syzkaller syzkaller login: [ 14.183596][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 14.183610][ T28] audit: type=1400 audit(1756013646.173:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.188359][ T28] audit: type=1400 audit(1756013646.173:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.191522][ T28] audit: type=1400 audit(1756013646.173:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[14762]" dev="pipefs" ino=14762 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.195125][ T28] audit: type=1400 audit(1756013646.173:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.197993][ T28] audit: type=1400 audit(1756013646.173:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.199' (ED25519) to the list of known hosts. 2025/08/24 05:34:15 parsed 1 programs [ 23.115720][ T28] audit: type=1400 audit(1756013655.103:64): avc: denied { node_bind } for pid=283 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.136406][ T28] audit: type=1400 audit(1756013655.103:65): avc: denied { module_request } for pid=283 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.900973][ T28] audit: type=1400 audit(1756013655.883:66): avc: denied { mounton } for pid=292 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.902099][ T292] cgroup: Unknown subsys name 'net' [ 23.923703][ T28] audit: type=1400 audit(1756013655.893:67): avc: denied { mount } for pid=292 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.951024][ T28] audit: type=1400 audit(1756013655.923:68): avc: denied { unmount } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.971242][ T292] cgroup: Unknown subsys name 'devices' [ 24.092867][ T292] cgroup: Unknown subsys name 'hugetlb' [ 24.098501][ T292] cgroup: Unknown subsys name 'rlimit' [ 24.206691][ T28] audit: type=1400 audit(1756013656.193:69): avc: denied { setattr } for pid=292 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.229941][ T28] audit: type=1400 audit(1756013656.193:70): avc: denied { create } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.240459][ T294] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.250543][ T28] audit: type=1400 audit(1756013656.193:71): avc: denied { write } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.279191][ T28] audit: type=1400 audit(1756013656.193:72): avc: denied { read } for pid=292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.299541][ T28] audit: type=1400 audit(1756013656.193:73): avc: denied { mounton } for pid=292 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.328014][ T292] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.960080][ T296] request_module fs-gadgetfs succeeded, but still no fs? [ 25.150606][ T315] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.157888][ T315] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.165331][ T315] device bridge_slave_0 entered promiscuous mode [ 25.172160][ T315] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.179197][ T315] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.186880][ T315] device bridge_slave_1 entered promiscuous mode [ 25.229565][ T315] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.236833][ T315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.244199][ T315] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.251254][ T315] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.258926][ T311] syz-executor (311) used greatest stack depth: 22208 bytes left [ 25.272317][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.279977][ T302] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.287748][ T302] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.296953][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.305338][ T302] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.312411][ T302] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.321876][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.330170][ T302] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.337248][ T302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.349570][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.361511][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.373615][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.385550][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.393568][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.400974][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.409385][ T315] device veth0_vlan entered promiscuous mode [ 25.419150][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.428810][ T315] device veth1_macvtap entered promiscuous mode [ 25.438035][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.451776][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.480956][ T315] syz-executor (315) used greatest stack depth: 21568 bytes left 2025/08/24 05:34:18 executed programs: 0 [ 26.073325][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.080365][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.089240][ T363] device bridge_slave_0 entered promiscuous mode [ 26.099500][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.106728][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.114088][ T363] device bridge_slave_1 entered promiscuous mode [ 26.166248][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.173738][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.182465][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.190811][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.199071][ T302] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.206249][ T302] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.214054][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.226062][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.234730][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.243212][ T302] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.250226][ T302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.261249][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.269374][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.278888][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.287278][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.304161][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.312711][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.323802][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.331812][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.339819][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.347563][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.355980][ T363] device veth0_vlan entered promiscuous mode [ 26.369440][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.377691][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.387048][ T363] device veth1_macvtap entered promiscuous mode [ 26.395831][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.403621][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.412257][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.425564][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.434092][ T302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.456765][ T373] loop2: detected capacity change from 0 to 512 [ 26.465302][ T373] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 26.479377][ T373] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 26.492450][ T373] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2818: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 26.505785][ T373] EXT4-fs (loop2): 1 truncate cleaned up [ 26.511693][ T373] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 26.522106][ T43] device bridge_slave_1 left promiscuous mode [ 26.534277][ T373] ================================================================== [ 26.535143][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.542370][ T373] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x979/0x21d0 [ 26.542411][ T373] Read of size 18446744073709551572 at addr ffff88811370c850 by task syz.2.17/373 [ 26.542426][ T373] [ 26.542435][ T373] CPU: 0 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 [ 26.575806][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 26.585953][ T373] Call Trace: [ 26.589409][ T373] [ 26.592414][ T373] __dump_stack+0x21/0x24 [ 26.596747][ T373] dump_stack_lvl+0xee/0x150 [ 26.601336][ T373] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.606364][ T373] ? ext4_xattr_block_set+0x9dc/0x3270 [ 26.611849][ T373] ? __ext4_unlink+0x673/0xb00 [ 26.616920][ T373] ? ext4_xattr_set_entry+0x979/0x21d0 [ 26.622562][ T373] print_address_description+0x71/0x210 [ 26.628207][ T373] print_report+0x4a/0x60 [ 26.632540][ T373] kasan_report+0x122/0x150 [ 26.638689][ T373] ? ext4_xattr_set_entry+0x979/0x21d0 [ 26.644143][ T373] ? ext4_xattr_set_entry+0x979/0x21d0 [ 26.649596][ T373] kasan_check_range+0x280/0x290 [ 26.655164][ T373] memmove+0x2d/0x70 [ 26.659080][ T373] ext4_xattr_set_entry+0x979/0x21d0 [ 26.664373][ T373] ext4_xattr_block_set+0xada/0x3270 [ 26.669836][ T373] ? __getblk_gfp+0x3b/0x7d0 [ 26.674808][ T373] ? xattr_find_entry+0x24c/0x300 [ 26.679934][ T373] ? ext4_xattr_block_find+0x310/0x310 [ 26.685393][ T373] ? ext4_xattr_block_find+0x295/0x310 [ 26.690860][ T373] ext4_expand_extra_isize_ea+0xf30/0x1990 [ 26.696712][ T373] __ext4_expand_extra_isize+0x2fe/0x3e0 [ 26.702359][ T373] __ext4_mark_inode_dirty+0x3cf/0x600 [ 26.707851][ T373] __ext4_unlink+0x673/0xb00 [ 26.712487][ T373] ? memcpy+0x56/0x70 [ 26.716474][ T373] ? __cfi___ext4_unlink+0x10/0x10 [ 26.721588][ T373] ? dquot_initialize+0x20/0x20 [ 26.726552][ T373] ? clear_nonspinnable+0x60/0x60 [ 26.731685][ T373] ext4_unlink+0x13a/0x3a0 [ 26.736127][ T373] vfs_unlink+0x39f/0x630 [ 26.740446][ T373] do_unlinkat+0x31f/0x6b0 [ 26.744936][ T373] ? __cfi_do_unlinkat+0x10/0x10 [ 26.749887][ T373] ? getname_flags+0x206/0x500 [ 26.754694][ T373] __x64_sys_unlink+0x49/0x50 [ 26.759376][ T373] x64_sys_call+0x958/0x9a0 [ 26.763975][ T373] do_syscall_64+0x4c/0xa0 [ 26.768401][ T373] ? clear_bhb_loop+0x30/0x80 [ 26.773071][ T373] ? clear_bhb_loop+0x30/0x80 [ 26.777741][ T373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.783621][ T373] RIP: 0033:0x7f22fd38ebe9 [ 26.788045][ T373] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 26.807901][ T373] RSP: 002b:00007fff303621a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 26.817188][ T373] RAX: ffffffffffffffda RBX: 00007f22fd5b5fa0 RCX: 00007f22fd38ebe9 [ 26.826773][ T373] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 26.835595][ T373] RBP: 00007f22fd411e19 R08: 0000000000000000 R09: 0000000000000000 [ 26.843586][ T373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.851726][ T373] R13: 00007f22fd5b5fa0 R14: 00007f22fd5b5fa0 R15: 0000000000000001 [ 26.860224][ T373] [ 26.863236][ T373] [ 26.865542][ T373] Allocated by task 373: [ 26.869760][ T373] kasan_set_track+0x4b/0x70 [ 26.874330][ T373] kasan_save_alloc_info+0x25/0x30 [ 26.879501][ T373] __kasan_kmalloc+0x95/0xb0 [ 26.884074][ T373] __kmalloc_node_track_caller+0xb1/0x1e0 [ 26.889773][ T373] kmemdup+0x2b/0x60 [ 26.893665][ T373] ext4_xattr_block_set+0x9dc/0x3270 [ 26.899029][ T373] ext4_expand_extra_isize_ea+0xf30/0x1990 [ 26.904927][ T373] __ext4_expand_extra_isize+0x2fe/0x3e0 [ 26.910595][ T373] __ext4_mark_inode_dirty+0x3cf/0x600 [ 26.916142][ T373] __ext4_unlink+0x673/0xb00 [ 26.920730][ T373] ext4_unlink+0x13a/0x3a0 [ 26.925317][ T373] vfs_unlink+0x39f/0x630 [ 26.929684][ T373] do_unlinkat+0x31f/0x6b0 [ 26.934150][ T373] __x64_sys_unlink+0x49/0x50 [ 26.938833][ T373] x64_sys_call+0x958/0x9a0 [ 26.943327][ T373] do_syscall_64+0x4c/0xa0 [ 26.947776][ T373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.953647][ T373] [ 26.955951][ T373] The buggy address belongs to the object at ffff88811370c800 [ 26.955951][ T373] which belongs to the cache kmalloc-1k of size 1024 [ 26.970217][ T373] The buggy address is located 80 bytes inside of [ 26.970217][ T373] 1024-byte region [ffff88811370c800, ffff88811370cc00) [ 26.983743][ T373] [ 26.986069][ T373] The buggy address belongs to the physical page: [ 26.992515][ T373] page:ffffea00044dc200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113708 [ 27.005567][ T373] head:ffffea00044dc200 order:3 compound_mapcount:0 compound_pincount:0 [ 27.013979][ T373] flags: 0x4000000000010200(slab|head|zone=1) [ 27.020065][ T373] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043080 [ 27.028669][ T373] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.037241][ T373] page dumped because: kasan: bad access detected [ 27.043663][ T373] page_owner tracks the page as allocated [ 27.049359][ T373] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 92, tgid 92 (klogd), ts 26479261169, free_ts 26363773345 [ 27.071575][ T373] post_alloc_hook+0x1f5/0x210 [ 27.076465][ T373] prep_new_page+0x1c/0x110 [ 27.081078][ T373] get_page_from_freelist+0x2c7b/0x2cf0 [ 27.086637][ T373] __alloc_pages+0x1c3/0x450 [ 27.091266][ T373] alloc_slab_page+0x6e/0xf0 [ 27.096322][ T373] new_slab+0x98/0x3d0 [ 27.100390][ T373] ___slab_alloc+0x6f6/0xb50 [ 27.104983][ T373] __slab_alloc+0x5e/0xa0 [ 27.109644][ T373] __kmem_cache_alloc_node+0x203/0x2c0 [ 27.115200][ T373] __kmalloc_node_track_caller+0xa0/0x1e0 [ 27.120933][ T373] __alloc_skb+0x236/0x4b0 [ 27.125362][ T373] alloc_skb_with_frags+0xa8/0x620 [ 27.130466][ T373] sock_alloc_send_pskb+0x853/0x980 [ 27.135680][ T373] unix_dgram_sendmsg+0x592/0x16d0 [ 27.140792][ T373] __sys_sendto+0x464/0x5e0 [ 27.145325][ T373] __x64_sys_sendto+0xe5/0x100 [ 27.150082][ T373] page last free stack trace: [ 27.154756][ T373] free_unref_page_prepare+0x742/0x750 [ 27.160199][ T373] free_unref_page+0x8f/0x530 [ 27.164875][ T373] __free_pages+0x67/0x100 [ 27.169288][ T373] __free_slab+0xca/0x1a0 [ 27.173597][ T373] __unfreeze_partials+0x160/0x190 [ 27.178698][ T373] put_cpu_partial+0xa9/0x100 [ 27.183392][ T373] __slab_free+0x1c4/0x280 [ 27.187814][ T373] ___cache_free+0xbf/0xd0 [ 27.192234][ T373] qlist_free_all+0xc6/0x140 [ 27.196799][ T373] kasan_quarantine_reduce+0x14a/0x170 [ 27.202236][ T373] __kasan_slab_alloc+0x24/0x80 [ 27.207079][ T373] slab_post_alloc_hook+0x4f/0x2d0 [ 27.212183][ T373] kmem_cache_alloc_node+0x181/0x340 [ 27.217473][ T373] __alloc_skb+0xea/0x4b0 [ 27.221830][ T373] inet6_netconf_notify_devconf+0x107/0x1c0 [ 27.227731][ T373] addrconf_ifdown+0x1603/0x1910 [ 27.232670][ T373] [ 27.234981][ T373] Memory state around the buggy address: [ 27.240595][ T373] ffff88811370c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.248667][ T373] ffff88811370c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.256707][ T373] >ffff88811370c800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.264791][ T373] ^ [ 27.271459][ T373] ffff88811370c880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.279511][ T373] ffff88811370c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.287564][ T373] ================================================================== [ 27.296198][ T373] Disabling lock debugging due to kernel taint [ 27.302756][ T43] device bridge_slave_0 left promiscuous mode [ 27.308899][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.318082][ T363] EXT4-fs (loop2): unmounting filesystem. [ 27.318090][ T43] device veth1_macvtap left promiscuous mode [ 27.337299][ T43] device veth0_vlan left promiscuous mode