last executing test programs: 434.235841ms ago: executing program 3 (id=4): sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)=@un=@abs={0x1, 0x0, 0x0}, 0x8, &(0x7f0000000140)=[{&(0x7f0000000040)="7efce4004ea44b25c1290ffec61cd12dcd8bf8db0a0df7407427c1ca489bb63dd49a605c5cd32ba419ad4e35108eaa6117b236c0b489f00e5892af3eced2d0bd82a758586fbcb48c975156e46e51fa37f4f227c8524dd7905e2a2772c8408e27a707e1826701d0845d4b9d42a2ca572174dd398de700cadcc8226f16a89d48ee08ffe8d2dca2ffc6baba89a791003113cf29bdb1ca5e8415d64cfc83ad4113dc1c4742a1f62b78112fe27bc80b7ceddcaed14bee67e07713504c2d6210beda8179863fdde72d8bb922207fab2e0d1d457c7368e4399483c08e23dd3c5423", 0xde}], 0x1, &(0x7f0000000180)}, 0xa) r0 = socket$inet(0x2, 0x8003, 0x0) setsockopt(r0, 0x0, 0x6, &(0x7f0000000340), 0x0) sysctl$hw(&(0x7f0000001a80)={0x6, 0xc}, 0x2, &(0x7f0000001ac0)="d7ff9708", &(0x7f0000001b80)=0x4, &(0x7f0000001bc0), 0x0) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x90, 0x18) socketpair(0x20, 0x4000, 0x9, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r2) 408.317863ms ago: executing program 0 (id=1): msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x1c0, 0x87}, 0x7, 0xfffffffffffffff9, 0x0, 0x0, 0x5be2f0d9, 0x2008005, 0xfffffffffffffffc, 0x4}) sendto$unix(0xffffffffffffff9c, &(0x7f0000000000)="b1000504600000000000000007000000331c13fecea10500fef9e906c72fd3357ae320b37b673039d2d236073705ae04be38164991f7accf5f882b297be1aa5b236deb51e2f0ac3ebbc257699a5f139b672f4d335d223e7d029d6ba8af630037280200000000720f70c1f5a472c881ea6e69e0bb76d907c400000200361b1257aea8c5000020020000000000008abfba09", 0x91, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) mknod(&(0x7f0000000380)='./file1\x00', 0x2000, 0x285b9a) r0 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0x120) getdents(r0, 0x0, 0x0) r1 = socket(0x11, 0x3, 0x0) sendto$unix(r1, &(0x7f0000000000)="b1000504000004000000000001000000331c13fecea10500fef96ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f4d335c223e7d0c032bfa896443a42102000000720fd18bfbb670c1f5a872c881ea6e2ec5890400000000008000361b4cc702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900000008e371a3f8343712051eea040000000000", 0xb1, 0x0, 0x0, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x1c0, 0x87}, 0x7, 0xfffffffffffffff9, 0x0, 0x0, 0x5be2f0d9, 0x2008005, 0xfffffffffffffffc, 0x4}) (async) sendto$unix(0xffffffffffffff9c, &(0x7f0000000000)="b1000504600000000000000007000000331c13fecea10500fef9e906c72fd3357ae320b37b673039d2d236073705ae04be38164991f7accf5f882b297be1aa5b236deb51e2f0ac3ebbc257699a5f139b672f4d335d223e7d029d6ba8af630037280200000000720f70c1f5a472c881ea6e69e0bb76d907c400000200361b1257aea8c5000020020000000000008abfba09", 0x91, 0x0, 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) (async) mknod(&(0x7f0000000380)='./file1\x00', 0x2000, 0x285b9a) (async) open(&(0x7f0000000800)='./file1\x00', 0x800, 0x120) (async) getdents(r0, 0x0, 0x0) (async) socket(0x11, 0x3, 0x0) (async) sendto$unix(r1, &(0x7f0000000000)="b1000504000004000000000001000000331c13fecea10500fef96ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f4d335c223e7d0c032bfa896443a42102000000720fd18bfbb670c1f5a872c881ea6e2ec5890400000000008000361b4cc702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900000008e371a3f8343712051eea040000000000", 0xb1, 0x0, 0x0, 0x0) (async) 394.753457ms ago: executing program 3 (id=9): sysctl$kern(&(0x7f0000000980)={0x1, 0x16}, 0x2, &(0x7f0000000e40)="6c5046c7d66676c7bc7852289e504b4214db8c539e59ca7969d1ee7d2d97312cc2c8b30c273006f43130336fb0fefb0d95c042f876ccb9cb9b15885cb7f528b185fdeaffcde947a60461c0d007085a33301307834b51cc5b2040d604ab5b9e6151cb6cc2fde110e302550dab02adfe22d03acbf98a6d27248bc8665099d2bbaa7ae0442c413237152ceafa2331397065cd6e568b5342c563b9c7a31252fb518fd1e7e87f1f660ce20fbc635cbae96c599bb6657e248e303747dd53bcecf6a9a1ba60e6457dbe8eca321b2be30d262b144f3d94e9", &(0x7f00000009c0)=0xd4, &(0x7f0000000f40)="3e8067e6be72f688ee4052bbee908a3ce5a076b7ccd028d433f209a80ee657b3119700897755d5e184d38f602ca8604b7921fa1b900770bd6a57c30035c1685e58d1a6ea85edaf54c386abf60270b9533dbac3858600526c5e468cc87804017733748beda22a47611b569d783e0d9c884381c409f0257754b97ec872931774e309214fddab5f4a58785b655f4b903f5d33a6e71eb5d8f40cf107ca682e051b688d408dacec6c335edd684a388b715c37976a5a57d4801c375ae1d79410c158e0ffc6246c0f78f467fe030ba47679e7113a09c344130594ade0cf", 0xda) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x1f95d27d48731892, 0x7}, 0x8) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x2000, 0x4800) r0 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) unveil(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='x\x00') open(&(0x7f0000000000)='./file0\x00', 0x615, 0x106) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCFLUSH(r0, 0xc00c7006, &(0x7f0000000080)=0x500) unveil(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='r\x00') 172.287922ms ago: executing program 0 (id=10): sendmsg$unix(0xffffffffffffffff, &(0x7f0000001700)={&(0x7f00000000c0), 0x2, 0x0}, 0x4) (async) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000240)={'tap', 0x0}) (async) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000000)={0x4, &(0x7f0000000040)=[{0x1, 0x3d, 0x4, 0x5}, {0x3c, 0x9, 0xa, 0x89}, {0x48, 0x8, 0x1, 0x1}, {0x3c56, 0x4, 0x0, 0x7}]}) (async) syz_emit_ethernet(0x56, &(0x7f0000002800)={@broadcast, @local, [], {@ipv6={0x86dd, {0x2, 0x6, "86a9a3", 0x20, 0x2b, 0x8, @rand_addr="288a4e70a92664347e54ba787271ac51", @remote={0xfe, 0x80, '\x00', 0x0}, {[@fragment={0x2b, 0x0, 0x4f, 0x0, 0x0, 0x1, 0x66}], @icmpv6=@ndisc_na={0x88, 0x0, 0x0, 0x20, '\x00', @loopback}}}}}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket(0x18, 0x2, 0x0) setsockopt$sock_cred(r1, 0xffff, 0x1022, 0x0, 0x0) r2 = socket(0x18, 0x1, 0x0) close(r2) socket$inet(0x18, 0x3, 0x102) (async) sendmsg$unix(r2, &(0x7f0000001700)={0x0, 0x0, 0x0}, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x70e, 0x0) (async) r3 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) ioctl$BIOCSETIF(r3, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) (async) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x94, 0x91, 0xff, 0x47}, {0x40, 0xef, 0xff, 0x9}, {0x6, 0x7c, 0x8, 0xfffff7fe}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) ioctl$BIOCSETF(r3, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) (async) syz_emit_ethernet(0x5e, &(0x7f0000002c80)={@broadcast, @local, [], {@ipv6={0x86dd, {0x4, 0x6, "f12819", 0x28, 0x37, 0x40, @loopback, @empty, {[], @icmpv6=@ndisc_redir={0x89, 0x0, 0x0, '\x00', @empty, @local={0xfe, 0x80, '\x00', 0x0}}}}}}}) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x2, 0x0) 171.969854ms ago: executing program 2 (id=3): select(0x40, &(0x7f0000000180)={0xfffffffffffffffd, 0x44809e9d, 0xfffffffffffffffb, 0xfffffffeffffffff, 0x2000000000000000, 0x210, 0x8, 0x7}, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file0\x00', 0x2000, 0x205b9a) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x19, 0x0) r1 = open(&(0x7f0000000300)='./file0\x00', 0x40, 0x100) sysctl$hw(&(0x7f00000000c0)={0x6, 0x8}, 0x2, 0x0, &(0x7f0000000080), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sysctl$hw(&(0x7f00000000c0), 0x2, &(0x7f00000002c0), &(0x7f0000000080)=0x1a, 0x0, 0x0) syz_open_pts() ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000380)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x84, 0x91, 0xff, 0x47}, {0x6, 0x80, 0x8, 0xfffff7fa}]}) sysctl$hw(0x0, 0x0, &(0x7f00000001c0)="0060053b3d000000002dec30c221c04ca1e6904c2ffd0bc16049a26808c2a0862cbdc68e74a9355f00000000000000009823ea007a51666d56a9836fa781c711aa35f39a00d93ec82fddc2fa15", &(0x7f0000000000)=0x4d, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETWF(r2, 0x80104277, &(0x7f0000000040)={0x0, 0x0}) write(r2, &(0x7f0000000600)="d81ad30100060000000100000000", 0xe) r3 = socket$inet(0x2, 0x3, 0x2) getsockopt(r3, 0x0, 0x68, 0x0, 0x0) r4 = socket(0x11, 0x3, 0x0) sendto$unix(r4, &(0x7f0000000080)="b10005010000009f0500000007010000331c13fece910b00fef96ecfc72fd3357ae30200004e3039d2d236acf21e7804be38164991f7c8cf5f882b2b7be1aa0500000051e2f0ad3ebbc257699a1f139b672f335c223e7d0c032bfa896443a42118210000720fd38bfb0000fd54c125191b1257aea8c500002002fbfe0c2300008abfba0902000000e371a3f8343712051eeab70800000000000000ffffffff001000000000000000000000000800000000", 0xb1, 0x0, 0x0, 0x0) 170.564806ms ago: executing program 0 (id=11): mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) r0 = open(&(0x7f0000002280)='./file0\x00', 0x1, 0x1e4) r1 = socket(0x18, 0x2, 0x0) setsockopt(r1, 0x1000000029, 0x32, &(0x7f00000000c0)="b211d7170d816685c8e360f2fa41c1a0946988b272d2dd3dc90142a84231a746e337b372e93320cff6669cbe7868de45ed3fc33719ca6df71ecec8a918458b2c10a1f8c66653b276e180e9cb9b21f9982230f575295d48889c9a920796b2dd92fc8575680b37ba955d2c15e6d7c9198ed900ab006ddfb67869b51a2216114d1ece85f593e74035f5bc054eb1dbddf42a", 0x90) sendmsg(r1, &(0x7f0000000080)={&(0x7f0000000040)=@in6={0x18, 0x0}, 0xc, 0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x438}, 0x2) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xfffffff9, 0xffff63db, 0x9, 0x8, 0x8, 0x8007c, 0x67, 0x10, [{0x8, 0x10000, 0xfffff115, 0x80000002}, {0x0, 0xffffffff, 0x200100, 0xfff}, {0x2, 0x4ba8, 0x0, 0x9}, {0x5, 0x8020fe, 0xf, 0x2000102}, {0x4, 0x2000007, 0x5, 0x5}, {0x7, 0xfffd, 0x8, 0x3}, {0x3, 0xa00, 0x3, 0xfffffffe}, {0x207, 0xffffffff, 0x228000, 0xffffe2e9}, {0x9, 0x953, 0x5, 0x7fff}, {0x3, 0x1, 0x66, 0x8bfd}, {0x86, 0x0, 0x8a3a0004, 0x2000a}, {0x10000, 0x0, 0x4, 0xa6a}, {0x401, 0x0, 0x400009, 0x4}, {0x3, 0x2, 0x3, 0x6f5fc48f}, {0x3, 0xff, 0x3, 0x9}, {0x9bdf, 0x1, 0xfffffffd, 0xd8}]}) sysctl$hw(&(0x7f0000000000)={0x6, 0x9}, 0x2, &(0x7f00000001c0)="8e84365b469069676d813d99c8bf3c78815d88d114e784e1dbca0b35336f84fea41dd675284b1d89015e3d6db659474382efed3001226a78e235637b9503738c6b00cbebdb22adc6cf6cb832330408b6c9d7410a4444f062f061f9ac1704a0b7f971cb3c875da80cb58a95871a238a4d3d", &(0x7f0000000040)=0x71, &(0x7f0000000280), 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="b10005010000009f0500070107", 0xd, 0x404, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket(0x11, 0x3, 0x0) sendto$unix(r2, &(0x7f0000000000)="b1000504000004000000000001000000331c13fecea10500fef96ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f4d335c223e7d0c032bfa896443a42102000000720fd18bfbb61b98df192f9781ea6e2ec5890400000000008000361b4cc702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900000008e371a3f8343712051eea040000000000", 0xb1, 0x40c, 0x0, 0x0) open$dir(&(0x7f00000002c0)='./file0\x00', 0x2, 0x10) sysctl$vfs_nfs(&(0x7f00000000c0)={0xa, 0x2, 0x2}, 0x3, &(0x7f0000000240), 0x0, 0x0, 0x0) ioctl$TIOCFLUSH(r0, 0x80047476, &(0x7f0000000000)=0xfffffffb) 167.575978ms ago: executing program 7 (id=8): select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x637e) mknod(0x0, 0x2000, 0x637d) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r1 = socket(0x2, 0x2, 0x0) ioctl$FIONREAD(r1, 0xc0106924, &(0x7f00000001c0)) r2 = socket(0x18, 0x3, 0x4) ioctl$FIONREAD(r2, 0x80606955, &(0x7f0000000100)) r3 = open(&(0x7f0000000280)='./file0\x00', 0x80, 0x3cc) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x4, 0x1, 0x7, 0x6, 0x3, 0x80002001, 0x8, 0x10, [{0x0, 0x7, 0x4, 0x3}, {0x7, 0x4, 0x9, 0x7}, {0x6, 0xf86, 0x100, 0xaf9}, {0x5, 0x8, 0xb, 0x3}, {0x7, 0xfffffffb, 0xe, 0x7}, {0x2, 0x7, 0xffffffff, 0x9c}, {0x80000cdf, 0x1, 0x5, 0x6d}, {0x2000a, 0x803, 0x14, 0x4}, {0x3, 0x81, 0x1, 0x4000009}, {0x3ff, 0x8001, 0xc7, 0x87}, {0x4, 0x5, 0x9, 0x10aeb}, {0x803, 0x40, 0x1, 0x5}, {0xe0, 0x4, 0x5, 0x3ff}, {0x29a71717, 0xfffffffa, 0x6, 0x100006}, {0x4, 0x9, 0xfff}, {0x0, 0x5, 0x4, 0x30000}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r3, 0x82907003, &(0x7f0000000140)=0x2) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) ioctl$FIONBIO(r3, 0x82907003, &(0x7f0000000140)=0x1) close(r3) 160.867221ms ago: executing program 1 (id=2): open(&(0x7f0000000000)='./file0\x00', 0x615, 0x1f904bc703df0293) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) r0 = semget$private(0x0, 0x1, 0x600) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) semget$private(0x0, 0x3, 0xb0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file1\x00', 0x3, 0xff, 0xfffefffd, 0x1, 0x5, 0xd87, 0x800, 0x1, 0x2, 0x8001, 0xe}) mknod(&(0x7f0000000000)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0x120) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x637e) r3 = open(&(0x7f0000000040)='./file0\x00', 0x40, 0x100) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x4, 0x1, 0x7, 0x6, 0x3, 0x80002001, 0x7, 0x10, [{0x0, 0x7, 0x4, 0x3}, {0x7, 0x4, 0x9, 0x7}, {0x6, 0xf86, 0x100, 0x400af9}, {0x5, 0x8, 0xb, 0x3}, {0x7, 0x2, 0xe, 0x7}, {0x2, 0x7, 0x6, 0x9c}, {0x80000cdf, 0x7, 0x5, 0x6d}, {0x2000a, 0x803, 0x14, 0x4}, {0x3, 0x81, 0x1, 0x4000007}, {0x3ff, 0x8001, 0xc7, 0x87}, {0x4, 0x5, 0x9, 0x10aeb}, {0x803, 0x7, 0x4, 0x5}, {0x1, 0x4, 0x5, 0x3ff}, {0x29a7171b, 0xfffffffa, 0x6, 0x100006}, {0x4, 0x9, 0xfff}, {0x0, 0x5, 0x4, 0x30000}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r3, 0x82907003, &(0x7f0000000140)=0x2) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000200)=""/123) getrlimit(0x0, &(0x7f0000001880)) 159.705508ms ago: executing program 6 (id=7): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0xfffffff9, 0x7fff63dc, 0xfffffff8, 0x3, 0xf, 0x8007c, 0x4a, 0x10, [{0x8, 0x10000, 0xfffff115, 0x80000002}, {0x0, 0xffffffff, 0x200100, 0xfff}, {0xcd5, 0x4baa, 0x0, 0x9}, {0x6, 0x20fc, 0xf, 0x2000100}, {0x4, 0x2, 0x5, 0x1}, {0x3893, 0xfffd, 0x9, 0xeb5}, {0x10004, 0xa00, 0x3, 0xfffffffe}, {0x207, 0xffffffff, 0x228003, 0xffffe2e9}, {0x4354, 0x1000, 0x3, 0x7fff}, {0x3, 0x1, 0x7, 0x2}, {0x86, 0x0, 0x8a3a0004, 0xad}, {0x10000, 0x0, 0x4, 0xa6a}, {0x405, 0x0, 0x400009, 0x4}, {0x3, 0x2, 0x2, 0x6f5fc48f}, {0x3, 0xff, 0x3, 0x9}, {0x9be2, 0x1, 0xfffffffe, 0xb}]}) sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="b10005010000009f0500070107000000211c13fecea70500fef96ecfc72fd3007ae30200fdef3044d2d236acf20bf404be01000000f7c8cf5f8823297be1aa0504000051e2f0ad3ebbc257699a1f139b672f335c22db830c032bfa896443c32118210000720fd38bfb0000fd54c125191b1257aea8c500001602", 0x7a, 0x404, 0x0, 0x0) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x10, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x84, 0x91, 0xff, 0x43}, {0x40, 0xf6, 0xff, 0x6}, {0x16, 0x80, 0x8, 0xfffff7fe}]}) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="721e596019a332b4bf86271417a8047863375814", 0x14}], 0x1) sysctl$hw(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x1000e, &(0x7f0000000280)=ANY=[]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) ioctl$BIOCSETWF(r1, 0x80104277, &(0x7f0000000240)={0x2, &(0x7f0000000200)=[{0x0, 0x3, 0x0, 0x3}, {0xe, 0x7, 0x6, 0x8b}]}) r2 = socket(0x11, 0x3, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0) r3 = msgget$private(0x0, 0x3d2) msgsnd(r3, &(0x7f0000000d80)=ANY=[@ANYBLOB="02"], 0xe1, 0x0) madvise(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x2) sysctl$net_inet6_icmp6(&(0x7f00000022c0)={0x4, 0x18, 0x3a, 0x3}, 0x4, 0x0, 0x0, &(0x7f0000003340)="01000000", 0x4) msgrcv(r3, &(0x7f0000000e80)={0x0, ""/64}, 0x59, 0x0, 0x800) sendto$unix(r2, &(0x7f0000000000)="b1000504000004000000000001000000331c13fecea10500fef96ec0c72fd3357ae30200004e3003000000acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f4d335c223e7d0c032bfa896443a42102000000720fd18bfbb61b98df192f9781ea6e2ec5890400000000008000361b4cc702fac500002021fbfa0c0f00008abfba221554f4e0f668246c0900000008e371a3f8343712051eea040000000000", 0xb1, 0x40c, 0x0, 0x0) setsockopt$sock_int(r2, 0xffff, 0x4, &(0x7f0000000180)=0x401, 0x4) 115.169693ms ago: executing program 5 (id=6): openat$pf(0xffffffffffffff9c, &(0x7f0000000700), 0x82, 0x0) (async) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000700), 0x82, 0x0) ioctl$TIOCSETA(r0, 0xc0284457, &(0x7f0000000040)={0x2, 0xffffffff, 0x3, 0x10000000, "00000000000000000f0000ee0900", 0x6, 0xfffffff7}) r1 = socket(0x18, 0x2, 0x0) close(r1) r2 = socket(0x800000018, 0x2, 0x0) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000000c0)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200}, 0xc, 0x8001, 0x1}) r3 = socket(0x18, 0x3, 0x0) connect$unix(r3, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) getsockname$inet(r3, &(0x7f00000000c0), &(0x7f0000000000)=0xffffffffffffff35) connect$unix(r1, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) writev(r2, &(0x7f0000000240)=[{0x0}], 0x1) open$dir(&(0x7f0000000000)='.\x00', 0x100, 0xd) (async) r4 = open$dir(&(0x7f0000000000)='.\x00', 0x100, 0xd) mknodat(r4, &(0x7f0000000040)='./file0\x00', 0x2000, 0x3361) open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7949) (async) r5 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7949) ioctl$VNDIOCCLR(r5, 0xc0a86b04, &(0x7f0000000200)={0x0, 0x10000, 0x0}) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) (async) r6 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) poll(&(0x7f00000000c0)=[{r6, 0xae98cd7e8d4e801f}], 0x1, 0x9) (async) poll(&(0x7f00000000c0)=[{r6, 0xae98cd7e8d4e801f}], 0x1, 0x9) select(0x40, &(0x7f0000000340)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xffffffbffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) (async) select(0x40, &(0x7f0000000340)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xffffffbffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) kqueue() (async) kqueue() sysctl$net_inet_etherip(&(0x7f0000000080)={0x4, 0x2, 0x61, 0x1}, 0x4, &(0x7f0000000380)="301e5e421ec70b748fd6709968270351c17197e83ad4f698ccc87f380f0459d73a91207cc2", &(0x7f00000003c0)=0x25, &(0x7f0000000400)="5eccb2928ba2799d3ad06066a5247b7cf6f5ab7a235ac6f7b213658c", 0x1c) (async) sysctl$net_inet_etherip(&(0x7f0000000080)={0x4, 0x2, 0x61, 0x1}, 0x4, &(0x7f0000000380)="301e5e421ec70b748fd6709968270351c17197e83ad4f698ccc87f380f0459d73a91207cc2", &(0x7f00000003c0)=0x25, &(0x7f0000000400)="5eccb2928ba2799d3ad06066a5247b7cf6f5ab7a235ac6f7b213658c", 0x1c) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x637e) (async) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x637e) r7 = open(&(0x7f0000000280)='./file0\x00', 0x80, 0x3cc) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x1, 0x1, 0x7, 0x2, 0x3, 0x80002001, 0xa, 0x10, [{0x0, 0x400007, 0x4, 0x3}, {0x7, 0x4, 0x9, 0x7}, {0x6, 0xf86, 0x100, 0xaf9}, {0x5, 0x8, 0xb, 0x3}, {0x7, 0x10010001, 0xe, 0x7}, {0x2, 0xb, 0xffffffff, 0x9c}, {0x80000cdf, 0x1, 0x5, 0x4}, {0x2000a, 0x803, 0x14, 0x4}, {0x2, 0x81, 0x1, 0x4000009}, {0x3ff, 0x8001, 0xc4, 0x87}, {0x4, 0x5, 0x9, 0x10aeb}, {0x803, 0x40, 0x1, 0x5}, {0xe0, 0x4, 0x5, 0x3ff}, {0x29a71717, 0xfffffdfa, 0x6, 0x100006}, {0x4, 0x9, 0xffe}, {0x0, 0x5, 0x4, 0x30000}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) (async) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r7, 0x82907003, &(0x7f0000000140)=0x2) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/77, 0x4d}], 0x1, 0x1ce4000000000000) ioctl$FIONBIO(r7, 0x82907003, &(0x7f0000000140)=0x1) 113.970471ms ago: executing program 3 (id=12): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x800, 0x7, 0x2000007, 0x101, 0x80000001, 0x8004, 0x7, 0x10, [{0x1000000, 0x7, 0x0, 0x71003}, {0xd8, 0x8, 0x8, 0xfffffff9}, {0xb, 0x4, 0x0, 0x8}, {0x40000005, 0x800, 0x3}, {0xf, 0xf2b, 0x9, 0x5}, {0x40000002, 0xfffffffd, 0x8, 0x95}, {0x82ce1, 0x800, 0x5, 0x400006d}, {0x3, 0x803, 0x14, 0x5}, {0xffffffff, 0x82, 0x2, 0x9}, {0x20000004, 0x7fffffff, 0xd1b, 0x88}, {0x1d0, 0x10001, 0x2c, 0x975e616}, {0x7fc, 0x9, 0x81, 0x5}, {0x81f, 0x4, 0x6, 0xffe}, {0x29a71717, 0xfffffffa, 0x6, 0x6}, {0x10000c, 0x2, 0x6}, {0x100, 0x1, 0x4, 0xae89}]}) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x5200) (async) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x5200) open(&(0x7f0000000000)='./file0\x00', 0x80, 0x2) (async) r0 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x2) read(r0, &(0x7f0000000040)=""/30, 0x1e) (async) read(r0, &(0x7f0000000040)=""/30, 0x1e) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (async) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x2) (async) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VNDIOCSET(r1, 0xc0184406, &(0x7f00000001c0)={0x0, 0x0, 0x0}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x50}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) sysctl$kern(&(0x7f00000000c0)={0x1, 0x50}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$net_inet_ip(&(0x7f00000000c0)={0x4, 0x2, 0x0, 0x10}, 0x4, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000000)='./file1\x00', 0x2000, 0x285b9a) select(0x40, &(0x7f0000000180)={0xfffffffffffffffd, 0x5, 0x5, 0xfffffffefffffffe, 0x2000400000000000, 0x210, 0xb, 0x7}, 0x0, 0x0, 0x0) (async) select(0x40, &(0x7f0000000180)={0xfffffffffffffffd, 0x5, 0x5, 0xfffffffefffffffe, 0x2000400000000000, 0x210, 0xb, 0x7}, 0x0, 0x0, 0x0) r2 = socket(0x20, 0x5, 0x7f) bind$unix(r2, &(0x7f0000000080)=@abs={0x1f95d27d48731892, 0x7}, 0x1c) r3 = socket(0x800000018, 0x2, 0x0) setsockopt$sock_int(r3, 0xffff, 0x1000, &(0x7f0000000000)=0x7, 0x4) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x2000, 0x4800) r4 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) ioctl$TIOCFLUSH(r4, 0xc00c7006, &(0x7f0000000080)=0x500) bind$unix(r3, &(0x7f0000000080)=@abs={0x1f95d27d48731892, 0x7}, 0x1c) r5 = open(&(0x7f0000000080)='./file1\x00', 0x0, 0x132) ioctl$FIONBIO(r5, 0x82907003, &(0x7f0000000140)=0x2) 110.752447ms ago: executing program 4 (id=5): mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (async) r0 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) ioctl$WSMOUSEIO_SCALIBCOORDS(r0, 0x81205724, &(0x7f0000000100)={0x20ad, 0x6, 0x2000007, 0x5f, 0x8, 0x6, 0x80, 0x10, [{0x1000000, 0x7, 0xffffffff, 0x71003}, {0xd8, 0x5, 0x8, 0xfffffff9}, {0x0, 0x8, 0x8, 0x6}, {0x8, 0x800, 0x3, 0xfffffffd}, {0xf, 0xf2b, 0x9, 0xc}, {0x40000002, 0x1, 0x8}, {0x82ce1, 0x800, 0x9c29, 0x400006d}, {0x3, 0x803, 0x14, 0x6}, {0xffffffff, 0x82, 0x4, 0x400009}, {0x5, 0x7fffffff, 0xd1b, 0x88}, {0x1d0, 0x7, 0x2c, 0x4}, {0x7fc, 0x9, 0x8, 0x80000000}, {0x81f, 0x4, 0x4, 0xffe}, {0x29a71713, 0xfffffffa, 0x6, 0x3}, {0xc, 0x9, 0x6}, {0x0, 0x3, 0x3}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) ioctl$VNDIOCSET(r0, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async) ioctl$VNDIOCSET(r0, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f0000000380)={'tap', 0x0}) (async) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x8000, 0x2d, 0x43, 0x1}, {0x3, 0xc, 0x2, 0xb}, {0x6, 0x2, 0xa, 0xfffffffc}]}) (async) sysctl$hw(0x0, 0x0, &(0x7f00000001c0)="0060053b3d000000002dec30c221c04ca1e6904c2ffd0bc16049a26808c2a0862cbdc68e74a9355f00000000000000009823ea007a51666d56a9836fa781c711aa35f39a00d93ec82fddc2fa159c3ec3", &(0x7f0000000000)=0x50, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) ioctl$BIOCSETWF(r1, 0x80104277, &(0x7f0000000040)={0x0, 0x0}) (async) write(r1, &(0x7f0000000600)="d81ad30100060000000100000000", 0xe) (async) mknod(&(0x7f00000000c0)='./file0\x00', 0xc000, 0x4287e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) write(r2, &(0x7f0000000000)="b96abc21", 0x4) (async) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) 101.755795ms ago: executing program 2 (id=13): r0 = open(&(0x7f0000000040)='./file0\x00', 0x204, 0x0) fcntl$lock(r0, 0x9, &(0x7f0000000500)={0x3, 0x0, 0x10000000000000, 0x1000381a10087}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x80000000181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file1\x00', 0xffff0311, 0x77af, 0xb, 0x1, 0x5, 0xda7, 0x10000041, 0x1, 0x0, 0xffffffffffffff41, 0x6e37}) setrlimit(0x8, 0x0) r2 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) ioctl$FIOGETOWN(r2, 0x40047477, &(0x7f0000000040)) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x637e) r3 = open(&(0x7f0000000040)='./file0\x00', 0x40, 0x100) ioctl$FIONBIO(r3, 0x82907003, &(0x7f0000000140)=0x2) connect$unix(r3, &(0x7f0000000080)=@abs={0x1, 0x0, 0x1}, 0x8) sysctl$kern(0x0, 0x0, &(0x7f00000000c0)="3bf2ee74e747c82dad6eb2a36fa755e1a3925fe49afca7e63b52fa65ccaa74d6e6b85b6cdced70357ef201f97842b1068dca31553fa2d7031f38c03e56ad0e24dfc4f97b8b7f81499647e6e7725765d61436c85e43c15d12a78cb8c57ddde87021d7b685507fd3e0652f35e45bdaa3afd86c4fe557433e4c2b632de71c951516adff26aa2e48b45f8ce92bcefd3eceefabee7e3ebe806fdb4f6af569ae94b5d127", 0x0, 0x0, 0x0) ioctl$FIONBIO(r3, 0x82907003, &(0x7f0000000140)=0x1) close(r3) 99.230621ms ago: executing program 4 (id=14): msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0xe5, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0xc8d, 0x0, 0xffffffffffffffff, 0x0, 0x54b, 0x3, 0x6, 0x8}) r0 = socket(0x18, 0x2, 0x0) close(r0) r1 = socket(0x800000018, 0x2, 0x0) setsockopt$sock_int(r1, 0xffff, 0x1000, &(0x7f0000000240)=0x6, 0x4) ioctl$FIOASYNC(r0, 0x8004667d, &(0x7f0000000000)=0x4) bind$unix(r1, &(0x7f0000000080)=@abs={0x1f95d27d48731892, 0x7}, 0x1c) connect$unix(r0, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0xa) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0xe5, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0xc8d, 0x0, 0xffffffffffffffff, 0x0, 0x54b, 0x3, 0x6, 0x8}) (async) socket(0x18, 0x2, 0x0) (async) close(r0) (async) socket(0x800000018, 0x2, 0x0) (async) setsockopt$sock_int(r1, 0xffff, 0x1000, &(0x7f0000000240)=0x6, 0x4) (async) ioctl$FIOASYNC(r0, 0x8004667d, &(0x7f0000000000)=0x4) (async) bind$unix(r1, &(0x7f0000000080)=@abs={0x1f95d27d48731892, 0x7}, 0x1c) (async) connect$unix(r0, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0xa) (async) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) (async) 97.08854ms ago: executing program 1 (id=15): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x802, 0x6, 0x1, 0xff, 0x80000004, 0x80000003, 0x10000, 0x10, [{0x4, 0x40007, 0x4, 0x70fff}, {0x7, 0x8, 0x8, 0xfffffff9}, {0x8, 0xf86, 0x3, 0x9}, {0x8000001, 0x800, 0x8007}, {0x401, 0x200726, 0x102800, 0x7}, {0x446, 0x6, 0xffffffff, 0x99}, {0xce1, 0xffffffff, 0x4f8, 0x6d}, {0x9, 0x803, 0x14, 0x8}, {0x1, 0x82, 0x5, 0x2}, {0x5, 0x7fff, 0xd1b, 0x88}, {0x1ce, 0x10001, 0xc, 0x3}, {0x800, 0x20000b, 0x8, 0x9}, {0xb8c, 0x4, 0x8, 0x4}, {0x2ba71715, 0xfffffffa, 0x1, 0x6}, {0xc, 0x8, 0x9, 0x4}, {0x0, 0x1, 0x1002, 0x30804}]}) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000000c0)={{0x8982, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x150, 0x200}, 0x0, 0x0, 0x7}) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) r0 = socket(0x18, 0x3, 0x0) connect$unix(r0, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) getsockname$inet(r0, &(0x7f00000000c0), &(0x7f0000000000)=0xffffffffffffff35) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x6c, 0x8c, 0x2, 0x50}, {0x16, 0x2, 0x4, 0x10000000}]}) sysctl$hw(0x0, 0x0, &(0x7f0000000180)="00231b05004070632c2dec30c21761035c2532c8a0ea9200001f00385c24fc3be7b65885161be1a8", &(0x7f0000000000)=0x28, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r1, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) pledge(&(0x7f0000000100)='tty V\xef\x86\xce3|#\xcb\x13\x12\xc0\r\x9c\xe6\x00E\xbd\x81+r9\xbc\xda\f\xeb\x13\x96\xdbY\x91\x0e\x17\x95 \x00\xa6\x9ca\x00\x00\x00\x00\x00\x00\xbe\xa4kG\x01\x00\x00\x00\x00^\x00\x01\x04\x00\xeb\x91vr)\\\xf2:\'2.\xee\xb6\xd9P#\x0f\xcd\x80\x8b\xa3 \x06\xe6{\xc3\x8e\xd7bN\x81\x9ess\x13\x06\xc6\x9b\xd4\r\xfc\x85\xf8}\x9c\xc6S\xe7\x1c\xfc\xec\xb0\x18\xf5\xb4H\xf8\x9el\x03(r\xd4\x9a\x0f\f\xdb', 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000380)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb8100400086dd6880058000303b03356d0140558d3dfd766d0a62aab10b9bfe4d1aafbaf5c2c66da2acf4faeb1e580100907828"]) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r2 = open(&(0x7f0000000600)='./file0\x00', 0x0, 0x62) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x3) syz_emit_ethernet(0x5e, &(0x7f0000002c80)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd64f12819002837400000000000000000000100000000000000000000000000000000890090780000000000000000000000000000000000000000fe8000000000000000000000000000aa"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r3 = socket(0x18, 0x1, 0x0) setsockopt(r3, 0x1000000029, 0x31, &(0x7f00000001c0)="ebff8bff13924800", 0x8) connect$unix(r3, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) 5.029912ms ago: executing program 6 (id=16): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x84, 0x91, 0xff, 0x47}, {0x50, 0xf3, 0xff, 0x9}, {0x6, 0x80, 0x8, 0xfffff800}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000040)={0x0, 0x0}) write(r0, &(0x7f00000003c0)="f81ad30100060000000100000000", 0xe) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaa82001500f9fe8000000001000000040057e74f70ba9825174b0b00000000bbb3d7ca7e2f5619403effc3d2ca65ff02000000003a6f000000000000000000", @ANYBLOB="ca402b645abff2e453a0dd404f9ba55f41295c06a46d2b1242595b1f6fe1c850fbcf71367a78c482d8d836dbec183bab0f5342ef17de717aafeec291f058d83d701b477b40206b1b78376b65cb86aef876e38529e8073270f48886c368451c89130df7c03c49a6715f710b37a9bae3a77c5816b96c900f86cb70a769b249c73c0f58dd8052e656", @ANYRESOCT=0x0, @ANYRESOCT=0x0]) (async) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaa82001500f9fe8000000001000000040057e74f70ba9825174b0b00000000bbb3d7ca7e2f5619403effc3d2ca65ff02000000003a6f000000000000000000", @ANYBLOB="ca402b645abff2e453a0dd404f9ba55f41295c06a46d2b1242595b1f6fe1c850fbcf71367a78c482d8d836dbec183bab0f5342ef17de717aafeec291f058d83d701b477b40206b1b78376b65cb86aef876e38529e8073270f48886c368451c89130df7c03c49a6715f710b37a9bae3a77c5816b96c900f86cb70a769b249c73c0f58dd8052e656", @ANYRESOCT=0x0, @ANYRESOCT=0x0]) 4.514563ms ago: executing program 4 (id=17): openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) (async) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0xe5973b0c884095fe, 0x0) ioctl$TIOCSETA(r1, 0xc444443a, &(0x7f0000000740)={0x2, 0x2ab0c32f, 0x0, 0x1, "01d00bd80047c1bfdf7801f51792d200", 0x3, 0xfffffed4}) (async) ioctl$TIOCSETA(r1, 0xc444443a, &(0x7f0000000740)={0x2, 0x2ab0c32f, 0x0, 0x1, "01d00bd80047c1bfdf7801f51792d200", 0x3, 0xfffffed4}) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc5005601, &(0x7f0000000000)={0x10, 0x1000, [{&(0x7f0000462000/0x2000)=nil, &(0x7f000057e000/0x2000)=nil, 0xffffffffffffffff}, {&(0x7f0000678000/0x1000)=nil, 0x0, 0xfffffffffffffffe}, {&(0x7f00000cf000/0x4000)=nil, &(0x7f000051b000/0x2000)=nil, 0xfffffffffffffffd}, {0x0, &(0x7f00004f5000/0x4000)=nil, 0x2f}, {&(0x7f00003d5000/0x11000)=nil, &(0x7f0000181000/0x1000)=nil, 0x1}, {&(0x7f0000000000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x2}, {&(0x7f000028c000/0x4000)=nil, &(0x7f0000601000/0x4000)=nil, 0xe04}, {&(0x7f00003de000/0x4000)=nil, &(0x7f00003e3000/0xf000)=nil, 0xffdffbfffffffffe}, {&(0x7f0000065000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0xffffffffffffffff}, {&(0x7f0000523000/0x1000)=nil, &(0x7f0000063000/0x13000)=nil}, {&(0x7f0000181000/0x3000)=nil, &(0x7f0000156000/0x1000)=nil}, {&(0x7f00004b2000/0x1000)=nil, &(0x7f00004ac000/0x1000)=nil, 0x8}, {&(0x7f00004c1000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x200000002}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000361000/0x1000)=nil, 0x2}, {&(0x7f00001cf000/0x4000)=nil, &(0x7f0000463000/0x3000)=nil, 0x2}, {&(0x7f00000cf000/0x1000)=nil, &(0x7f000028b000/0x4000)=nil, 0x9}], './file0\x00'}) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x11, 0x0, 0x22}, 0x4, &(0x7f0000000000), 0x0, 0x0, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffe}, {0x2, 0x0, 0x0, 0xffffffff}, {0x7f, 0x0, 0x0, 0xbc2}]}) (async) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffe}, {0x2, 0x0, 0x0, 0xffffffff}, {0x7f, 0x0, 0x0, 0xbc2}]}) mknod(&(0x7f0000000000)='./file0\x00', 0x2060, 0xcd5331e3) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x49}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0xff0a, 0x0, 0x37) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCGDLTLIST(r0, 0xc010427b, &(0x7f0000000140)={0x0, 0x0}) (async) ioctl$BIOCGDLTLIST(r0, 0xc010427b, &(0x7f0000000140)={0x0, 0x0}) 3.320051ms ago: executing program 1 (id=18): madvise(&(0x7f000004a000/0x3000)=nil, 0x3000, 0x2) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x4) r0 = shmget(0x3, 0xe000, 0x224, &(0x7f0000fef000/0xe000)=nil) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x84, 0x91, 0xff, 0x47}, {0x40, 0xf3, 0xff, 0x9}, {0x6, 0x80, 0x8, 0xfffff7fe}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETWF(r1, 0x80104277, &(0x7f0000000040)={0x0, 0x0}) write(r1, &(0x7f00000003c0)="f81ad30100060000000100000000", 0xe) shmat(r0, &(0x7f00004a6000/0x1000)=nil, 0x3000) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r3 = socket(0x18, 0x2, 0x0) close(r3) r4 = openat$vmm(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$VMM_IOC_CREATE(r4, 0xc5005601, &(0x7f0000000000)={0x10, 0x0, [{&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil}, {&(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x530}, {&(0x7f0000ffc000/0x1000)=nil}, {0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000002000/0x2000)=nil, 0x3}, {&(0x7f0000ffc000/0x4000)=nil}, {0x0, &(0x7f0000002000/0x1000)=nil, 0x100000000}, {0x0, &(0x7f0000fff000/0x1000)=nil, 0x5}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x200001fffffc}, {&(0x7f0000000000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x2}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000001000/0x2000)=nil, 0x8}, {0x0, &(0x7f0000ffe000/0x2000)=nil, 0xfffffffffffffffd}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x2}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x7}], './file0\x00'}) sysctl$net_inet_udp(&(0x7f0000000000)={0x4, 0x2, 0x11, 0x6}, 0x4, 0x0, 0x0, 0x0, 0x0) ioctl$VMM_IOC_INTR(r4, 0xc0285602, &(0x7f0000000040)={0x1, 0x0, 0x1}) connect$unix(r3, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0xffffffffffffff33) preadv(r2, &(0x7f0000000080)=[{&(0x7f0000000480)=""/240, 0xfffffc47}, {&(0x7f00000000c0)=""/179, 0xfdac}, {&(0x7f00000002c0)=""/229, 0xe2}], 0x50, 0x0) mknod(&(0x7f0000000280)='./file0\x00', 0x4, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x2, 0x102) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r6 = socket(0x1, 0x2, 0x0) dup2(r6, r5) ioctl$FIONREAD(r6, 0xc0106924, &(0x7f00000001c0)) ioctl$FIONREAD(r5, 0xc020697e, &(0x7f0000000100)) ioctl$FIONREAD(r2, 0x4004667f, &(0x7f0000000080)) r7 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0xa3, 0x0) ioctl$BIOCSETIF(r7, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) 485.05µs ago: executing program 5 (id=19): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) (async) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000b40)={0x7ff, 0x15, 0x2000007, 0xd6f, 0x80000002, 0x80000001, 0x10001, 0x10, [{0x0, 0x10a6e, 0x99a9, 0x1071000}, {0x50, 0x0, 0x8007, 0xffffffff}, {0x8, 0x400006, 0x20004, 0x9}, {0x4b, 0x800, 0x6, 0xfffffffa}, {0x5, 0x200726, 0x27fe, 0xc}, {0x2, 0x6, 0x3, 0x9c}, {0xce1, 0xffff8000, 0x4f8, 0x6d}, {0x1, 0x6, 0xdf5, 0x2d}, {0x2, 0x7, 0x285, 0x9}, {0xc, 0x95, 0xd1f, 0xc}, {0xcf, 0x5, 0x5}, {0x7ff, 0x9, 0x744c01d5, 0x9}, {0xb85, 0x0, 0x7, 0x5}, {0x29a71717, 0xfffffffa, 0xfffffffe, 0x3}, {0x3, 0x5, 0x5, 0x7}, {0x0, 0xb1a, 0xe7, 0x30004}]}) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000b40)="825a4f47c21e6ed7eda4f5903abf65b18d7c51f78b06cc3a5840c04c2a649b0000000000fafd3493776665d4cd12c63d34", 0x31}], 0x1, 0x0, 0x0, 0x40f}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) (async) r1 = socket(0x2, 0x3, 0x0) ioctl$VMM_IOC_RUN(0xffffffffffffffff, 0xc0205602, 0x0) (async) close(r1) r2 = socket(0x2, 0x3, 0x0) close(r2) (async) r3 = socket(0x18, 0x2, 0x0) (async, rerun: 32) socket(0x18, 0x2, 0x0) (async, rerun: 32) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000000c0)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200}, 0xc, 0x8001, 0x2}) r4 = socket(0x18, 0x3, 0x0) connect$unix(r4, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) getsockname$inet(r4, &(0x7f00000000c0), &(0x7f0000000000)=0xffffffffffffff35) (async) connect$unix(r3, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) setsockopt(r2, 0x1000000029, 0x31, &(0x7f0000000000)="b211d7170d816685c8e360f2fa41c1a0946988b272d2dd3dc90142a84231a746e337b372e93320cff6669cbe7868de45ed3fc33719ca6df71ecec8a918458b2c10a1f8c66653b276e180e9cb9b21f9982230f575295d48889c9a920796b2dd92fc8575680b37ba955d2c15e6d7c9198ed900ab006ddfb67869b51a2216114d1ece85f593e74035f5bc054eb1dbddf42a", 0x90) (async) setsockopt$sock_int(r1, 0xffff, 0x1001, &(0x7f0000000100)=0x20000, 0x4) (async) write(r1, &(0x7f0000001680)="04bdfa5d1d2873c63e3534825ba166e2fea9aec43050006123339a346f731573d8d508753f95b7688ad48b8cf6bbca325cebc37fc4e1dd543dbe2da6dd", 0x1001c) (async) ioctl$TIOCSETA(r0, 0xc4504443, &(0x7f0000000740)={0x7, 0x2, 0x8, 0x2, "01d04b0a0047c1d100", 0x9, 0x3}) execve(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)=[&(0x7f0000000200)='/dev/zero\x00', &(0x7f0000000240)='/dev/ttyCcfg\x00', &(0x7f0000000280)=',^$\x00', &(0x7f00000002c0)='/dev/ttyCcfg\x00', &(0x7f0000000300)='($]*-*:-\x00', &(0x7f0000000340)='\x00', &(0x7f00000003c0)='\'\'\xf1}\\\\$\')+\x00', &(0x7f0000000400)='/dev/zero\x00', &(0x7f0000000440)='\'\xea\x00'], &(0x7f00000005c0)=[&(0x7f0000000500)='/dev/zero\x00', &(0x7f0000000540)='/dev/zero\x00', &(0x7f0000000580)='/dev/zero\x00']) (async) r5 = syz_open_pts() (async, rerun: 64) ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) (async, rerun: 64) r6 = openat$wsdisplay(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) close(r6) (async) r7 = socket(0x18, 0xc003, 0x3a) setsockopt(r7, 0x29, 0x6c, &(0x7f0000000040), 0x4) (async, rerun: 32) setsockopt$inet6_MRT6_ADD_MFC(r7, 0x29, 0x67, 0x0, 0x0) (async, rerun: 32) close(r5) 0s ago: executing program 4 (id=20): mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x70e, 0x101) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/2, 0x2}], 0x1) sysctl$net_inet6_ip6(&(0x7f0000000040)={0x4, 0x18, 0x29, 0x35}, 0x4, &(0x7f0000000080)="741ad85d9f945ecdd7e4ffffffff000063b82792b26cff2414a0dee861bd8acd0000158b318100000000c00600d513a0619527c62715f2717d78444f5b1f758ba1086cbaec45eaa62435dfb84cad60daf6779849932654afd18ea1ecc560a1a8b60fb25168df3c2fa3fe5cb65a33bbd2937fd60a86fae0f61b6d196d85d5df9c2b56f6eb45f81bbb30cb227446a42e7db2928030089049dc81a6935221df0f52430f79179b11c5ca12d402", &(0x7f0000000200)=0xfec1, 0x0, 0xd1ef4960be19f686) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts. panic: kernel diagnostic assertion "rn != NULL" failed: file "/syzkaller/managers/multicore/kernel/sys/net/pipex.c", line 459 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 107763 71785 0 0 0 0 syz-executor * 53810 83798 0 0 0x4000000 1K syz-executor db_enter() at db_enter+0x25 panic(ffffffff833b5bf3) at panic+0x1e5 __assert(ffffffff833f0cea,ffffffff8340af2f,1cb,ffffffff833a8449) at __assert+0x29 pipex_unlink_session_locked(ffff80003c401bf0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff800001590000) at pipex_destroy_all_sessions+0xd9 pppacclose(637e,81,2000,ffff8000fffee548) at pppacclose+0x16f spec_close(ffff8000317c23e0) at spec_close+0x417 VOP_CLOSE(fffffd806c782d88,81,fffffd80097fd478,ffff8000fffee548) at VOP_CLOSE+0x132 vn_closefile(fffffd8062c26188,ffff8000fffee548) at vn_closefile+0x12b fdrop(fffffd8062c26188,ffff8000fffee548) at fdrop+0x121 closef(fffffd8062c26188,ffff8000fffee548) at closef+0x192 syscall(ffff8000317c2640) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x721c40a1540, count: 2 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "rn != NULL" failed: file "/syzkaller/managers/multicore/kernel/sys/net/pipex.c", line 459 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff833b5bf3) at panic+0x1e5 __assert(ffffffff833f0cea,ffffffff8340af2f,1cb,ffffffff833a8449) at __assert+0x29 pipex_unlink_session_locked(ffff80003c401bf0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff800001590000) at pipex_destroy_all_sessions+0xd9 pppacclose(637e,81,2000,ffff8000fffee548) at pppacclose+0x16f spec_close(ffff8000317c23e0) at spec_close+0x417 VOP_CLOSE(fffffd806c782d88,81,fffffd80097fd478,ffff8000fffee548) at VOP_CLOSE+0x132 vn_closefile(fffffd8062c26188,ffff8000fffee548) at vn_closefile+0x12b fdrop(fffffd8062c26188,ffff8000fffee548) at fdrop+0x121 closef(fffffd8062c26188,ffff8000fffee548) at closef+0x192 syscall(ffff8000317c2640) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x721c40a1540, count: -13 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff8000317c21b0 rbx 0xffff8000299dee07 rdx 0xffff8000015679c0 rcx 0xffff8000fffee548 rax 0xffff8000299ddff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x15b5494e8f46cd15 r11 0x8fb12ade444676fb r12 0xffff8000299dec08 r13 0 r14 0 r15 0x1 rip 0xffffffff82ebfd25 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff8000317c21a0 ss 0 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=53810 pid=83798 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=57, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000fffee7e0,0xffff8000fffef250 process=0xffff80003c40c4f0 user=0xffff8000317bd000, vmspace=0xfffffd806c188208 estcpu=7, cpticks=2, pctcpu=0.1, user=0, sys=2, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 38937 303051 52348 0 2 0 syz-executor 38937 495781 52348 0 3 0x4000080 fsleep syz-executor 38937 500368 52348 0 2 0x4000000 syz-executor 52281 236398 55496 0 2 0 syz-executor 52281 3226 55496 0 3 0x4000080 fsleep syz-executor 71785 107763 57746 0 7 0 syz-executor 71785 11441 57746 0 2 0x4000000 syz-executor 71785 37718 57746 0 2 0x4000080 syz-executor 68818 171381 84287 0 2 0 syz-executor 68818 437456 84287 0 3 0x4000080 fsleep syz-executor 1276 181314 2660 0 2 0 syz-executor 28591 30975 33428 0 2 0 syz-executor 28591 400543 33428 0 3 0x4000080 fsleep syz-executor 28591 116421 33428 0 3 0x4000080 fsleep syz-executor 83798 95216 31772 0 3 0x80 nanoslp syz-executor *83798 53810 31772 0 7 0x4000000 syz-executor 52744 497131 65722 0 3 0x80 nanoslp syz-executor 52744 264786 65722 0 3 0x4000080 fifow syz-executor 52744 289303 65722 0 3 0x4000080 fsleep syz-executor 31772 289933 96950 0 3 0x82 nanoslp syz-executor 84287 428861 96950 0 3 0x82 nanoslp syz-executor 52348 178095 96950 0 3 0x82 nanoslp syz-executor 55496 340579 96950 0 3 0x82 nanoslp syz-executor 33428 291423 96950 0 3 0x82 nanoslp syz-executor 2660 121259 96950 0 2 0x2 syz-executor 57746 215587 96950 0 3 0x82 nanoslp syz-executor 65722 35271 96950 0 3 0x82 nanoslp syz-executor 96950 347835 14273 0 3 0x82 kqread syz-executor 14273 236339 76608 0 3 0x10008a sigsusp ksh 76608 157678 22218 0 3 0x98 kqread sshd-session 22218 466260 40811 0 3 0x92 kqread sshd-session 85417 215794 1 0 3 0x100083 ttyin getty 40811 348041 1 0 3 0x88 kqread sshd 12476 227771 79466 74 3 0x1100092 bpf pflogd 79466 311423 1 0 3 0x80 sbwait pflogd 57527 88417 16717 73 3 0x1100090 kqread syslogd 16717 110431 1 0 3 0x100082 sbwait syslogd 98071 268101 1 0 3 0x100080 kqread resolvd 56442 342578 25190 77 3 0x100092 kqread dhcpleased 23150 198572 25190 77 3 0x100092 kqread dhcpleased 25190 87186 1 0 3 0x80 kqread dhcpleased 85307 463461 0 0 3 0x14200 bored smr 80232 259839 0 0 2 0x14200 zerothread 58978 70589 0 0 3 0x14200 aiodoned aiodoned 31029 423386 0 0 3 0x14200 syncer update 20528 115416 0 0 3 0x14200 cleaner cleaner 65436 115705 0 0 3 0x14200 reaper reaper 51059 31105 0 0 3 0x14200 pgdaemon pagedaemon 80823 501741 0 0 3 0x14200 bored viomb 98258 321740 0 0 3 0x40014200 acpi0 acpi0 916 80731 0 0 3 0x40014200 idle1 89788 150385 0 0 3 0x14200 bored softnet1 23886 497336 0 0 3 0x14200 bored softnet0 59549 379663 0 0 3 0x14200 bored systqmp 42543 394493 0 0 3 0x14200 bored systq 1697 28281 0 0 3 0x14200 tmoslp softclockmp 78324 263340 0 0 3 0x40014200 tmoslp softclock 99038 514163 0 0 3 0x40014200 idle0 1 35547 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks CPU 1: exclusive mutex /syzkaller/managers/multicore/kernel/sys/net/pipex.c:78 r = 0 (0xffffffff83843a80) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 pipex_destroy_all_sessions+0x2f #3 pppacclose+0x16f #4 spec_close+0x417 #5 VOP_CLOSE+0x132 #6 vn_closefile+0x12b #7 fdrop+0x121 #8 closef+0x192 #9 syscall+0xbd4 #10 Xsyscall+0x128 Process 83798 (syz-executor) thread 0xffff8000fffee548 (53810) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff838e6f08) #0 witness_lock+0x5f1 #1 __mp_acquire_count+0x58 #2 sleep_finish+0x2d8 #3 msleep_nsec+0x132 #4 taskq_do_barrier+0x15f #5 ifiq_destroy+0xda #6 if_detach+0x7a6 #7 pppacclose+0x118 #8 spec_close+0x417 #9 VOP_CLOSE+0x132 #10 vn_closefile+0x12b #11 fdrop+0x121 #12 closef+0x192 #13 syscall+0xbd4 #14 Xsyscall+0x128 exclusive mutex /syzkaller/managers/multicore/kernel/sys/net/pipex.c:78 r = 0 (0xffffffff83843a80) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 pipex_destroy_all_sessions+0x2f #3 pppacclose+0x16f #4 spec_close+0x417 #5 VOP_CLOSE+0x132 #6 vn_closefile+0x12b #7 fdrop+0x121 #8 closef+0x192 #9 syscall+0xbd4 #10 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11053 12087K 12281K 166960K 12173 0 pcb 18 12K 12K 166960K 24 0 rtable 248 8K 8K 166960K 372 0 pf 34 17K 19K 166960K 51 0 ifaddr 43 7K 7K 166960K 47 0 ifgroup 55 2K 2K 166960K 59 0 sysctl 3 1K 9K 166960K 7 0 counters 72 37K 37K 166960K 80 0 ioctlops 0 0K 4K 166960K 1494 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1344 84K 85K 166960K 1382 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 4 0K 0K 166960K 4 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 18 65K 97K 166960K 150 0 proc 69 115K 164K 166960K 530 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 31 148K 148K 166960K 31 0 exec 0 0K 1K 166960K 374 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 246 167K 177K 166960K 3445 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 43 86K 108K 166960K 1277 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 2 0K 0K 166960K 4 0 NDP 28 2K 2K 166960K 30 0 temp 36 8666K 8730K 166960K 5836 0 kqueue 15 24K 30K 166960K 29 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 37 0 33 1 0 1 1 0 8 0 rtentry 176 111 0 1 5 0 5 5 0 8 0 unpcb 144 35 0 16 1 0 1 1 0 8 0 syncache 336 3 0 3 1 0 1 1 0 8 1 tcpcb 736 9 0 5 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 80 0 69 2 0 2 2 0 8 0 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 5 0 4 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 16 0 0 1 0 1 1 0 8 0 pfstkey 128 16 0 0 1 0 1 1 0 8 0 pfstate 448 16 0 0 2 0 2 2 0 8 0 pfrule 1344 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 452 0 0 29 0 29 29 0 8 0 art_table 40 453 0 0 5 0 5 5 0 8 0 art_node 32 111 0 11 1 0 1 1 0 8 0 sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1 semapl 112 2 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1599 0 82 96 0 96 96 0 8 0 ffsino 296 1599 0 82 118 0 118 118 0 8 0 nchpl 144 1801 0 99 64 0 64 64 0 8 0 rtmask 32 1 0 0 1 0 1 1 0 8 0 vnodes 216 1695 0 0 95 0 95 95 0 8 0 namei 1024 5399 0 5399 2 0 2 2 0 8 2 percpumem 16 55 0 4 1 0 1 1 0 8 0 kstatmem 264 30 0 4 2 0 2 2 0 8 0 scxspl 216 5891 0 5890 3 1 2 2 1 8 1 plimitpl 152 28 0 10 1 0 1 1 0 8 0 sigapl 424 459 0 411 7 0 7 7 0 8 1 knotepl 120 730 0 0 23 0 23 23 0 8 0 kqueuepl 224 30 0 18 1 0 1 1 0 8 0 pipepl 344 116 0 89 3 0 3 3 0 8 0 fdescpl 528 443 0 411 3 0 3 3 0 8 0 filepl 160 1559 0 1341 10 0 10 10 0 8 0 lockfpl 104 12 0 10 1 0 1 1 0 8 0 lockfspl 48 7 0 5 1 0 1 1 0 8 0 sessionpl 144 22 0 13 1 0 1 1 0 8 0 pgrppl 48 30 0 13 1 0 1 1 0 8 0 ucredpl 104 71 0 58 1 0 1 1 0 8 0 zombiepl 144 411 0 411 1 0 1 1 0 8 1 processpl 1232 459 0 411 5 0 5 5 0 8 0 procpl 664 495 0 436 6 0 6 6 0 8 0 sockpl 752 152 0 118 4 0 4 4 0 8 0 mcl64k 65536 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 1 0 0 1 0 1 1 0 8 0 mcl4k 4096 116 0 0 15 0 15 15 0 8 0 mcl2k 2048 19 0 0 3 0 3 3 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 118 0 0 8 0 8 8 0 8 0 bufpl 280 2351 0 126 159 0 159 159 0 8 0 anonpl 32 3950 0 0 32 0 32 32 0 246 0 amapchunkpl 152 9278 0 8777 21 0 21 21 0 158 0 amappl16 200 2069 0 2049 5 0 5 5 0 8 3 amappl15 192 6 0 6 1 0 1 1 0 8 1 amappl14 184 6 0 6 1 0 1 1 0 8 1 amappl13 176 428 0 427 1 0 1 1 0 8 0 amappl12 168 797 0 755 3 0 3 3 0 8 0 amappl11 160 11 0 10 1 0 1 1 0 8 0 amappl10 152 52 0 38 1 0 1 1 0 8 0 amappl9 144 247 0 247 1 0 1 1 0 8 1 amappl8 136 28 0 26 1 0 1 1 0 8 0 amappl7 128 76 0 75 1 0 1 1 0 8 0 amappl6 120 280 0 267 1 0 1 1 0 8 0 amappl5 112 78 0 68 1 0 1 1 0 8 0 amappl4 104 418 0 388 1 0 1 1 0 8 0 amappl3 96 1409 0 1298 4 1 3 3 0 8 0 amappl2 88 517 0 459 2 0 2 2 0 8 0 amappl1 80 9107 0 8508 15 0 15 15 0 8 1 amappl 88 2719 0 2552 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 443 0 411 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 443 0 411 1 0 1 1 0 8 0 vmmpekpl 168 5414 0 5379 2 0 2 2 0 8 0 vmmpepl 168 36448 0 34504 86 0 86 86 0 357 1 vmsppl 488 442 0 411 5 0 5 5 0 8 0 rwobjpl 80 13713 0 12694 24 0 24 24 0 8 1 pdppl 4096 893 0 822 99 12 87 87 0 8 16 pvpl 32 9600 0 0 78 0 78 78 0 265 0 pmappl 256 442 0 411 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 268 0 14 8 0 8 8 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff83824ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff838e6d00) at __mp_lock+0x192 intr_handler(ffff80003c409b70,ffff8000002a3480) at intr_handler+0xe9 Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f end of kernel end trace frame: 0x7e1ee8a83370, count: 9 ddb{0}> trace x86_ipi_db(ffffffff83824ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff838e6d00) at __mp_lock+0x192 intr_handler(ffff80003c409b70,ffff8000002a3480) at intr_handler+0xe9 Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f end of kernel end trace frame: 0x7e1ee8a83370, count: -6 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff833b5bf3) at panic+0x1e5 __assert(ffffffff833f0cea,ffffffff8340af2f,1cb,ffffffff833a8449) at __assert+0x29 pipex_unlink_session_locked(ffff80003c401bf0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff800001590000) at pipex_destroy_all_sessions+0xd9 pppacclose(637e,81,2000,ffff8000fffee548) at pppacclose+0x16f spec_close(ffff8000317c23e0) at spec_close+0x417 VOP_CLOSE(fffffd806c782d88,81,fffffd80097fd478,ffff8000fffee548) at VOP_CLOSE+0x132 vn_closefile(fffffd8062c26188,ffff8000fffee548) at vn_closefile+0x12b fdrop(fffffd8062c26188,ffff8000fffee548) at fdrop+0x121 closef(fffffd8062c26188,ffff8000fffee548) at closef+0x192 syscall(ffff8000317c2640) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x721c40a1540, count: 2 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff833b5bf3) at panic+0x1e5 __assert(ffffffff833f0cea,ffffffff8340af2f,1cb,ffffffff833a8449) at __assert+0x29 pipex_unlink_session_locked(ffff80003c401bf0) at pipex_unlink_session_locked+0x429 pipex_destroy_all_sessions(ffff800001590000) at pipex_destroy_all_sessions+0xd9 pppacclose(637e,81,2000,ffff8000fffee548) at pppacclose+0x16f spec_close(ffff8000317c23e0) at spec_close+0x417 VOP_CLOSE(fffffd806c782d88,81,fffffd80097fd478,ffff8000fffee548) at VOP_CLOSE+0x132 vn_closefile(fffffd8062c26188,ffff8000fffee548) at vn_closefile+0x12b fdrop(fffffd8062c26188,ffff8000fffee548) at fdrop+0x121 closef(fffffd8062c26188,ffff8000fffee548) at closef+0x192 syscall(ffff8000317c2640) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x721c40a1540, count: -13