last executing test programs: 3m16.212281038s ago: executing program 2 (id=541): open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x80, 0x1c4) ftruncate(r0, 0x3862) 3m16.187318928s ago: executing program 2 (id=542): fork() madvise(&(0x7f0000fff000/0x1000)=nil, 0x82121b000, 0x3) 3m15.970305975s ago: executing program 2 (id=554): open(0x0, 0x1, 0x118) r0 = semget$private(0x0, 0x4, 0x60) semop(r0, &(0x7f0000000000)=[{0x0, 0x7f, 0x800}, {0x0, 0xfff7, 0x1800}, {0x2, 0x5, 0x1000}, {0x0, 0x9, 0x1000}], 0x4) 3m15.877292769s ago: executing program 2 (id=557): r0 = socket$inet6_tcp(0x1c, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FUNCTION_BLK(r0, 0x6, 0x2000, &(0x7f0000000040)={'bbr\x00', 0xd}, 0x24) getsockopt$inet6_tcp_buf(r0, 0x6, 0x23, &(0x7f0000002680)=""/4088, &(0x7f0000000000)=0x148) 3m15.840143806s ago: executing program 2 (id=559): freebsd11_mknod(&(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x672cda28f543e327, 0x1) freebsd11_stat(&(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) open$dir(&(0x7f0000000140)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x80, 0xa) 3m15.822250721s ago: executing program 2 (id=561): setuid(0xee01) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SMB_BREAD(r0, 0xc020695b, &(0x7f0000000080)={0x0, 0x0, 0x0, @buf="a40d", @buf="db05", 0x0, 0x0, 0x0, 0x0}) 3m15.714873801s ago: executing program 32 (id=561): setuid(0xee01) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SMB_BREAD(r0, 0xc020695b, &(0x7f0000000080)={0x0, 0x0, 0x0, @buf="a40d", @buf="db05", 0x0, 0x0, 0x0, 0x0}) 3m9.312641906s ago: executing program 4 (id=791): r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x40000400000002c2, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000180), 0x81706}], 0x1000000000000013) copy_file_range(r0, &(0x7f0000000000)=0x2, r0, 0x0, 0xfefffffffffffffd, 0x0) 3m8.86606527s ago: executing program 4 (id=797): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) seteuid(0xffffffffffffffff) getsockopt$inet_buf(r0, 0x0, 0x6e, 0x0, 0x0) 3m8.841539052s ago: executing program 4 (id=798): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreqn(r0, 0x0, 0x2, &(0x7f0000000040)={@loopback}, 0xc) sendto$inet(r0, &(0x7f0000000080)="05130014fc9de0d29faa575313574bed4f85a723", 0x14, 0x0, &(0x7f0000000000)={0x10}, 0x10) 3m8.819983747s ago: executing program 4 (id=799): r0 = socket(0x2, 0x3, 0x8) connect$inet(r0, &(0x7f00000000c0)={0x34, 0x2, 0x2, @rand_addr=0xfffffffe}, 0x10) sendmsg$inet6_sctp(r0, &(0x7f00000002c0)={&(0x7f0000000280)=@in={0x10, 0x2, 0x1, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x0) 3m8.800217113s ago: executing program 4 (id=800): extattr_get_link(&(0x7f0000000040)='./file0\x00', 0x3, &(0x7f0000000100)='$*\x00', 0x0, 0x0) freebsd11_mknod(&(0x7f0000000980)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x672cda28f543e327, 0x0) getfh(&(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) 3m8.762459536s ago: executing program 4 (id=801): thr_self(&(0x7f0000001d80)=0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1, 0x1010, 0xffffffffffffffff, 0x0) rtprio_thread(0x1, r0, &(0x7f0000000080)={0x4, 0x13}) 3m8.752647021s ago: executing program 33 (id=801): thr_self(&(0x7f0000001d80)=0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1, 0x1010, 0xffffffffffffffff, 0x0) rtprio_thread(0x1, r0, &(0x7f0000000080)={0x4, 0x13}) 2m0.143075477s ago: executing program 5 (id=3140): ioctl$BIOCSETF(0xffffffffffffffff, 0x80084267, &(0x7f0000000340)={0x1, &(0x7f0000000300)=[{0x1e, 0x1, 0x3, 0xa}]}) openat$crypto(0xffffff9c, &(0x7f0000000240), 0x4, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x5) linkat(0xffffffffffffff9c, &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0) 2m0.105555647s ago: executing program 5 (id=3143): r0 = socket(0x1c, 0x1, 0x0) r1 = kqueue() kevent(r1, &(0x7f0000000080)=[{0x3, 0xfffffffffffffff3, 0xc023, 0x0, 0x0, 0x0, [0x0, 0x4000000]}], 0x1, 0x0, 0x300, 0x0) sendto(r0, &(0x7f0000000200)='R', 0x1, 0x180, &(0x7f0000000240)=@in6={0x1c, 0x1c, 0x1, 0xfffffffb, @empty, 0x34e32fe8}, 0x1c) 1m59.921552696s ago: executing program 5 (id=3154): pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) write(r1, &(0x7f0000000140)='\x00', 0xfe80) poll(&(0x7f0000000680)=[{r1, 0x15}], 0x1, 0x10000008) dup2(r0, r1) 1m59.759168815s ago: executing program 5 (id=3159): r0 = socket$inet6_icmp_raw(0x1c, 0x3, 0x3a) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0x1c, 0x1c, 0x1, 0x5, @loopback, 0x7}, 0x1c) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x30, &(0x7f0000000080)=ANY=[], 0x38) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x3, 0xfffffffe, @rand_addr="000000000000000100606000000200", 0x100}, 0x1c) 1m59.74114977s ago: executing program 5 (id=3161): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) chflags(&(0x7f0000000080)='./file0\x00', 0x119304) mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000280)='./file0/file0\x00') 1m59.694966659s ago: executing program 5 (id=3164): mkdir(&(0x7f00000001c0)='./file0\x00', 0x39) mkdir(&(0x7f0000000040)='./file0/file0\x00', 0x14c) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) freebsd11_fstatat(r0, &(0x7f0000000000)='./file0/file0/..\x00', 0x0, 0x6000) 1m59.686011294s ago: executing program 34 (id=3164): mkdir(&(0x7f00000001c0)='./file0\x00', 0x39) mkdir(&(0x7f0000000040)='./file0/file0\x00', 0x14c) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) freebsd11_fstatat(r0, &(0x7f0000000000)='./file0/file0/..\x00', 0x0, 0x6000) 3.010144144s ago: executing program 0 (id=5226): r0 = getpid() procctl$PROC_REAP_ACQUIRE(0x0, r0, 0x2, 0x2) vfork() lio_listio(0x0, 0x0, 0x0, &(0x7f00000047c0)={0x1, 0x8, @sigval_int, @spare}) r1 = getpid() procctl$PROC_REAP_RELEASE(0x0, r1, 0x3, 0x3) 2.986485086s ago: executing program 0 (id=5229): r0 = fork() wait4(r0, 0x0, 0x2, 0x0) r1 = socket(0x1c, 0x1, 0x0) r2 = openat$crypto(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) aio_readv(&(0x7f0000000400)={r2, 0x0, &(0x7f00000001c0)="5b04", 0x2, [0xfffffffc, 0xffffffff], 0x5, 0x0, 0x3, {0x0, 0xfffffffe, 0x0}, {0x0, 0x0, @sival_ptr=0xf9f, @spare=[0x3ea6205d, 0x200000, 0x1, 0x400, 0xfbf, 0x2, 0xd, 0x1040]}}) ioctl$KDGETMODE(r1, 0x40046676, 0x22e00000) 2.702909683s ago: executing program 3 (id=5236): aio_waitcomplete(0x0, 0x0) r0 = socket(0x1c, 0x1, 0x0) r1 = socket$inet6_icmp_raw(0x1c, 0x3, 0x3a) recvmsg(r1, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}, 0xa86a7001833bc1f6) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 1.984554504s ago: executing program 1 (id=5237): r0 = open$dir(&(0x7f0000000300)='.\x00', 0x80, 0x4a) setgid(0xffffffffffffffff) setgroups(0x0, 0x0) fchmod(r0, 0xf3) setuid(0xffffffffffffffff) open$dir(&(0x7f0000000040)='./file0\x00', 0x200, 0x7369a0733676a8) 1.9837626s ago: executing program 0 (id=5245): preadv(0xffffffffffffffff, &(0x7f0000003b40)=[{0x0}], 0x1, 0x10001) fork() aio_suspend(0x0, 0x0, &(0x7f0000002940)={0x7, 0x9}) fork() open$dir(&(0x7f0000000180)='./file0\x00', 0x40000400000002c6, 0x0) msync(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2) 1.912421878s ago: executing program 1 (id=5238): chroot(0x0) setgroups(0x0, 0x0) openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = shm_open2(&(0x7f0000000000)='./file0\x00', 0x200, 0x4, 0x5, 0x0) fstat(r0, 0x0) 1.900504951s ago: executing program 6 (id=5239): r0 = getpid() procctl$PROC_REAP_ACQUIRE(0x0, r0, 0x2, 0x2) vfork() lio_listio(0x0, 0x0, 0x0, &(0x7f00000047c0)={0x1, 0x8, @sigval_int, @spare}) r1 = getpid() procctl$PROC_REAP_RELEASE(0x0, r1, 0x3, 0x3) 1.899615461s ago: executing program 0 (id=5240): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socket(0x1, 0x5, 0xfc) socket$inet6_udp(0x1c, 0x2, 0x0) r1 = kqueue() __specialfd$inotify(0x2, &(0x7f00000002c0), 0x4) sendmsg$unix(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@rights={0x10, 0xffff, 0x1, [r1]}], 0x10, 0x8}, 0x8) 1.877780535s ago: executing program 0 (id=5241): mkdir(&(0x7f0000001040)='./file0\x00', 0x1) r0 = open$dir(&(0x7f0000000080)='.\x00', 0x2000000, 0x0) r1 = open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x0) fchflags(r0, 0x40004) mkdirat(r1, &(0x7f00000001c0)='./file1\x00', 0x0) renameat(r0, &(0x7f0000000040)='./file1\x00', r1, &(0x7f0000000180)='./file0\x00') 1.861852637s ago: executing program 1 (id=5242): r0 = socket$inet6_udp(0x1c, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000140)={0x1c, 0x1c, 0x2, 0x0, @mcast1}, 0x1c) r1 = socket$inet6_udp(0x1c, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1b, &(0x7f00000001c0), 0x4) bind$inet6(r1, &(0x7f0000000140)={0x1c, 0x1c, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr}}, 0x1c) rfork(0x1000) 1.827934064s ago: executing program 0 (id=5243): setuid(0xee01) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000300)={0x2, &(0x7f00000000c0)=[{}, {0x1}]}) r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) symlinkat(0x0, r0, 0x0) r1 = msgget$private(0x0, 0x206) msgrcv(r1, 0x0, 0x0, 0x0, 0x1000) 1.814235408s ago: executing program 35 (id=5243): setuid(0xee01) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000300)={0x2, &(0x7f00000000c0)=[{}, {0x1}]}) r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) symlinkat(0x0, r0, 0x0) r1 = msgget$private(0x0, 0x206) msgrcv(r1, 0x0, 0x0, 0x0, 0x1000) 1.801491014s ago: executing program 1 (id=5247): rfork(0x85000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="04010000ffff000001"], 0x104}, 0x0) openat$crypto(0xffffff9c, &(0x7f0000000040), 0x10000, 0x0) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=""/25, 0x19}, 0x80) vfork() 1.801129307s ago: executing program 6 (id=5248): r0 = fork() wait4(r0, 0x0, 0x2, 0x0) r1 = socket(0x1c, 0x1, 0x0) r2 = openat$crypto(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) aio_readv(&(0x7f0000000400)={r2, 0x0, &(0x7f00000001c0)="5b04", 0x2, [0xfffffffc, 0xffffffff], 0x5, 0x0, 0x3, {0x0, 0xfffffffe, 0x0}, {0x0, 0x0, @sival_ptr=0xf9f, @spare=[0x3ea6205d, 0x200000, 0x1, 0x400, 0xfbf, 0x2, 0xd, 0x1040]}}) ioctl$KDGETMODE(r1, 0x40046676, 0x22e00000) 1.797542309s ago: executing program 3 (id=5249): r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) listen(r0, 0xb7c5) freebsd10_pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) accept4(r0, 0x0, 0x0, 0x0) fcntl$setstatus(r2, 0x4, 0x40) 857.430756ms ago: executing program 6 (id=5250): preadv(0xffffffffffffffff, &(0x7f0000003b40)=[{0x0}], 0x1, 0x10001) fork() aio_suspend(0x0, 0x0, &(0x7f0000002940)={0x7, 0x9}) fork() open$dir(&(0x7f0000000180)='./file0\x00', 0x40000400000002c6, 0x0) msync(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2) 856.012735ms ago: executing program 3 (id=5251): setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x48, &(0x7f0000000140)={@multicast1, @multicast2, @broadcast}, 0xc) fork() mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0xa, &(0x7f0000000140)={0x0, {{0x10, 0x2, 0x2, @local={0xac, 0x14, 0x0}}}, {{0x10, 0x2, 0x1, @rand_addr=0xfffffffe}}}, 0x108) 779.806155ms ago: executing program 3 (id=5252): r0 = socket$inet6(0x1c, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0x1c, 0x1c, 0x0, 0x825, @loopback, 0x20}, 0x1c) r1 = socket$inet6(0x1c, 0x1, 0x0) setsockopt(r1, 0x29, 0x40, &(0x7f0000000000)="60c6eabb", 0x4) bind$inet6(r1, &(0x7f0000000080)={0x1c, 0x1c, 0x0, 0x7, @rand_addr="020008fbd0f1e92d7ccdc1002000"}, 0x1c) sendmsg$inet6_sctp(r1, &(0x7f0000000480)={&(0x7f0000000100)=@in6={0x21, 0x1c, 0x0, 0x9, @loopback={0x0, 0xfffffffffffffffe}, 0xffffffff}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x20184}, 0x80) 759.100921ms ago: executing program 3 (id=5253): r0 = open$dir(&(0x7f0000000240)='./file0\x00', 0x40000400000002c2, 0x0) r1 = open$dir(&(0x7f0000000840)='./file1\x00', 0x40000400000002c2, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x0) copy_file_range(r1, 0x0, r0, 0x0, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000280)='./file0\x00', 0x40000400001803c1, 0x3f) copy_file_range(r0, 0x0, r2, 0x0, 0xffffffffffffffff, 0x0) 664.102202ms ago: executing program 1 (id=5254): mkdir(&(0x7f0000001040)='./file0\x00', 0x1) r0 = open$dir(&(0x7f0000000080)='.\x00', 0x2000000, 0x0) r1 = open$dir(&(0x7f0000000080)='.\x00', 0x0, 0x0) fchflags(r0, 0x40004) mkdirat(r1, &(0x7f00000001c0)='./file1\x00', 0x0) renameat(r0, &(0x7f0000000040)='./file1\x00', r1, &(0x7f0000000180)='./file0\x00') 662.479626ms ago: executing program 6 (id=5255): bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0x1c, 0x1c, 0x1, 0x0, @empty, 0x30}, 0x1c) setreuid(0xee00, 0x0) r0 = getuid() setreuid(r0, r0) r1 = socket(0x1c, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@abs={0x8, 0x1c}, 0x1c) 488.521009ms ago: executing program 1 (id=5256): r0 = getpid() procctl$PROC_REAP_ACQUIRE(0x0, r0, 0x2, 0x2) vfork() lio_listio(0x0, 0x0, 0x0, &(0x7f00000047c0)={0x1, 0x8, @sigval_int, @spare}) r1 = getpid() procctl$PROC_REAP_RELEASE(0x0, r1, 0x3, 0x3) 488.376173ms ago: executing program 36 (id=5256): r0 = getpid() procctl$PROC_REAP_ACQUIRE(0x0, r0, 0x2, 0x2) vfork() lio_listio(0x0, 0x0, 0x0, &(0x7f00000047c0)={0x1, 0x8, @sigval_int, @spare}) r1 = getpid() procctl$PROC_REAP_RELEASE(0x0, r1, 0x3, 0x3) 472.52673ms ago: executing program 6 (id=5257): kqueue() r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x40000400000002c2, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000180), 0x81706}], 0x1000000000000013) copy_file_range(r0, &(0x7f0000000000)=0xaa4, r0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) select(0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)) 41.996256ms ago: executing program 6 (id=5258): sigaction(0xc, &(0x7f0000000200)={&(0x7f0000000180)="f30f2dadad000000c4e1f55f9b00080000f08794a0e4553810c4e2e5bf51c63e263e660f380755b1c4e189c1a240490000c481fe700600660f3a41828bcf0000def3ec326de3516cb69989999908", 0x36, {[0xfffff801, 0x50e5, 0xfdffffff, 0x5]}}, 0x0) lgetfh(0x0, 0x0) lgetfh(0x0, 0x0) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000400001803c1, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000006c0), 0xf0f75}], 0x1, 0x0) lio_listio(0x0, 0x0, 0x0, &(0x7f0000002c00)={0x1, 0x13, @sigval_int=0x5, @ke_flags=0x8018}) 0s ago: executing program 3 (id=5265): r0 = socket$inet6_udp(0x1c, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000140)={0x1c, 0x1c, 0x2, 0x0, @mcast1}, 0x1c) r1 = socket$inet6_udp(0x1c, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1b, &(0x7f00000001c0), 0x4) bind$inet6(r1, &(0x7f0000000140)={0x1c, 0x1c, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr}}, 0x1c) rfork(0x1000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.209' (ED25519) to the list of known hosts. md0: truncating fractional last sector by 3 bytes md1: truncating fractional last sector by 8 bytes Oct 22 07:05:48 ci-freebsd-i386-3 kernel: pid 1124 (syz-executor), jid 0, uid 0, was killed: exceeded maximum CPU limit md2: truncating fractional last sector by 2047 bytes if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 ip6_pcbopts: all specified options are cleared. ip6_pcbopts: all specified options are cleared. md3: truncating fractional last sector by 249 bytes if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 Out of ktrace request objects. if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 lock order reversal: (sleepable after non-sleepable) 1st 0xfffffe006de40808 tun_mtx (tun_mtx, sleep mutex) @ /syzkaller/managers/i386/kernel/sys/net/if_tuntap.c:1690 2nd 0xffffffff83cdea40 tun_ioctl (tun_ioctl, sx) @ /syzkaller/managers/i386/kernel/sys/net/if_tuntap.c:1389 lock order tun_ioctl -> tun_mtx established at: #0 0xffffffff81686821 at witness_checkorder+0x781 #1 0xffffffff8150b387 at __mtx_lock_flags+0x187 #2 0xffffffff8187100c at tunifioctl+0x15c #3 0xffffffff8184c23e at ifhwioctl+0xefe #4 0xffffffff81850432 at ifioctl+0xde2 #5 0xffffffff8169560a at kern_ioctl+0x52a #6 0xffffffff81694fee at sys_ioctl+0x36e #7 0xffffffff8216d8b2 at amd64_syscall+0x4e2 #8 0xffffffff82112acb at fast_syscall_common+0xf8 lock order tun_mtx -> tun_ioctl attempted at: #0 0xffffffff816876f2 at witness_checkorder+0x1652 #1 0xffffffff81575049 at _sx_xlock+0x139 #2 0xffffffff81870f3a at tunifioctl+0x8a #3 0xffffffff8184d0eb at ifhwioctl+0x1dab #4 0xffffffff8186e9a2 at tunioctl+0xd92 #5 0xffffffff811e0d96 at devfs_ioctl+0x266 #6 0xffffffff82330287 at VOP_IOCTL_APV+0x87 #7 0xffffffff817f3507 at vn_ioctl+0x3c7 #8 0xffffffff811e1c59 at devfs_ioctl_f+0x69 #9 0xffffffff8169560a at kern_ioctl+0x52a #10 0xffffffff81694fee at sys_ioctl+0x36e #11 0xffffffff80442dd7 at freebsd32_ioctl+0x607 #12 0xffffffff822f81b2 at ia32_syscall+0x4d2 #13 0xffffffff8211332f at int0x80_syscall_common+0x9c md2147483519: truncating fractional last sector by 3 bytes if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 Expensive callout(9) function: 0xffffffff81a62070(0xfffffe0058708060) 0.002141765 s if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f4800 ip6_pcbopts: all specified options are cleared. ip6_pcbopts: all specified options are cleared. if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 Expensive callout(9) function: 0xffffffff81498500(0xfffffe006ddfc3c0) 0.003166107 s if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe005859f000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe005859f000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 vnode_pager_putpages: zero-length write at 0 resid 2002 0xfffffe007d2366e0: type VREG state VSTATE_CONSTRUCTED op 0xffffffff8371cba0 usecount 2, writecount 2, refcount 3 seqc users 0 hold count flags () flags (VIRF_PGREAD|VMP_LAZYLIST) v_object 0xfffffe007d443d90 ref 1 pages 1 cleanbuf 1 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe00541d6780 (pid 4909, syz-executor, tid 104572) nlink=1, effnlink=1, size=2002, extsize=0 generation=a809a161, uid=0, gid=0, flags=0x4 ino 123, on dev gpt/rootfs vnode_pager_putpages: zero-length write at 0 resid 2002 0xfffffe007a446a50: type VREG state VSTATE_CONSTRUCTED op 0xffffffff8371cba0 usecount 2, writecount 2, refcount 3 seqc users 0 hold count flags () flags (VIRF_PGREAD|VMP_LAZYLIST) v_object 0xfffffe007d44a2e8 ref 1 pages 1 cleanbuf 1 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe007d453780 (pid 4946, syz-executor, tid 104627) nlink=1, effnlink=1, size=2002, extsize=0 generation=90a79ce9, uid=0, gid=0, flags=0x4 ino 109, on dev gpt/rootfs if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe005859f000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 md127: truncating fractional last sector by 6 bytes if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f6000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077f5000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a0000 md19: truncating fractional last sector by 129 bytes if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 if_delmulti_locked: detaching ifnet instance 0xfffffe00585a1800 ifconfig: interface tap7 does not exist kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) kldload: can't load if_tap: module already loaded or in kernel SYZFAIL: tun: can't open device device=/dev/tap7 (errno 2: No such file or directory) SYZFAIL: repeatedly failed to execute the program proc=7 req=5244 state=1 status=67 (errno 9: Bad file descriptor) FreeBSD/amd64 (ci-freebsd-i386-3.us-central1-b.c.syzkaller.internal) (ttyu0) login: set $lines = 0 Password: Login incorrect login: show registers Password: Login incorrect login: ps Jan 1 02:36:37 ci-freebsd-i386-3 login[747]: 2 LOGIN FAILURES ON ttyu0 Password: Login incorrect login: show malloc Password: Login incorrect show all tcpcbs/bl