last executing test programs: 6.461995056s ago: executing program 5 (id=28): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) r0 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$DIOCMAP(r0, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r0, 0x7}) ioctl$FIOASYNC(0xffffffffffffffff, 0x80047460, &(0x7f00000000c0)=0x4) sysctl$hw(&(0x7f0000000280)={0x6, 0x8}, 0x2, &(0x7f0000000000)="0000e65bc39e76ecc9ddb3c3cc6bbc2506870300ec", &(0x7f0000000240)=0x15, 0x0, 0x0) execve(0x0, 0x0, 0x0) r1 = socket(0x2, 0x8002, 0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) closefrom(r2) 5.955234545s ago: executing program 5 (id=40): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket(0x18, 0x1, 0x6) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0xc0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x6, 0x1142fa, 0x10000000, 0x0, 0xfe200002, 0x7, 0x7b9, 0x2, 0x2, 0xfffffffffffffffc, 0x2}) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x2) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x1) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0xba) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0xcfc, 0x400001, 0x7, 0xd4, 0xa, 0x8001, 0x9c, 0x10, [{0x5, 0x9, 0x1, 0x7ff}, {0x7, 0x4, 0xffb, 0x80}, {0x10000006, 0x2000f87, 0x0, 0x40007}, {0x5, 0x800, 0x7, 0xffffff}, {0x2, 0x4000a, 0x9, 0x10000}, {0xfffffff5, 0x1, 0x0, 0x8020494}, {0x9, 0xffffffff, 0x1003, 0x71}, {0x1f, 0x10008803, 0x14, 0x8}, {0x2, 0x81, 0x2, 0x7}, {0x6, 0x8004, 0x0, 0x79}, {0x2, 0xe6, 0x3}, {0xfffffffa, 0x40, 0x400008, 0x4}, {0xe0, 0x4, 0x5, 0x3}, {0xffff0354, 0xfffffffa, 0x4, 0x3}, {0x0, 0x4, 0x7, 0x1ffffffb}, {0x4, 0x1, 0x4, 0xc3}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0x2000007, 0xfffffffffffffffd, 0x27ffffffffffffff, 0x181c, 0xc, 0x401}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) 5.794129416s ago: executing program 1 (id=49): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x7, 0xffffffffffffffff, 0xfffffffffffffffd, 0x800, 0x181c, 0x20000a, 0x2}, 0x0, 0x0, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x9, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x4c) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0xffffffa3, 0x9, 0xd, 0x1, 0x4, 0xd86, 0x40, 0x2, 0x1, 0x100002000642}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x8, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSMOUSEIO_SCALIBCOORDS(r1, 0x81205724, &(0x7f0000000100)={0x4, 0x1, 0x9, 0xd4, 0xa, 0xffffffff, 0x9c, 0x10, [{0x5, 0x7, 0x0, 0x7ff}, {0x6, 0x3, 0xb9d4, 0x4}, {0x10000005, 0x7, 0x0, 0x5}, {0x0, 0x800, 0x2000000e, 0xffffff}, {0x8001, 0x7ffbffff, 0x9, 0x8}, {0x6, 0x1, 0x80000000, 0x800009c}, {0x409, 0xffffffff, 0x20081003, 0xfffeffff}, {0x1f, 0x100007fe, 0x10001, 0x8}, {0xfffffffe, 0x81, 0x1, 0xf}, {0x6, 0x8001, 0xfffffffe, 0x800000b}, {0x4, 0x3, 0x3}, {0x1, 0x40, 0x3, 0x4}, {0xe0, 0x5, 0x5, 0x2}, {0xffff0354, 0xfffffffa, 0x8001, 0x100006}, {0x0, 0x6, 0x8, 0x1ffffffd}, {0xe, 0x2, 0x0, 0xc3}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0x2000007, 0xfffffffffffffffd, 0x27ffffffffffffff, 0x181c, 0xc, 0x401}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r1, 0x82907003, &(0x7f0000000140)=0x1) closefrom(r2) 5.744795007s ago: executing program 1 (id=52): symlink(0x0, 0x0) open(0x0, 0x611, 0x1) mknod(0x0, 0x2000, 0xd02) open(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0xba) rename(0x0, 0x0) rename(0x0, 0x0) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$DIOCGETSTATES(r0, 0xc0104419, &(0x7f0000000040)={0xf83e0f83e0faa8, &(0x7f0000000080)}) r1 = socket(0x18, 0x1, 0x6) setsockopt(r1, 0x1000000000029, 0xa, &(0x7f0000000080)='\x00\x00\x00\x00', 0x4) kevent(0xffffffffffffffff, &(0x7f0000000000)=[{{}, 0x6aa1b1da9f415add, 0x82, 0x8, 0x4, 0x5}], 0x4, 0x0, 0x6, 0x0) sysctl$net_inet_esp(&(0x7f0000000000)={0x4, 0x2, 0x2, 0x1}, 0x4, 0x0, 0x0, 0x0, 0x0) setsockopt(r1, 0x1000000000029, 0xa, 0x0, 0x0) 4.406438804s ago: executing program 1 (id=55): ioctl$DIOCNATLOOK(0xffffffffffffffff, 0xc0504417, &(0x7f0000000080)={@v6=@loopback, @v4=@remote={0xac, 0x14, 0x0}, @v4, @v6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4, 0x2, 0x7, 0x1, 0x9, 0x5, 0x2, 0x6, 0x3}) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x9}, 0x4) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f0000000340)={0x6, 0x8, 0x5, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x8}) openat$bpf(0xffffffffffffff9c, 0x0, 0x200, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) r2 = socket$inet(0x2, 0x3, 0xfc) ioctl$FIONREAD(r2, 0x80206979, &(0x7f0000000000)) 4.071447566s ago: executing program 5 (id=58): ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000400)={0x3, &(0x7f0000000000)=[{0x24, 0x0, 0x2, 0x4}, {0x84, 0x1, 0x9, 0x9}, {0x6, 0xff, 0xe4, 0x4000800}]}) r0 = syz_open_pts() close(r0) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r1 = syz_open_pts() close(r1) r2 = syz_open_pts() sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x32c, 0x0, 0x0, &(0x7f0000000000), 0x90}, 0x0) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f0000000340)={0x934, 0x8, 0xffffdf82, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x4}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) ioctl$TIOCSETAW(r0, 0x802c7415, &(0x7f0000000180)={0x2df57366, 0x3, 0xd, 0xfffffffd, "0a6400b72834605c9b000a296203000000020400", 0x80000005, 0xc}) writev(r0, &(0x7f0000002c40)=[{&(0x7f0000000200)='R', 0x1}], 0x1) 3.226427069s ago: executing program 1 (id=68): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x2, 0xff, 0x7, 0x9}, {0x30, 0xc9, 0x2, 0x8}, {0x9b1e, 0x22, 0xf, 0x40207ff}]}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x2, 0x2, 0x200}, 0x10) sysctl$kern(0x0, 0x0, &(0x7f0000000280)="c2a6500000019324b9b7a065af1faf4a1532d36092ec2f956cb56bb6a41c59c48094c1095b60d952c3d7d8dd90b90c8e7ad131f55ac05378abbbab540fe863acd3690861e747a271bb05427d60572f4ba84f6cf497d7de7727be2a6f8eec4cfe3a", &(0x7f0000000000)=0x61, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@broadcast, @local, [], {@ipv4={0x86dd, {{0x5, 0x4, 0x0, 0x17, 0x1c, 0x66, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x0}, @multicast1}, @icmp=@info_reply={0x10, 0x0, 0x0, 0x8000, 0x9}}}}}) 3.217790212s ago: executing program 5 (id=69): mknod(&(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0xd02) mknod(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x0) open(&(0x7f0000000140)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x615, 0xb6) symlink(&(0x7f0000000700)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') open$dir(&(0x7f0000000b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0x0) mknod(&(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0xd02) open(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200, 0xba) rename(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3.211336415s ago: executing program 2 (id=70): r0 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000780)={{0x0, r3, r2, r3, 0x8f, 0x9, 0x0, 0x0, 0xfffffffffffffffb}, 0x0, 0x6, 0x0, 0x0, 0x6, 0x0, 0x8}) setgroups(0x0, 0x0) setresgid(r3, r3, 0x0) setuid(0xffffffffffffffff) semctl$SETVAL(r0, 0xff7f0000, 0x8, 0x0) 3.198361591s ago: executing program 1 (id=71): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$BIOCSBLEN(r0, 0xc0044266, &(0x7f00000000c0)=0x34) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000500)={'tap', 0x0}) pread(r0, &(0x7f0000000600)="e7077b6629e0397383eaeac9193e79db7bbbad786e7bbb921dff532158d0b49a3e7de9f2d8fdefa9e6fddc16bcd369b9fc28dc5e", 0x34, 0x5) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) syz_extract_tcp_res(0x0, 0x3, 0xc) r1 = socket$inet(0x2, 0x1, 0x6) ioctl$FIONREAD(r1, 0x80206979, &(0x7f0000000100)) 3.064693434s ago: executing program 2 (id=73): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) r0 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$DIOCMAP(r0, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r0, 0x3}) r1 = socket(0x2, 0x8002, 0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) closefrom(r2) open(&(0x7f0000000000)='./file0\x00', 0x8, 0x9bf2d3725864749b) 3.011698452s ago: executing program 7 (id=74): r0 = socket(0x2, 0x8002, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) closefrom(r1) socket(0x18, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000ffff000001"], 0x28}, 0x0) recvmsg(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/51, 0x33}, 0x0) 2.956239677s ago: executing program 4 (id=76): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000240)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x3, 0x3, 0x1, 0xa}, {0x1, 0xc9, 0xfe, 0x9}, {0x9b1e, 0x22, 0xf, 0x40207ff}]}) sysctl$kern(0x0, 0x0, &(0x7f0000000180)="c2a6500034dd7fb55c3f1f17dd129377ba8200019324b9b7a0536259f563790a966083c8c73a28ce546a06907f", &(0x7f0000000000)=0x2d, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x22, &(0x7f00000000c0)={@random="5e0f5d1664a4", @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x3, 0x33, 0x14, 0x66, 0x9, 0xf6, 0x1d, 0x0, @empty, @loopback}}}}}) 2.931058226s ago: executing program 4 (id=78): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() setsid() ioctl$TIOCSCTTY(r1, 0x20007461) r2 = syz_open_pts() readv(r2, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) ioctl$TIOCSETAW(r0, 0x802c7415, &(0x7f00000001c0)={0x2df57366, 0x3, 0xd, 0xdad, "0a6400b72834605c9b000a296203000000020400", 0x80000005, 0xc}) readv(r1, &(0x7f0000002100)=[{0x0}, {&(0x7f0000000200)=""/112, 0x70}, {&(0x7f0000000280)=""/23, 0x17}], 0x3) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000ac0)="62bab39b5019e45650c18a095a667f8cb9212084d4b8af4f31fac97bd3bd67e8ff5923165f6879976635c09cb8496b02d2a4de53e452b47259891a38f474fa5a0974cffb5ded63ea871fcc93813973231060fb179710c0689150ea8755663ee5df492962fea8f06976f0ba2267216c5e927cf70853df96a1ae5710e87777ed0d57bf6253a4664ae0a1eab65a7b8f32b383cafc85431145d92050c644b4f56e038a141d92e8cf0f905682ef0458adebb3ba2fe6b7dc1a5ab275f5ae47c6ff9f8a00d5d332f25a2f6e303fff628975961456a81deddbbb13584afdddc0251ca306a651e78573552ef98e14690fb1b16b8dedcc6bad8c9022b172d4d22066b1d4dd93d88d985f89a1551bb1274e1ec2612bb0e5f26284a9ec6391226ad31b51cb512962f56515c4cf8d66fa1e6315cbe339efa1516b9df5a7db20c192e5aa26b1201e74fd4d94f354d1713d28a8085d68e1102ad7908f441713e1f09c64c2278e31acbce8e1d96d3aad8bd17c00342412a88b9e8296069c6b002444ee75ec9004f882ec81a36773966a9839b61ca99585b18042504e4631b048ebd1a192792c5c2d6170b7146c795def76d4d7708f552dedb5e2d392855acd6d6a3b784616b3db2df1e46677ec7373fe8859ecb6029b00d464823c668d99f65608d47619374d2171cda064595e6b363d42080ecde006be1e9d10c389622279670b64bc6659146066d3ca6b2830de289552f3579de356ec57ec5c4d4811bf40ae80b0fdafeda3b7ed7e7157eb97f77d0123f35b26643b1f03dbec5cd8301c14e972bc4bdfed1f2549b87c5b738b22c95f8b1cca000000000000f98b5a19578a734733894299be1a0a2f83d96e170f5f487ac9f0f587d987f6ab43221ea1752484188ec321edf8dd23b3b90d61e9eaee1f727dcd08aee004fe528b61519fc461fa541f5883b02bcff8d590a24b66dd4271b17d218b1ace939a1241bae1776a224d58edc59293f6779a4b485fcb9ad939630e1893892f8d2bc93b49a3c8ca91dabedf2a43a2117e2a3288e74c39ecd1aa3c3029243c5deb42907557b581eb473a46ce998bfed139b4aad15740a9403f3dd41a815a6bae2014fff0d39f3e5b22395704833257ff6ccc836b43056a36ed7a5407caaeda6f13c05bf325c33e710a4cacfbb107c43615ed8a91c8b8c786bcac379ae4901d0054d1fa264c55e80ceaac6bb5a6211bdbcde85b35d5df7ebc9d0077d7d955f316b40fe65b59e5ced32d4175cba82251b252fd49efc9c0a3e371038b7e37f1d9ecd031cdc40525aa5690c50fe10563782f5f0023724fd8f545f396d3377dc861e1190ce023ac2032907ef123614de1e4b3a8003f57fb22934db2", 0x3c6}], 0x1) 2.925101846s ago: executing program 7 (id=79): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x9}, 0x4) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000080)={0x0, &(0x7f0000001800)}) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f0000000340)={0x6, 0x8, 0x5, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x8}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) r2 = socket$inet(0x2, 0x3, 0xfc) ioctl$FIONREAD(r2, 0x80206979, &(0x7f0000000000)) 2.590418415s ago: executing program 6 (id=82): r0 = socket$inet(0x2, 0xc003, 0xdf) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file1\x00', 0x8, 0x2a, 0x9, 0x0, 0x4, 0xd86, 0x1, 0x2, 0x1, 0x100002000642, 0x800000000}) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r2 = open(&(0x7f0000000800)='./file1\x00', 0x800, 0xba) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0xcfc, 0x400001, 0x7, 0xd4, 0xa, 0x8001, 0x9c, 0x10, [{0x5, 0x9, 0x1, 0x7ff}, {0x7, 0x4, 0xffb, 0x80}, {0x10000006, 0x2000f87, 0x0, 0x40007}, {0x5, 0x800, 0x7fffffff, 0xffffff}, {0xa, 0xa, 0x9, 0x10000}, {0xfffffff5, 0x1, 0x0, 0x8000494}, {0x9, 0xffffffff, 0x1003, 0x71}, {0x1f, 0x10008803, 0x14, 0x8}, {0x2, 0x81, 0x1, 0x9}, {0x6, 0x8001, 0x1, 0x800004b}, {0x2, 0x5, 0x3}, {0xfffffffa, 0x40, 0x400008, 0x4}, {0xe0, 0x4, 0x5, 0x3}, {0xffff0354, 0xfffffffa, 0x4, 0x3}, {0x0, 0x4, 0x7, 0x1ffffffb}, {0x4, 0x1, 0x4, 0xc7}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0x2000007, 0xfffffffffffffffd, 0x27ffffffffffffff, 0x181c, 0xc, 0x401}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) closefrom(r0) 2.555469965s ago: executing program 5 (id=84): ioctl$DIOCNATLOOK(0xffffffffffffffff, 0xc0504417, &(0x7f0000000080)={@v6=@loopback, @v4=@remote={0xac, 0x14, 0x0}, @v4, @v6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4, 0x2, 0x7, 0x1, 0x9, 0x5, 0x2, 0x6, 0x3}) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f0000000340)={0x934, 0x4, 0xffffdf82, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x8007, 0x8}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) r2 = socket$inet(0x2, 0x3, 0xfc) ioctl$FIONREAD(r2, 0x80206979, &(0x7f0000000000)) 2.245566258s ago: executing program 6 (id=85): sysctl$kern(&(0x7f00000000c0)={0x1, 0x17}, 0x2, 0x0, 0x0, 0x0, 0x0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x2, 0x800c1, 0xb, 0x1, 0x1040807, 0x50001, 0x3, 0x0, 0x0, 0x8, 0xf5fffffffffffff9}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r0, 0xffff, 0x1024, &(0x7f0000000480)={0x0}, &(0x7f0000000580)=0xc) kill(r1, 0x12) r2 = socket$inet6(0x18, 0x1, 0x6) setsockopt$sock_int(r2, 0xffff, 0x1000, &(0x7f0000001300)=0x3, 0x4) bind$inet6(r2, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000000000000000010000000600", 0x7}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x8, "fffffff9000000000000000000000001", 0x7}, 0x1c) r3 = socket$inet6(0x18, 0x1, 0x6) bind$inet6(r3, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x1, "ffffffffffff00000000000000000001", 0x7}, 0x1c) 2.224481736s ago: executing program 2 (id=87): setsockopt(0xffffffffffffffff, 0x1000000029, 0x24, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0) r0 = socket(0x18, 0x3, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r1 = socket(0x18, 0x3, 0x0) socket(0x18, 0x3, 0x40) r2 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r2, 0xc0106924, &(0x7f00000001c0)) ioctl$FIONREAD(r1, 0x8080691a, &(0x7f0000000100)) openat$null(0xffffffffffffff9c, 0x0, 0x58e408e4a8000e55, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, 0x0) ioctl$FIONREAD(r0, 0xc1206951, &(0x7f0000000100)) 2.162967977s ago: executing program 6 (id=88): ioctl$WSMUXIO_LIST_DEVICES(0xffffffffffffffff, 0xc1045763, &(0x7f0000000040)={0x0, [{}, {0x1}, {0x0, 0x300}, {0x2, 0x4}, {0x0, 0x4000}, {0x2, 0xe}, {}, {0x3, 0x1}, {}, {0x4}, {}, {0x1}, {0x3, 0x6}, {0x2}, {0x3}, {0x1}, {0x2}, {0x1}, {0x1, 0x3a3e}, {}, {0x3}, {0x0, 0x4}, {0x2}, {0x2}, {0x3}, {0x0, 0x5}, {0x2, 0x1}, {0x0, 0x10000}, {0x1, 0x80000000}, {0x1, 0x6}, {0x0, 0x2}]}) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f0000000340)={0x934, 0x8, 0xffffdf82, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x4}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000080)={0x2, 0x0, 0x5, 0x5}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) r2 = socket$inet(0x2, 0x3, 0xfc) ioctl$FIONREAD(r2, 0x80206979, &(0x7f0000000000)) 1.886623419s ago: executing program 7 (id=89): r0 = shmget$private(0x0, 0xe000, 0x7c1, &(0x7f000040b000/0xe000)=nil) setgroups(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, 0x0, 0x0, 0x1001, 0x0) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(r3, r3, 0x0) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) shmctl$IPC_SET(r0, 0x1, &(0x7f0000000200)={{0x0, r4, 0x0, r4, 0x4, 0xd, 0x0, 0x0, 0xffffffffffffff46}, 0x8, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x10, 0x2, 0xfffffffffffffffe, 0x205, 0x3}) stat(0x0, 0x0) setuid(0xffffffffffffffff) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000002c0)=""/148) shmat(r0, &(0x7f0000416000/0x1000)=nil, 0x3000) 1.882268594s ago: executing program 0 (id=90): r0 = socket(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1, 0x0, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000001"]) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)="6dc100167f", 0x5}], 0x1) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendto(r0, 0x0, 0x0, 0x4, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) r2 = dup(r1) connect$inet(r2, &(0x7f0000000000)={0x10, 0x2, 0x3, 0x80000001}, 0x10) write$audio(r2, 0x0, 0x0) 1.861778204s ago: executing program 2 (id=91): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DIOCXBEGIN(r0, 0xc0104451, &(0x7f0000000040)={0x1, 0x408, &(0x7f00000028c0)=[{0x0, './file0/file0/..\x00', 0x7}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0xf94a14e19cec2761, 0x0) r2 = semget$private(0x0, 0x4, 0x720) semctl$SETALL(r2, 0x0, 0x9, 0xfffffffffffffffe) ioctl$TIOCSETA(r1, 0xc0104453, &(0x7f0000000040)={0x474, 0x408, 0xfeff, 0x10070, "456000004fcb420865abbf000200000000000001", 0x8, 0x7}) r3 = socket(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x0, 0x0, 0x0) futimes(0xffffffffffffffff, 0x0) sysctl$kern(&(0x7f0000000100)={0x1, 0x48}, 0x2, 0x0, 0x0, 0x0, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, 0x0) 1.860492786s ago: executing program 2 (id=92): open(&(0x7f0000000140)='./file0\x00', 0x200, 0x130) chmod(&(0x7f0000000000)='./file0\x00', 0x3de) setuid(0xee01) poll(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) write(r0, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) setreuid(0x0, 0xee01) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r1 = socket(0x18, 0x1, 0x0) ioctl$FIONREAD(r1, 0x80206982, &(0x7f00000001c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getrlimit(0x1, &(0x7f0000001080)) 1.859243254s ago: executing program 4 (id=93): ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0xc, 0x9, 0x5, 0x9}]}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x6) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x2, 0x4001, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) close(r1) r2 = socket(0x2, 0x4001, 0x0) connect$unix(r2, &(0x7f0000000000), 0x10) setsockopt$sock_int(r1, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) shutdown(r1, 0x1) listen(r1, 0x81) 1.811936336s ago: executing program 7 (id=94): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x19, 0x0) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)="6dc10016", 0x4}], 0x1) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) close(r1) r2 = socket(0x2, 0x2, 0x0) connect$unix(r2, &(0x7f0000000000), 0x10) r3 = socket(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0xffff, 0x1023, &(0x7f0000000040)=0x6, 0x4) readv(r3, &(0x7f0000001440)=[{0x0}], 0x1) 1.751484365s ago: executing program 0 (id=95): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) r1 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$BIOCSETIF(r1, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) r3 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$BIOCSETIF(r3, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) r4 = socket(0x2, 0x8002, 0x0) r5 = fcntl$dupfd(r4, 0x2, 0xffffffffffffffff) closefrom(r5) 1.729023853s ago: executing program 0 (id=97): openat$vmm(0xffffffffffffff9c, &(0x7f0000000000), 0x8, 0x0) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x2, 0x4001, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) r2 = socket(0x2, 0x4001, 0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) close(r3) r4 = socket(0x2, 0x4001, 0x0) connect$unix(r4, &(0x7f0000000000), 0x10) setsockopt$sock_int(r3, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) setsockopt$sock_int(r1, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) 1.706662162s ago: executing program 6 (id=98): setsockopt$sock_int(0xffffffffffffffff, 0xffff, 0x1002, 0x0, 0x0) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() socket$unix(0x1, 0x2, 0x0) read(r0, &(0x7f0000000080)=""/182, 0xb6) readv(r0, &(0x7f0000000800)=[{&(0x7f00000002c0)=""/141, 0x8d}], 0x1) setsid() ioctl$TIOCSCTTY(r1, 0x20007461) ioctl$TIOCSETD(r0, 0x8004745f, &(0x7f0000000000)=0x1d) 1.703724386s ago: executing program 7 (id=99): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000700)=""/140, 0x8c}], 0x1, 0x0}, 0x1840) kevent(0xffffffffffffffff, 0x0, 0x3ff, 0x0, 0x8000800, 0x0) setrlimit(0x8, &(0x7f0000000580)={0xa, 0x7ec}) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) closefrom(r0) setrlimit(0x8, &(0x7f0000000080)={0xe, 0x51}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/240, 0xf0}, 0x0) setrlimit(0x4, &(0x7f0000000000)={0x7, 0x3ff}) 1.65263591s ago: executing program 4 (id=101): setrlimit(0x8, &(0x7f0000000980)={0x7, 0x4b}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$FIOASYNC(r0, 0x80047469, &(0x7f00000000c0)=0x47) write(r0, 0x0, 0x0) writev(r0, &(0x7f0000000580)=[{0x0}], 0x1) r2 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000040), 0x10, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) closefrom(r2) writev(r1, 0x0, 0x0) 403.384601ms ago: executing program 4 (id=102): ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0xc, 0x9, 0x5, 0x9}]}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x6) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x2, 0x4001, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) close(r1) r2 = socket(0x2, 0x4001, 0x0) connect$unix(r2, &(0x7f0000000000), 0x10) setsockopt$sock_int(r1, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) read$audioctl(r1, 0x0, 0x0) 400.081634ms ago: executing program 3 (id=103): select(0x40, &(0x7f0000000180)={0xffffffff, 0x8, 0xffffffffffffffff, 0xfffffffffffffff9, 0x800, 0x181c, 0xa, 0x2}, 0x0, 0x0, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000000c0)=@file={0xe, 0x1, './file0\x00'}, 0xa) listen(r0, 0x1) accept4(r0, 0x0, 0x0, 0x4000) r1 = socket(0x2, 0x8002, 0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) closefrom(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r3) 382.137502ms ago: executing program 4 (id=104): r0 = socket$inet6(0x18, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1000, &(0x7f0000000140)=0x5, 0x4) bind$inet6(r0, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000010000000600", 0x62a4}, 0x1c) r1 = socket$inet6(0x18, 0x2, 0x0) setsockopt$sock_int(r1, 0xffff, 0x1000, &(0x7f0000000140)=0x5, 0x4) bind$inet6(r1, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "0000000001000010fe00", 0x7}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x18, 0x0, 0x9, '\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0xd5}, 0x1c) r2 = socket(0x2, 0x8002, 0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) closefrom(r3) 325.615609ms ago: executing program 5 (id=105): mknod(&(0x7f00000000c0)='./bus\x00', 0x2000, 0x450c) r0 = open(&(0x7f00000002c0)='./bus\x00', 0x2, 0x80) ioctl$WSMUXIO_INJECTEVENT(r0, 0x80185760, &(0x7f0000000140)={0xd, 0x6}) ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f0000000100)={0x0, 0x0, {[0xff7ffbeffffffffb, 0x0, 0x952, 0x2, 0x8001, 0x0, 0x6, 0xffffffffffffffff, 0x4, 0x800000000c4, 0x0, 0x3, 0xffffffffffffffff, 0x400000000000000, 0x0, 0xffffffffffffffa5, 0x7e, 0xce5], [0xfffffffffffffffe, 0x80000001, 0xda3, 0x2, 0x9, 0x7b98, 0x1fe, 0x0, 0xfffffffffffffffe], [0x3, 0x8, 0x40000000, 0x0, 0xfffffffffffffffb, 0x11003, 0x4], [0xb3, 0x20000000000, 0x6, 0x8040000100000000, 0xfffffffffffffffa, 0x9], [{0x4, 0x4, 0x1, 0x7d06}, {0xfffc, 0x1, 0x5}, {0x0, 0x0, 0xfffffffe, 0x80}, {0x3, 0x4b72, 0x10001, 0xffffffffffffffff}, {0x0, 0x2, 0x0, 0x8}, {0x0, 0x2000, 0x40000, 0x6}, {0x6b7}, {0x0, 0x965, 0x0, 0x9}], {0x2000, 0x7, 0x5, 0x8}, {0x29, 0x6, 0xb0, 0x2}}}) r1 = kqueue() setrlimit(0x8, 0x0) syz_open_pts() ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x200000000000c, 0x0, 0x0) kevent(r1, &(0x7f0000000040), 0x31, 0x0, 0x57d, 0x0) kevent(r1, 0x0, 0x80000000, &(0x7f00000003c0), 0x9, 0x0) 315.424041ms ago: executing program 0 (id=106): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r2 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) ioctl$WSDISPLAYIO_USEFONT(r2, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0x1268f, 0xfffffffa, 0x400, 0x0, 0x1, 0x2, 0x7, 0x2, 0x0, 0xfffffffffffffffe, 0x6}) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x2) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) closefrom(r0) 269.233443ms ago: executing program 2 (id=107): open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x0) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) syz_emit_ethernet(0x10004, 0x0) open(0x0, 0x615, 0x0) ioctl$WSMUXIO_LIST_DEVICES(0xffffffffffffffff, 0xc1045763, &(0x7f0000000380)={0x10000, [{0x1, 0xfe}, {0x0, 0xfffffffa}, {}, {0x0, 0x1}, {0x1, 0x9}, {0x0, 0x4}, {0x3, 0x8}, {0x0, 0xc8}, {0x5}, {0x0, 0xff}, {0x2}, {0x2, 0x204}, {0x1, 0xfffffffd}, {}, {0x0, 0x80000000}, {0x0, 0x7}, {0x2, 0x774}, {0x1, 0x7}, {0x3, 0x2000000}, {0x0, 0x3}, {0x3, 0x70}, {0x1, 0x4}, {0x3, 0x7f}, {0x0, 0x3}, {0x2, 0x5}, {0x1, 0x7}, {0x2, 0x2003}, {0x3, 0x2}, {0x1}, {0x3}, {0x3}, {0x2, 0x57fb}]}) openat$bpf(0xffffffffffffff9c, 0x0, 0x10, 0x0) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) r1 = socket$inet(0x2, 0x3, 0x0) ioctl$FIONREAD(r1, 0x80206979, &(0x7f0000000100)) 197.565052ms ago: executing program 1 (id=71): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$BIOCSBLEN(r0, 0xc0044266, &(0x7f00000000c0)=0x34) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000500)={'tap', 0x0}) pread(r0, &(0x7f0000000600)="e7077b6629e0397383eaeac9193e79db7bbbad786e7bbb921dff532158d0b49a3e7de9f2d8fdefa9e6fddc16bcd369b9fc28dc5e", 0x34, 0x5) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) syz_extract_tcp_res(0x0, 0x3, 0xc) r1 = socket$inet(0x2, 0x1, 0x6) ioctl$FIONREAD(r1, 0x80206979, &(0x7f0000000100)) 190.404849ms ago: executing program 3 (id=108): ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0xc, 0x9, 0x5, 0x9}]}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x6) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x2, 0x4001, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) close(r1) r2 = socket(0x2, 0x4001, 0x0) connect$unix(r2, &(0x7f0000000000), 0x10) setsockopt$sock_int(r1, 0xffff, 0x1023, &(0x7f0000000040), 0xe0) shutdown(r1, 0x1) 168.398496ms ago: executing program 3 (id=109): ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) r0 = socket(0x18, 0xc003, 0x3a) setsockopt(r0, 0x29, 0x6c, &(0x7f0000000040), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0x66, &(0x7f00000003c0)={0x0, 0x1, 0x14, 0x1}, 0xc) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0xffffffff, 0xff, {0x2, 0x1}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket(0x18, 0x1, 0x0) setsockopt(r1, 0x1000000029, 0xc, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) r2 = socket(0x2, 0x8002, 0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) closefrom(r3) 151.607515ms ago: executing program 6 (id=110): ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, 0x0) syz_emit_ethernet(0x0, 0x0) mknod(0x0, 0x20, 0x3ff) setgid(0xffffffffffffffff) r0 = msgget$private(0x0, 0x0) msgsnd(r0, 0x0, 0x8, 0x0) mknod(0x0, 0x2000, 0x205318) ktrace(0x0, 0x1, 0x4, 0x0) setresgid(0x0, 0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000000580)={{0x0, 0x0, 0x0, 0x0, 0x84, 0x51f}, 0x0, 0x0, 0xbe7f, 0x602298e2, 0x3a6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}) setuid(0xffffffffffffffff) msgctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/56) 146.619166ms ago: executing program 7 (id=111): openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) socket(0x18, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f0000000340)={0x934, 0x8, 0xffffdf82, 0xffffff8c, "08ed95990000000000000000ffffffffffffffe6", 0x800b, 0x4}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000000)=""/18, 0x12}], 0x1) 120.784056ms ago: executing program 3 (id=112): ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x10000100000004}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x2, 0x0) setsockopt(r0, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) sendto(r0, 0x0, 0x0, 0x80a, &(0x7f0000000240)=@in6={0x1c, 0x18, 0x2, 0xf4, "ffffffffff886f44000000000000e700", 0xffffffc0}, 0x1c) 109.642876ms ago: executing program 0 (id=113): mknod(0x0, 0x8000, 0x5204) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, 0x0, 0x0) pipe(0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) r1 = socket(0x18, 0xc003, 0x3a) setsockopt(r1, 0x29, 0x6c, &(0x7f0000000040), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0x66, &(0x7f00000003c0)={0x2, 0x0, 0x10, 0x9}, 0xc) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0x66, &(0x7f00000003c0)={0x0, 0x1, 0xf, 0x3}, 0xc) sysctl$net_inet6_ip6(&(0x7f0000000180)={0x4, 0x18, 0x29, 0x34}, 0x4, &(0x7f0000000540)="abf734f14a00000000a3fb4fede70914bb67340f459d8806085867fde6f3eceea7d85b9e4b487e5ea752729d4421276fe97a8f07a77efc742151f530da62832176", &(0x7f0000000500)=0x41, 0x0, 0x0) 90.850986ms ago: executing program 3 (id=114): r0 = semget(0x0, 0x1, 0x281) r1 = semget(0x0, 0x0, 0x1d8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(0x0, r4, 0x0) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000780)={{0x0, 0x0, r3, r4, 0x8f, 0x9, 0x0, 0x0, 0x4}, 0x0, 0x6, 0x0, 0x0, 0x6, 0x0, 0x8}) setgroups(0x0, 0x0) setuid(0xffffffffffffffff) semop(r1, &(0x7f00000000c0)=[{0x0, 0x8, 0x1800}], 0x1) semop(r0, &(0x7f0000000000)=[{0x0, 0xfff8, 0x1000}], 0x1) 84.665981ms ago: executing program 0 (id=115): setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0x69, 0x0, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x5) pread(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffff7) kevent(0xffffffffffffffff, 0x0, 0xd235, 0x0, 0x2000000, 0x0) shmget(0x3, 0x2000, 0xa0, &(0x7f0000ffd000/0x2000)=nil) fcntl$setown(0xffffffffffffffff, 0x6, r0) ioctl$DRM_IOCTL_MODE_CLOSEFB(0xffffffffffffffff, 0xc00864d0, 0x0) r1 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000001a00), 0x0, 0x0) ioctl$WSKBDIO_SETMAP(r1, 0x8010570e, &(0x7f0000001b40)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x8, 0x0) 53.145388ms ago: executing program 6 (id=116): mknod(&(0x7f0000000240)='./bus\x00', 0x2000, 0x654) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000004}, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) r2 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0x100) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000100)={{0x0, 0x0, 0x0, 0x0, 0x10b, 0x190, 0x3fd, 0x0, 0x100000}, 0x4, 0x9, 0x0, 0x0, 0x5, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x2) closefrom(r0) 0s ago: executing program 3 (id=117): open(&(0x7f0000000000)='./file0\x00', 0x615, 0x166) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0xc8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r0, 0x0) madvise(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x2) r1 = kqueue() kevent(r1, &(0x7f0000000240), 0x33b4dd72, 0x0, 0xffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r2 = kqueue() kevent(r2, &(0x7f0000000440)=[{{}, 0xfffffffffffffffa, 0x8, 0x2, 0x67, 0xd11}], 0x3fc, 0x0, 0x8000800, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.175' (ED25519) to the list of known hosts. pckbd_enable: command error kernel: protection fault trap, code=0 Stopped at bpfdetach+0x70: movq 0(%r15),%r12 ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> trace bpfdetach(ffff80000160a800) at bpfdetach+0x70 if_detach(ffff80000160a800) at if_detach+0x12b tun_clone_destroy(ffff80000160a800) at tun_clone_destroy+0x2ce if_clone_destroy(ffff80003c3edc90) at if_clone_destroy+0x205 ifioctl(ffff800001618310,80206979,ffff80003c3edc90,ffff800034b9e020) at ifioctl+0x59d sys_ioctl(ffff800034b9e020,ffff80003c3ede70,ffff80003c3eddc0) at sys_ioctl+0x674 syscall(ffff80003c3ede70) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd4cdd2dc4c0, count: -8 ddb{0}> show registers rdi 0xffff80002af80000 rsi 0x167cf acpi_pdirpa+0x2640 rbp 0xffff80003c3edab0 rbx 0x80206979 __kernel_virt_to_phys+0x206979 rdx 0xffff80002af80000 rcx 0x167ce acpi_pdirpa+0x263f rax 0xffffffff82593ac9 bpfdetach+0xb9 r8 0x7f7fffffc000 r9 0 r10 0xaf50296b356f50cb r11 0x41768c29d6d22643 r12 0xdeaf0002deaf4152 r13 0xffff80000160ae48 r14 0xffff80000160a800 r15 0xdeaf0002deaf4152 rip 0xffffffff82593a80 bpfdetach+0x70 cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80003c3eda80 ss 0x10 bpfdetach+0x70: movq 0(%r15),%r12 ddb{0}> show proc PROC (syz-executor) tid=189179 pid=97644 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=79, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800034b9e7e8,0xffff800034b9fcb8 process=0xffff800034ba1830 user=0xffff80003c3e8000, vmspace=0xfffffd806c6ab9a8 estcpu=29, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 86136 401086 28245 0 2 0 syz-executor 86136 309925 28245 0 2 0x4000000 syz-executor 80995 506320 52729 0 2 0 syz-executor 80995 62161 52729 0 3 0x4000080 fsleep syz-executor 85124 347996 19888 0 3 0 vmmaplk syz-executor 85124 446279 19888 0 2 0x4000000 syz-executor 97644 425766 98476 0 2 0xc80 syz-executor 97644 478735 98476 0 3 0x4000080 fsleep syz-executor *97644 189179 98476 0 7 0x4000000 syz-executor 56385 340257 56820 0 2 0xc80 syz-executor 56385 68133 56820 0 3 0x4000000 clonelk syz-executor 69083 256929 32556 0 3 0x3000 suspend syz-executor 69083 434487 32556 0 2 0x4081000 syz-executor 90502 283382 29227 0 2 0 syz-executor 90502 116798 29227 0 2 0x4000000 syz-executor 90502 254970 29227 0 3 0x4000080 fsleep syz-executor 98476 32682 72787 0 2 0xc82 syz-executor 19888 101486 72787 0 2 0xc82 syz-executor 28245 140285 72787 0 3 0x82 nanoslp syz-executor 32556 186351 72787 0 3 0x82 nanoslp syz-executor 29227 459767 72787 0 2 0xc82 syz-executor 66596 272468 72787 0 2 0x2 syz-executor 56820 22811 72787 0 2 0xc82 syz-executor 52729 34088 72787 0 2 0xc82 syz-executor 72787 429213 71318 0 3 0x82 kqread syz-executor 71318 504902 83486 0 3 0x10008a sigsusp ksh 83486 25718 88650 0 3 0x98 kqread sshd-session 88650 210872 83190 0 3 0x92 kqread sshd-session 94320 131287 1 0 3 0x100083 ttyin getty 83190 217723 1 0 3 0x88 kqread sshd 81966 472262 30283 74 3 0x1100092 bpf pflogd 30283 87290 1 0 3 0x80 sbwait pflogd 3632 462570 39354 73 3 0x1100090 kqread syslogd 39354 312320 1 0 3 0x100082 sbwait syslogd 43109 66359 1 0 3 0x100080 kqread resolvd 51321 79056 24903 77 3 0x100092 kqread dhcpleased 95290 433274 24903 77 2 0x100012 dhcpleased 24903 162564 1 0 3 0x80 kqread dhcpleased 94310 518047 0 0 3 0x14200 bored smr 76233 196993 0 0 2 0x14200 zerothread 24345 194543 0 0 3 0x14200 aiodoned aiodoned 46994 483035 0 0 3 0x14200 syncer update 3674 392807 0 0 3 0x14200 cleaner cleaner 64325 35501 0 0 7 0x14200 reaper 51247 397391 0 0 3 0x14200 pgdaemon pagedaemon 7436 427129 0 0 3 0x14200 bored viomb 59098 88795 0 0 3 0x40014200 acpi0 acpi0 54489 96681 0 0 3 0x40014200 idle1 68285 284918 0 0 3 0x14200 bored softnet1 84643 336976 0 0 3 0x14200 bored softnet0 6208 202450 0 0 3 0x14200 bored systqmp 45087 373239 0 0 3 0x14200 bored systq 3606 118024 0 0 3 0x14200 tmoslp softclockmp 81574 292511 0 0 3 0x40014200 tmoslp softclock 74522 328989 0 0 3 0x40014200 idle0 1 264085 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 85124 (syz-executor) thread 0xffff800034b9e7e8 (446279) exclusive rwlock vmmaplk r = 0 (0xfffffd806c6abe78) #0 witness_lock+0x5f1 #1 rw_do_enter_read+0x3e8 #2 uvmfault_lookup+0x122 #3 uvm_fault_check+0x4f #4 uvm_fault+0x106 #5 kpageflttrap+0x2f4 #6 kerntrap+0x19d #7 alltraps_kern_meltdown+0x7b #8 _copyin+0x5b #9 ptcwrite+0x193 #10 spec_write+0x11f #11 VOP_WRITE+0x101 #12 vn_write+0x1d3 #13 dofilewritev+0x2bd #14 sys_writev+0xd8 #15 syscall+0xbd4 #16 Xsyscall+0x128 Process 97644 (syz-executor) thread 0xffff800034b9e020 (189179) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b2ee80) #0 witness_lock+0x5f1 #1 __mp_acquire_count+0x58 #2 sleep_finish+0x2d8 #3 rw_do_enter_write+0x1dc #4 lf_purgelocks+0x2f #5 vgonel+0x47e #6 vop_generic_revoke+0x3ea #7 VOP_REVOKE+0x65 #8 vdevgone+0x17b #9 bpfsdetach+0x155 #10 bpfdetach+0xa6 #11 if_detach+0x12b #12 tun_clone_destroy+0x2ce #13 if_clone_destroy+0x205 #14 ifioctl+0x59d #15 sys_ioctl+0x674 #16 syscall+0xbd4 #17 Xsyscall+0x128 exclusive rwlock clonelk r = 0 (0xffffffff8392c448) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 if_clone_destroy+0x93 #3 ifioctl+0x59d #4 sys_ioctl+0x674 #5 syscall+0xbd4 #6 Xsyscall+0x128 Process 90502 (syz-executor) thread 0xffff80003c3bf780 (116798) exclusive rwlock fdlock r = 0 (0xffff8000363ab930) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 sys_socket+0x203 #3 syscall+0xbd4 #4 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11073 12173K 12348K 166960K 12261 0 pcb 17 12K 12K 166960K 39 0 rtable 227 9K 9K 166960K 423 0 pf 35 17K 24K 166960K 122 0 ifaddr 42 7K 8K 166960K 63 0 ifgroup 55 2K 2K 166960K 86 0 sysctl 3 1K 9K 166960K 7 0 counters 70 37K 37K 166960K 112 0 ioctlops 0 0K 4K 166960K 1508 0 iov 0 0K 4K 166960K 1 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1296 82K 82K 166960K 1451 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 7 0 VM map 2 1K 1K 166960K 2 0 sem 6 0K 0K 166960K 6 0 dirhash 12 2K 2K 166960K 18 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 17 61K 89K 166960K 263 0 sigio 0 0K 0K 166960K 3 0 proc 71 115K 164K 166960K 586 0 subproc 72 4K 4K 166960K 81 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 11 0 in_multi 96 7K 7K 166960K 120 0 ether_multi 1 0K 0K 166960K 3 0 mrt 0 0K 0K 166960K 9 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 103 466K 466K 166960K 103 0 exec 0 0K 1K 166960K 411 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 232 159K 178K 166960K 4217 0 UVM aobj 11 2K 2K 166960K 11 0 pinsyscall 42 84K 103K 166960K 1495 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 11 0 NDP 12 0K 2K 166960K 40 0 temp 35 9114K 9126K 166960K 6601 0 kqueue 17 26K 32K 166960K 52 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 44 0 41 1 0 1 1 0 8 0 rtentry 176 126 0 29 6 0 6 6 0 8 0 unpcb 144 102 0 81 1 0 1 1 0 8 0 syncache 336 5 0 5 1 1 0 1 0 8 0 tcpcb 736 37 0 32 1 0 1 1 0 8 0 arp 136 20 0 2 1 0 1 1 0 8 0 inpcb 328 162 0 149 3 1 2 2 0 8 0 nd6 152 27 0 3 1 0 1 1 0 8 0 kcovpl 48 9 0 1 1 0 1 1 0 8 0 mppekey 1024 1 0 1 1 1 0 1 0 8 0 ppxss 1192 17 0 17 2 1 1 1 0 8 1 pppxif 1576 2 0 2 1 1 0 1 0 8 0 pfstscr 40 2 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfanchor 1288 14 0 9 1 0 1 1 0 8 0 pftag 88 1 0 0 1 0 1 1 0 8 0 pfstitem 24 31 0 0 1 0 1 1 0 8 0 pfstkey 128 31 0 0 1 0 1 1 0 8 0 pfstate 448 30 0 0 4 0 4 4 0 8 0 pfrule 1360 25 0 19 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 542 0 121 31 3 28 31 0 8 1 art_table 40 543 0 121 5 0 5 5 0 8 0 art_node 32 125 0 38 1 0 1 1 0 8 0 sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1 semupl 112 1 0 1 1 0 1 1 0 8 1 semapl 72 4 0 0 1 0 1 1 0 8 0 shmpl 112 8 0 0 1 0 1 1 0 8 0 dirhash 1024 21 0 4 3 0 3 3 0 8 0 dino2pl 256 1772 0 299 93 0 93 93 0 8 0 ffsino 296 1772 0 299 114 0 114 114 0 8 0 nchpl 144 2081 0 373 64 0 64 64 0 8 0 rtmask 32 5 0 5 2 1 1 1 0 8 1 vnodes 216 1909 0 0 107 0 107 107 0 8 0 namei 1024 6547 0 6546 3 2 1 2 0 8 0 percpumem 16 71 0 21 1 0 1 1 0 8 0 kstatmem 264 47 0 20 3 0 3 3 0 8 0 scsiplug 72 1 0 1 1 1 0 1 0 8 0 scxspl 216 7285 0 7285 3 2 1 2 1 8 1 plimitpl 152 53 0 35 1 0 1 1 0 8 0 sigapl 424 592 0 544 7 1 6 7 0 8 0 knotepl 120 522 0 0 16 0 16 16 0 8 0 kqueuepl 224 61 0 49 1 0 1 1 0 8 0 pipepl 344 137 0 110 3 0 3 3 0 8 0 fdescpl 528 576 0 545 3 0 3 3 0 8 0 filepl 160 2206 0 1975 10 0 10 10 0 8 0 lockfpl 104 54 0 52 1 0 1 1 0 8 0 lockfspl 48 28 0 26 1 0 1 1 0 8 0 sessionpl 144 34 0 25 1 0 1 1 0 8 0 pgrppl 48 43 0 26 1 0 1 1 0 8 0 ucredpl 104 267 0 254 1 0 1 1 0 8 0 zombiepl 144 556 0 554 2 1 1 1 0 8 0 processpl 1232 592 0 544 5 0 5 5 0 8 0 procpl 664 753 0 695 6 0 6 6 0 8 0 sosppl 176 9 0 9 2 1 1 1 0 8 1 sockpl 752 309 0 272 5 1 4 4 0 8 0 mcl64k 65536 19 0 0 3 0 3 3 0 8 0 mcl16k 16384 10 0 0 2 0 2 2 0 8 0 mcl12k 12288 7 0 0 1 0 1 1 0 8 0 mcl9k128 9344 5 0 0 1 0 1 1 0 8 0 mcl8k 8192 9 0 0 2 0 2 2 0 8 0 mcl4k 4096 116 0 0 15 0 15 15 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 26 0 0 4 0 4 4 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 161 0 0 11 0 11 11 0 8 0 bufpl 272 2621 0 105 168 0 168 168 0 8 0 anonpl 32 5365 0 0 44 0 44 44 0 246 0 amapchunkpl 152 11845 0 11363 25 4 21 24 0 158 0 amappl16 200 1431 0 1406 5 2 3 4 0 8 0 amappl15 192 19 0 19 2 2 0 1 0 8 0 amappl14 184 454 0 453 1 0 1 1 0 8 0 amappl13 176 134 0 121 1 0 1 1 0 8 0 amappl12 168 837 0 807 2 0 2 2 0 8 0 amappl11 160 6 0 6 1 1 0 1 0 8 0 amappl10 152 63 0 49 1 0 1 1 0 8 0 amappl9 144 278 0 278 1 1 0 1 0 8 0 amappl8 136 104 0 102 1 0 1 1 0 8 0 amappl7 128 153 0 140 1 0 1 1 0 8 0 amappl6 120 165 0 164 1 0 1 1 0 8 0 amappl5 112 108 0 98 1 0 1 1 0 8 0 amappl4 104 306 0 287 1 0 1 1 0 8 0 amappl3 96 2283 0 2171 5 1 4 4 0 8 0 amappl2 88 587 0 524 2 0 2 2 0 8 0 amappl1 80 11667 0 11055 17 2 15 17 0 8 0 amappl 88 3425 0 3264 4 0 4 4 0 92 0 uvmvnodes 80 102 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 10 0 0 1 0 1 1 0 8 0 uaddrrnd 24 576 0 545 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 576 0 545 1 0 1 1 0 8 0 vmmpekpl 168 6826 0 6783 3 0 3 3 0 8 0 vmmpepl 168 45928 0 44018 100 12 88 98 0 357 0 vmsppl 488 575 0 545 5 0 5 5 0 8 0 rwobjpl 80 16166 0 15126 26 2 24 26 0 8 0 pdppl 4096 1159 0 1090 101 28 73 83 0 8 4 pvpl 32 13250 0 0 108 1 107 107 0 265 0 pmappl 256 575 0 545 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 452 0 38 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace bpfdetach(ffff80000160a800) at bpfdetach+0x70 if_detach(ffff80000160a800) at if_detach+0x12b tun_clone_destroy(ffff80000160a800) at tun_clone_destroy+0x2ce if_clone_destroy(ffff80003c3edc90) at if_clone_destroy+0x205 ifioctl(ffff800001618310,80206979,ffff80003c3edc90,ffff800034b9e020) at ifioctl+0x59d sys_ioctl(ffff800034b9e020,ffff80003c3ede70,ffff80003c3eddc0) at sys_ioctl+0x674 syscall(ffff80003c3ede70) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd4cdd2dc4c0, count: -8 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83b2e680) at __mp_lock+0x1a3 reaper(ffff8000ffffd9f8) at reaper+0x211 end trace frame: 0x0, count: -5