last executing test programs:

274.570971ms ago: executing program 1 (id=2):
fcntl$lock(0xffffffffffffffff, 0x9, &(0x7f00000000c0)={0x1, 0x1, 0x8000, 0x100000000000000}) (async)
fcntl$lock(0xffffffffffffffff, 0x9, &(0x7f00000000c0)={0x1, 0x1, 0x8000, 0x100000000000000})
sysctl$net_inet_tcp(0x0, 0x0, &(0x7f00000000c0)="9b180bc3eb987ab7fe", 0x0, 0x0, 0x0)
ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x4000000000000003}}) (async)
ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x4000000000000003}})
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) (async)
syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"])
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r0 = socket(0x2, 0x2, 0x0)
connect$unix(r0, &(0x7f0000000000), 0x10) (async)
connect$unix(r0, &(0x7f0000000000), 0x10)
r1 = socket(0x18, 0x1, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x8, 0x0) (async)
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x8, 0x0)
clock_getres(0x6, 0x0)
poll(&(0x7f0000000000)=[{r2, 0x4}], 0x1, 0x2)
r3 = socket(0x11, 0x3, 0x0)
setsockopt$sock_timeval(r3, 0xffff, 0x1005, &(0x7f00000001c0)={0x9, 0x9}, 0x10)
getsockopt$sock_timeval(r3, 0xffff, 0x1005, &(0x7f0000000000), &(0x7f0000000040)=0x10)
close(r2) (async)
close(r2)
close(r1)
r4 = socket(0x18, 0x1, 0x0)
setsockopt(r4, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14)
connect$unix(r1, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c)

0s ago: executing program 1 (id=9):
r0 = kqueue()
mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, 0xc811, r0, 0x9)
readv(r0, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/236, 0xec}, {&(0x7f0000000100)=""/81, 0x51}, {&(0x7f0000000180)=""/112, 0x70}, {&(0x7f0000000200)=""/193, 0xc1}, {&(0x7f0000000300)=""/159, 0x9f}], 0x5)
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000440))
getpeername$inet6(r1, &(0x7f0000000480), &(0x7f00000004c0)=0x1c)
r2 = dup2(r0, r0)
r3 = socket$inet6(0x18, 0x3, 0x1)
kevent(r0, &(0x7f0000000500)=[{{r2}, 0xfffffffffffffff8, 0x82, 0x40, 0xc059, 0x9e}, {{r3}, 0xfffffffffffffffa, 0x2, 0x20, 0x8, 0x4}, {{r1}, 0xfffffffffffffff6, 0xa8, 0x1, 0x6, 0xaf}, {{r1}, 0xfffffffffffffffd, 0x10, 0x1, 0x5, 0xcd}], 0x6618, &(0x7f0000000580)=[{{r1}, 0xfffffffffffffffd, 0x1a, 0x20, 0x7, 0x8}], 0x1ff, &(0x7f00000005c0)={0xf34b, 0x7215}) (async)
kevent(r0, &(0x7f0000000500)=[{{r2}, 0xfffffffffffffff8, 0x82, 0x40, 0xc059, 0x9e}, {{r3}, 0xfffffffffffffffa, 0x2, 0x20, 0x8, 0x4}, {{r1}, 0xfffffffffffffff6, 0xa8, 0x1, 0x6, 0xaf}, {{r1}, 0xfffffffffffffffd, 0x10, 0x1, 0x5, 0xcd}], 0x6618, &(0x7f0000000580)=[{{r1}, 0xfffffffffffffffd, 0x1a, 0x20, 0x7, 0x8}], 0x1ff, &(0x7f00000005c0)={0xf34b, 0x7215})
kill(0xffffffffffffffff, 0xa)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000700)={&(0x7f0000000600)=[0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0], 0x2, 0x4, 0x9, 0x4, 0x4, 0x0, 0x1ff, 0x3}) (async)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000700)={&(0x7f0000000600)=[0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0], 0x2, 0x4, 0x9, 0x4, 0x4, 0x0, 0x1ff, 0x3})
ioctl$DIOCRSETTFLAGS(r2, 0xc450444a, &(0x7f0000000740)={{'./file0\x00', './file0\x00', 0x1, 0xfb}, 0x0, 0x0, 0x0, 0xdd9, 0x5e, 0xa4, 0x0, 0xa, 0x2}) (async)
ioctl$DIOCRSETTFLAGS(r2, 0xc450444a, &(0x7f0000000740)={{'./file0\x00', './file0\x00', 0x1, 0xfb}, 0x0, 0x0, 0x0, 0xdd9, 0x5e, 0xa4, 0x0, 0xa, 0x2})
ioctl$DIOCCLRIFFLAG(r2, 0xc028445a, &(0x7f0000000c00)={'./file0\x00', &(0x7f0000000bc0)=""/61, 0x4, 0x5, 0x9c}) (async)
ioctl$DIOCCLRIFFLAG(r2, 0xc028445a, &(0x7f0000000c00)={'./file0\x00', &(0x7f0000000bc0)=""/61, 0x4, 0x5, 0x9c})
ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000c40)=0x9a4d)
execve(&(0x7f0000000c80)='./file0\x00', &(0x7f0000000dc0)=[&(0x7f0000000cc0)=']$(\x00', &(0x7f0000000d00)=')\\.\'\'{\x00', &(0x7f0000000d40)=']-{:(\x00', &(0x7f0000000d80)='\x00'], &(0x7f0000001040)=[&(0x7f0000000e00)='\x00', &(0x7f0000000e40)='\x00', &(0x7f0000000e80)='\x00', &(0x7f0000000ec0)=']{(+#:-,/\x00', &(0x7f0000000f00)='\x00', &(0x7f0000000f40)='\x00', &(0x7f0000000f80)='!^),@&\\\x00', &(0x7f0000000fc0)='\x00', &(0x7f0000001000)=')--\x00'])
r4 = openat$zero(0xffffffffffffff9c, &(0x7f00000010c0), 0x80, 0x0)
ioctl$DIOCIGETIFACES(r4, 0xc0284457, &(0x7f00000011c0)={'./file0\x00', &(0x7f0000001100)=""/146, 0x3, 0x7, 0x7fff, 0x29e})
unveil(&(0x7f0000001200)='./file0\x00', &(0x7f0000001240)='x\x00') (async)
unveil(&(0x7f0000001200)='./file0\x00', &(0x7f0000001240)='x\x00')
bind$inet6(r4, &(0x7f0000001280)={0x1c, 0x18, 0x3, 0xc, "8f049db3ccd356d69a7e30c6083a81a3"}, 0x1c)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f00000012c0)={0x454, 0x7, r2}) (async)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f00000012c0)={0x454, 0x7, r2})
r5 = msgget(0x3, 0x4)
getrlimit(0xf, &(0x7f0000001300))
preadv(r1, &(0x7f0000002880)=[{&(0x7f0000001340)=""/18, 0x12}, {&(0x7f0000001380)=""/134, 0x86}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f0000002540)=""/183, 0xb7}, {&(0x7f0000002600)=""/243, 0xf3}, {&(0x7f0000002700)=""/153, 0x99}, {&(0x7f00000027c0)=""/143, 0x8f}], 0x8, 0x7) (async)
preadv(r1, &(0x7f0000002880)=[{&(0x7f0000001340)=""/18, 0x12}, {&(0x7f0000001380)=""/134, 0x86}, {&(0x7f0000001440)=""/249, 0xf9}, {&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f0000002540)=""/183, 0xb7}, {&(0x7f0000002600)=""/243, 0xf3}, {&(0x7f0000002700)=""/153, 0x99}, {&(0x7f00000027c0)=""/143, 0x8f}], 0x8, 0x7)
msgsnd(r5, &(0x7f0000002900)={0x1, "527f1ff00fec8768fd710956e1a222233a09617bd3b280406f4b1387277281235bd9cce5b42a91ca5ab907d1e54c86467ab08e820172c47d0adc0f60884a77fccb9b20214629cf"}, 0x4f, 0x800) (async)
msgsnd(r5, &(0x7f0000002900)={0x1, "527f1ff00fec8768fd710956e1a222233a09617bd3b280406f4b1387277281235bd9cce5b42a91ca5ab907d1e54c86467ab08e820172c47d0adc0f60884a77fccb9b20214629cf"}, 0x4f, 0x800)
openat$pf(0xffffffffffffff9c, &(0x7f0000002980), 0x10, 0x0) (async)
r6 = openat$pf(0xffffffffffffff9c, &(0x7f0000002980), 0x10, 0x0)
ioctl$DIOCGETSYNFLWATS(r6, 0xc0084463, &(0x7f00000029c0))
faccessat(r0, &(0x7f0000002a00)='./file0\x00', 0xb1, 0x3)
msgget(0x2, 0x400)
mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000)
r7 = socket$inet6(0x18, 0x1, 0x80)
getsockname(r7, &(0x7f0000002a40)=@in, &(0x7f0000002a80)=0x10) (async)
getsockname(r7, &(0x7f0000002a40)=@in, &(0x7f0000002a80)=0x10)

kernel console output (not intermixed with test programs):

starting RPC daemons:.
savecore: no core dump
checking quotas: done.
clearing /tmp
kern.securelevel: 0 -> 1
creating runtime link editor directory cache.
preserving editor files.
starting network daemons: sshd.
starting local daemons:.
Sun Apr 26 03:31:49 PDT 2026

OpenBSD/amd64 (ci-openbsd-setuid-6.us-central1-b.c.syzkaller.internal) (tty00)

Warning: Permanently added '10.128.0.64' (ED25519) to the list of known hosts.
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 32: Broken pipe)
login: 

OpenBSD/amd64 (ci-openbsd-setuid-6.us-central1-b.c.syzkaller.internal) (tty00)

login: uvn_flush: obj=0xfffffd806f2fb788, offset=0xdff000.  error during pageout.
uvn_flush: WARNING: changes to page may be lost!
set $lines = 0
Password:
Login incorrect
login: show panic
Password:
Login incorrect
login: show registers
Password:
Login incorrect
login: ps
Password:
Login incorrect
show malloc
login: Password: