8038}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.72' (ED25519) to the list of known hosts. if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 md0: truncating fractional last sector by 249 bytes ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 md2147483519: truncating fractional last sector by 3 bytes Out of ktrace request objects. ip6_pcbopts: all specified options are cleared. ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe0007793800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 Expensive callout(9) function: 0xffffffff819c1440(0) 0.005802808 s if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793800 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 vnode_pager_putpages: zero-length write at 0 resid 2002 0xfffffe0078029dc0: type VREG state VSTATE_CONSTRUCTED op 0xffffffff8371d940 usecount 2, writecount 2, refcount 3 seqc users 0 hold count flags () flags (VIRF_PGREAD|VMP_LAZYLIST) v_object 0xfffffe005878d5d0 ref 1 pages 1 cleanbuf 1 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe0058787780 (pid 2748, syz-executor, tid 102220) nlink=1, effnlink=1, size=2002, extsize=0 generation=59957326, uid=0, gid=0, flags=0x4 ino 198685, on dev gpt/rootfs if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054218800 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 if_delmulti_locked: detaching ifnet instance 0xfffffe006e6ef000 Nov 19 22:19:36 ci-freebsd-i386-4 dhclient[1684]: send_packet: No buffer space available if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0054217000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007793000 Nov 19 22:19:58 ci-freebsd-i386-4 syslogd: last message repeated 2 times if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 if_delmulti_locked: detaching ifnet instance 0xfffffe0007795000 vnode_pager_putpages: zero-length write at 0 resid 4096 0xfffffe0077875000: type VREG state VSTATE_CONSTRUCTED op 0xffffffff8371d940 usecount 0, writecount 0, refcount 4 seqc users 0 hold count flags () flags (VIRF_PGREAD|VI_DOINGINACT|VMP_LAZYLIST) v_object 0xfffffe007ce285d0 ref 0 pages 9 cleanbuf 2 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe007ce16000 (pid 4229, syz-executor, tid 104185) nlink=1, effnlink=1, size=67542, extsize=0 generation=711c6e6c, uid=0, gid=0, flags=0x160000 ino 198704, on dev gpt/rootfs vnode_pager_putpages: zero-length write at 0 resid 4096 0xfffffe006e6b7dc0: type VREG state VSTATE_CONSTRUCTED op 0xffffffff8371d940 usecount 0, writecount 0, refcount 4 seqc users 0 hold count flags () flags (VIRF_PGREAD|VI_DOINGINACT|VMP_LAZYLIST) v_object 0xfffffe007ce2a1f0 ref 0 pages 9 cleanbuf 2 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe00587f2780 (pid 4247, syz-executor, tid 104206) nlink=1, effnlink=1, size=67542, extsize=0 generation=a8b77505, uid=0, gid=0, flags=0x160000 ino 190, on dev gpt/rootfs vnode_pager_putpages: zero-length write at 0 resid 4096 0xfffffe007cc88000: type VREG state VSTATE_CONSTRUCTED op 0xffffffff8371d940 usecount 0, writecount 0, refcount 4 seqc users 0 hold count flags () flags (VIRF_PGREAD|VI_DOINGINACT|VMP_LAZYLIST) v_object 0xfffffe007ce237c0 ref 0 pages 9 cleanbuf 2 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe007ce0b780 (pid 4273, syz-executor, tid 104242) nlink=1, effnlink=1, size=67542, extsize=0 generation=fe771a26, uid=0, gid=0, flags=0x160000 ino 167, on dev gpt/rootfs ifconfig: interface tap7 does not exist kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) SYZFAIL: repeatedly failed to execute the program proc=7 req=3233 state=1 status=67 (errno 9: Bad file descriptor) FreeBSD/amd64 (ci-freebsd-i386-4.us-central1-b.c.syzkaller.internal) (ttyu0) login: set $lines = 0 Password: Login incorrect login: show registers Password: Login incorrect login: ps Nov 19 22:21:34 ci-freebsd-i386-4 login[747]: 2 LOGIN FAILURES ON ttyu0 Password: Login incorrect login: show malloc Password: Login incorrect show all tcpcbs/bl