last executing test programs: 59.600004ms ago: executing program 4 (id=5): ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000100)={'tap', 0x0}) mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x200000000000c, &(0x7f0000000040)="ea00eb0100000000", 0x8) sysctl$net_inet6_ip6(&(0x7f0000000180)={0x4, 0x1f, 0x29, 0x34}, 0x4, 0x0, 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x1, 0x24) ioctl$FIONREAD(r1, 0x80206979, &(0x7f0000000100)) sysctl$hw(&(0x7f0000000000)={0x7, 0x19}, 0x2, 0x0, 0x0, 0x0, 0x0) 44.458997ms ago: executing program 1 (id=2): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x7fff) r1 = socket(0x18, 0x6, 0x3c) getpeername(r1, &(0x7f00000000c0)=@in6, &(0x7f0000000100)=0x1c) syz_emit_ethernet(0x12, &(0x7f0000000080)={@local, @random="adc9bcfb08ca", [{[], {0x8100, 0x0, 0x0, 0x3}}], {@ipv4={0x8100, {{0x5, 0x4, 0x2, 0x2, 0x1c, 0x65, 0xfffb, 0x4a, 0x89, 0x0, @rand_addr=0x6, @broadcast}, @udp={{0x0, 0x0, 0x8}}}}}}) syz_emit_ethernet(0xc7, &(0x7f0000000140)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3, 0xb9, 0x0, 0x0, 0x66, 0x6, 0x0, @rand_addr, @local={0xac, 0x14, 0x0}}, @tcp={{0x1, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x47, 0x0, 0x29, {[@timestamp={0x8, 0xa, 0x3, 0x6}]}}, {"7f967d4a40d0a0c7b102b3f44841c509889d9426ec9101c19258f264aa38637e60e4d5416b0fcdfb934dfd6e87ee15a3134c5e5a830967f3327eadc9c074286838c84c9dfe9ed90b33d0db2e41a21dc4367e77f7d8d4007ee42817de5c4476f52bff6bece3e02f3819181afe0169e6d2e8b6574fde3bbdabe875c9b1035521dd5535222db8"}}}}}}) 31.048825ms ago: executing program 6 (id=7): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000300), 0x8000, 0x0) ioctl$DIOCNATLOOK(r0, 0xc0504417, &(0x7f0000000480)={@v6=@loopback, @v6=@loopback, @v4, @v6=@empty, 0x104, 0x24b9, 0x40, 0x1, 0x6, 0x2, 0x18, 0x6, 0x3}) openat$bpf(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$bpf(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$bpf(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x8, 0x8, 0x80, 0xc5, 0x8, 0x7, 0x40, 0x10, [{0x5, 0x3, 0x7fff, 0x80000201}, {0x5, 0x8, 0x6, 0xffc}, {0x1, 0xfffffffe, 0x6, 0x2}, {0x2, 0xdf, 0xf, 0x40}, {0x2, 0x7, 0xf11, 0x7}, {0x800, 0xffbf, 0x80cf}, {0x1, 0x5, 0x85, 0x2}, {0x3, 0x1, 0xfffffff8, 0xfbffe2e9}, {0x8, 0xffe, 0x6, 0x17fff}, {0x3, 0x4, 0x5, 0x7}, {0xff, 0x8000000, 0x8, 0x7}, {0x4, 0x2, 0x800000, 0xa66}, {0x401, 0x10a, 0x9, 0x9}, {0x200003, 0x5, 0x4, 0x6f5fc48f}, {0x81, 0x101, 0x3, 0x7fff}, {0xffffffff, 0x1, 0x6, 0x2000069}]}) poll(&(0x7f0000000000), 0x35, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r2 = socket(0x18, 0x3, 0x0) r3 = socket(0x18, 0x3, 0x0) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7fc, 0xffffffff, 0x3, 0x101, 0x4, 0x1, 0x3, 0x10, [{0x5, 0xfe3, 0xffffff26, 0x71800}, {0xfffffffd, 0x300b7fe, 0x800002, 0xa}, {0x100806, 0x0, 0x4, 0x2}, {0x2, 0x0, 0x200, 0xfffffffc}, {0x4, 0x3, 0x80000000, 0x7}, {0x2, 0x47fff, 0x14000009, 0xc}, {0x5, 0xbffffff5, 0x7, 0x6d}, {0x2000a, 0x8, 0xfdf0, 0xb}, {0x0, 0x7, 0x34, 0xa}, {0xfffffc04, 0x4, 0x8003, 0x1}, {0x100a44f, 0xfff9, 0xa38c000, 0xe1}, {0x80000cb, 0x2, 0xc, 0x9}, {0x2000df, 0x9, 0x15, 0x400}, {0x10008, 0xe2, 0xfffffff5, 0x2}, {0x5, 0x1, 0x24, 0x4}, {0x0, 0xd655, 0x960, 0x6}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) ioctl$FIONREAD(r3, 0xc0106924, &(0x7f00000001c0)) setitimer(0x1, &(0x7f0000000140)={{0x3, 0x100900000000009}, {0x7ffffffffffffffc, 0x1f50}}, 0x0) ioctl$FIONREAD(r2, 0x8080691a, &(0x7f0000000100)) ioctl$DIOCSETIFFLAG(r1, 0xc0284459, &(0x7f0000000080)={'./file0\x00', &(0x7f0000000040)=""/47, 0x10001, 0xb, 0x7, 0x2}) r4 = openat$vmm(0xffffffffffffff9c, &(0x7f0000000000), 0x8, 0x0) ioctl$VMM_IOC_CREATE(r4, 0xca605601, &(0x7f0000000080)={0x10, 0x9, [{&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x9}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0xffffffffffff822d}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x73}, {&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0xb}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0xffffffffffffff89}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x7}, {&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x6}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x6}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x762c}, {&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x6}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x4}, {&(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2}, {&(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x7fffffff}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x8001}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0xffffffff}], './file0\x00', 0x5, 0x9, 0x0, 0x8, [0x9, 0x7, 0x6, 0x4, 0x0, 0x3ff, 0x2, 0x8, 0xfff, 0x3, 0x7, 0x401, 0x1, 0x9, 0x4, 0x8, 0x298, 0x5, 0x100, 0x5, 0x8, 0x7, 0x5, 0xffff, 0x1, 0x8, 0x7, 0xd, 0x5e5, 0x6, 0x0, 0xb677, 0x7f, 0x8, 0xa094, 0x2, 0x100, 0xffffffff, 0x1, 0x4, 0x1, 0x9248, 0x100, 0xb, 0x10000, 0x51, 0x0, 0x81, 0xa, 0x6, 0xd19d, 0x8, 0x24, 0xabf4, 0x6, 0x3, 0x100, 0x4, 0x2, 0x2, 0xd1, 0xb, 0x4, 0xfffffffe, 0x5, 0x6, 0x7, 0x2, 0x7, 0x6, 0x7, 0xfffffff4, 0x4, 0xb370, 0x2, 0x0, 0x2, 0x3ff, 0xfba, 0x7, 0x0, 0x5, 0x7, 0x51, 0xfff, 0xb9, 0x7, 0x5, 0xf, 0x0, 0x1, 0xbe000000, 0x2, 0x1, 0x8, 0xfffffffb, 0x6, 0x7063, 0xa, 0x6, 0x7, 0xa23d, 0x80000001, 0x8, 0x8, 0x9, 0x2, 0x1, 0x6, 0xbc6, 0x5, 0x6, 0x2, 0x2, 0xfff, 0x2, 0x7fffffff, 0x4, 0xffff, 0x5, 0xfffffffc, 0xa000, 0x9, 0x3, 0x3ff, 0x1, 0xd7d9, 0xfe, 0xb, 0x1, 0x9, 0x79, 0x2, 0x5, 0xa, 0x7, 0x2, 0x2, 0x5, 0x5, 0xd, 0x9, 0x8001, 0x80000000, 0x52f, 0x5, 0x2, 0x6, 0x5, 0x7a9f, 0xcf, 0x0, 0xea3c, 0x5, 0x8, 0x4, 0x0, 0x3, 0xffffffff, 0x2, 0x9, 0x4, 0x80, 0xf5a, 0x200, 0xfffffc8f, 0x2, 0x5, 0x5, 0x101, 0x0, 0xaf, 0x8, 0x4, 0x5, 0x2, 0x2, 0x6, 0x800, 0x7, 0x6, 0x7fff, 0x6, 0x800, 0x21, 0x9, 0x5, 0x8, 0x8, 0x64a, 0x5, 0x7c, 0x2204fbed, 0x0, 0x8, 0x1, 0x1, 0x800, 0x9, 0x75a1, 0x0, 0x0, 0x32, 0xe04d, 0x4, 0x2, 0x8, 0x100, 0x2, 0x8, 0x9, 0x9229, 0x0, 0xb0, 0xc, 0xe11, 0x891a74b, 0xd39, 0x2, 0xffffffff, 0xe73, 0x6, 0x7, 0x9, 0x7fffffff, 0x5, 0x0, 0x5, 0xfffffff7, 0xc74c, 0xff, 0x8, 0x6, 0x4, 0x8a, 0x8, 0x2, 0x4774, 0x7, 0x3, 0x7, 0x81, 0x3, 0x8, 0x1, 0x2, 0xb, 0x8e6, 0x5, 0x6, 0x80, 0x2, 0x7f, 0xe, 0x80000000, 0x4, 0x4, 0x9, 0x1, 0x1, 0x9, 0x180, 0x401, 0x7, 0x8, 0x81, 0x4c1, 0x0, 0xb, 0x4, 0xffffffff, 0x12000, 0x10001, 0x99, 0xba8, 0x1, 0xfffffffb, 0xa, 0x1, 0x200, 0x6b73, 0x0, 0x80, 0x8, 0xef2f, 0x9, 0x0, 0x0, 0xffffffd6, 0x80, 0x1b, 0xe2, 0x0, 0x0, 0x1, 0x1, 0x7, 0xffff, 0x99, 0x8, 0x8, 0xe, 0xfff, 0x3, 0x8, 0x3, 0x8, 0xfffffe00, 0x8000, 0x8, 0xd, 0x1, 0x6, 0x5, 0x0, 0x2, 0x401, 0xbf73, 0x3, 0x7ff, 0x0, 0x5, 0xf, 0x0, 0x4, 0xfffffffc, 0x5, 0xa, 0x6, 0x2, 0x800, 0x2, 0x6, 0x80000000, 0xed, 0x2, 0x7, 0x8, 0x0, 0x6, 0xfffffff9, 0x7, 0x9, 0xffffffff, 0x0, 0x9, 0x1ff, 0xfa7, 0x6, 0x5, 0x9, 0x2c, 0x2, 0xffffffff, 0x7, 0x8, 0x80000000, 0x4ef69553, 0xf, 0xe80, 0x7fffffff, 0x5, 0x1, 0x1, 0x2, 0x61, 0xc, 0x9, 0x800, 0x2, 0x100, 0x3, 0x2, 0x1, 0x10000, 0x3, 0x51, 0x8, 0x0, 0x1, 0x5ed, 0x2, 0x9, 0x22, 0x2, 0x8001, 0xdf, 0x5, 0x6, 0x5, 0x4d7e, 0x5, 0x6, 0x62e4, 0x9, 0x7ff, 0x101, 0x5c, 0x93, 0x6, 0xe, 0xe14, 0x6, 0x8, 0x3, 0x101, 0x5, 0x8001, 0x81, 0x0, 0x1, 0x4, 0x1, 0x9, 0xfffffffa, 0x1000, 0xfff, 0x7fff, 0x75da, 0xd8e3, 0x1, 0xb1a, 0x827, 0x8, 0x81, 0x80000000, 0x9, 0x0, 0x4, 0xd, 0x7, 0xfffffffa, 0x1, 0x1, 0x3, 0x2, 0x50b, 0x10000, 0x5, 0xe, 0x4, 0xd92, 0x4, 0x40, 0x3, 0xd59, 0x2, 0x4, 0xa53d, 0x8, 0x7, 0xb63, 0xd, 0x4, 0x3, 0x1, 0x5, 0x10, 0x8001, 0x0, 0x8, 0x4, 0x2, 0x9, 0x8001, 0x7fffffff, 0x9, 0x4, 0x8, 0x4, 0x8, 0xffffffff, 0x7f, 0x7fffffff, 0x4, 0x3, 0x8, 0x7, 0x8, 0x10000, 0xb, 0xbb5c, 0x1, 0x8a, 0x80000001, 0x7, 0x132, 0x80000001, 0x5, 0xa, 0x2, 0x0, 0x80000000, 0x200, 0xa, 0xa0d, 0xff, 0x4, 0xcf71, 0x1e46c000, 0x9, 0xe, 0xb, 0xfffffffd, 0xf2, 0x7, 0x1000, 0x9, 0x9, 0x1000, 0x5, 0x80000001]}) ioctl$VMM_IOC_INFO(r4, 0xc0185603, &(0x7f0000000180)={0x97, 0x5, &(0x7f00000000c0)=""/151}) 29.113622ms ago: executing program 0 (id=1): setrlimit(0x8, &(0x7f0000000980)={0xb, 0x4e}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() setsid() ioctl$TIOCSCTTY(r1, 0x20007461) r2 = openat$tty(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) readv(r2, &(0x7f00000012c0)=[{&(0x7f0000000180)=""/186, 0xba}], 0x1) ioctl$FIOASYNC(r0, 0x80047469, &(0x7f0000000000)=0x45) ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f0000000180)={0x107778, 0x82, 0x0, 0xb217, "150000060209000000000600", 0x1, 0x8000b}) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) unveil(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='x\x00') r3 = syz_open_pts() ioctl$TIOCSETD(r3, 0x8004741b, &(0x7f0000000040)=0x8) sendmsg$unix(0xffffffffffffff9c, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000000500)="370dc7cc4e61858942", 0x9}], 0x1, 0x0, 0x0, 0x406}, 0x8) r4 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$TIOCSETA(r4, 0xc450443c, &(0x7f00000000c0)={0x72f, 0x1, 0x9, 0x3, "c9f7d2462f0000023beeca8f00875a6e80f775d2", 0x2}) writev(r0, &(0x7f00000004c0)=[{&(0x7f00000003c0)="06e325e455082843d3c1b0eb72ebe75686a7206a1e51297b209dc4d9f8aac0867492253b61c0bacaadbe0cad67f68abd19", 0x31}], 0x1) r5 = semget(0x0, 0x1, 0x281) semctl$SETVAL(r5, 0x2520dcc8a5ccf6cb, 0x8, 0x0) semctl$GETVAL(r5, 0x3, 0x5, &(0x7f0000000640)=""/163) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r6, 0x0, 0x200000000000b, &(0x7f0000000080)='\x00', 0x1) setsockopt$inet_opts(r6, 0x0, 0x200000000000c, &(0x7f0000000240)="ea10070000000000", 0x8) semop(r5, &(0x7f0000000100)=[{0x4, 0x2, 0x800}, {0x1, 0x2}, {0x3, 0x1, 0x1000}, {0x1, 0x0, 0x1800}, {0x1, 0x6fb}, {0x3, 0x4, 0x800}, {}, {0x1, 0x5, 0x1000}], 0x8) 5.39079ms ago: executing program 3 (id=4): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000200)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x8, 0x3, 0x1, 0x8}, {0x9b1e, 0x27, 0xb3, 0x4}]}) sysctl$kern(0x0, 0x0, &(0x7f0000000080)="c20500000000000000b7a065af1faf671532d360956ddca885f86faffe1bcae492b84e8f43ac5a39e455ba29be4808f26cc6cded56afc821f4ee873ae6eb91aecb707ea66c3ea9305b5f54ea4c", &(0x7f0000000000)=0x4d, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) futimes(r0, &(0x7f0000000400)=[{0xffffffffffffffff, 0x36}, {0x10000, 0xe}]) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000040)={0x28, 0x0}) write(r0, &(0x7f0000000300)="f81ad3e4004800009db6a1cb4973", 0xe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x1b, &(0x7f0000000240)=[{&(0x7f0000000140)=""/218}, {&(0x7f00000002c0)=""/70}, {&(0x7f0000000340)=""/106}], 0x100000000000039d, 0x0, 0x24}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) r2 = socket(0x2, 0x2, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000800), 0x0, 0x0) r4 = socket(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000000)={0x10, 0x2, 0x1, 0x200000e3}, 0x10) r5 = socket$inet(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000440)={0x10, 0x2, 0x1}, 0x10) listen(r5, 0x404) syz_emit_ethernet(0x3a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800453c002c0067000000069078060000bbac1400aa4e234e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="600282009078fffc04020402"]) setsockopt$sock_int(r2, 0xffff, 0x1023, &(0x7f0000000040)=0x6, 0x4) setsockopt$sock_int(r4, 0xffff, 0x1023, 0x0, 0x0) openat$wskbd(0xffffffffffffff9c, &(0x7f0000000000), 0x8009, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r6 = getsid(0xffffffffffffffff) r7 = socket(0x2, 0x2, 0x0) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0xa6, 0x3, 0x8, 0x80000001, 0xa1b0, 0x10001, 0x10, [{0xfffffffc, 0x2890, 0x40000004, 0x5}, {0x6, 0x9, 0x8, 0xfffffff9}, {0x1, 0xfffffffa, 0xfffffff9, 0x9}, {0x7, 0x800, 0x8007, 0x7}, {0x401, 0x3, 0x2800, 0x7}, {0x1, 0x4, 0x3, 0x9b}, {0x2, 0xffffffff, 0x4f4, 0x10000}, {0x6, 0x803, 0x3, 0x7}, {0xd0f5, 0x4, 0x5, 0x9}, {0x6a75, 0x8009, 0x1000, 0x8}, {0x1cc, 0x10001, 0xc, 0x3}, {0x7, 0xa, 0x8, 0xfffffffc}, {0x3, 0x7, 0x6, 0x1}, {0x6, 0xfffffffa, 0x60, 0x6}, {0x1, 0x1, 0x5, 0x4}, {0x0, 0x6, 0xfff, 0x30004}]}) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) connect$inet(r7, &(0x7f0000000200)={0x10, 0x2, 0x3}, 0x10) fcntl$setown(r1, 0x6, r6) getsockopt$sock_int(r3, 0xffff, 0x801, &(0x7f0000000280), &(0x7f00000003c0)=0x4) 0s ago: executing program 7 (id=8): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ktrace(0x0, 0x5, 0x0, 0x0) openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket(0x18, 0x1, 0x0) setsockopt(r1, 0x1000000029, 0xc, &(0x7f0000000040)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r1, 0x1000000029, 0xd, &(0x7f0000000100), 0x0) ioctl$DIOCXBEGIN(r0, 0xc0104451, &(0x7f0000000040)={0x5, 0x408, &(0x7f0000001440)=[{0x1, './file0/file0\x00', 0x80000001}, {0x0, './file0/file1\x00', 0x4}, {0x1, './file0/file2\x00', 0x6}, {0x1, './file0/file3\x00'}, {0x0, '.\x00', 0x8001}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket(0x18, 0x3, 0x7) setsockopt(r2, 0x1000000000029, 0x3e, &(0x7f0000000780), 0x0) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0xf94a14e19cec2761, 0x0) ioctl$DIOCRDELTABLES(0xffffffffffffff9c, 0xc450443e, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd45f400280067000000069078e0000002ac1400aa4e224e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5002820389977a7a8dbb0823a0000000fc"]) ioctl$TIOCSETA(r3, 0xc0104453, &(0x7f0000000040)={0x474, 0x408, 0xfeff, 0x10070, "456000004fcb420865abbf000200000000000001", 0x8, 0x7}) kernel console output (not intermixed with test programs): OpenBSD/amd64 (ci-openbsd-multicore-1.us-central1-f.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.0.180' (ED25519) to the list of known hosts. login: WuvARmN_IfNaultG(:0 xSfPffLf NeeOT8 0L6OWccERe0bE90D , ON0 xT9R8A,P 0E,X 1I)T a -> 0 e Stopped at proc_trampoline+0xc7: movl $0,%gs:0x688 TID PID UID PRFLAGS PFLAGS CPU COMMAND 63587 32156 0 0 0x4000000 1K syz-executor *315817 76321 0 0x100002 0 0 sh proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x728c97f05850, count: 14 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu1: uvm_fault(0xffffee806cce0b90, 0x98, 0, 1) -> e ddb{0}> show kasan No such command ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x728c97f05850, count: -1 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff800032398e50 rbx 0 rdx 0 rcx 0xffff800045fe8550 rax 0x2a r8 0xffff800032398d80 r9 0x3 r10 0xdc93ce3deef53e60 r11 0xb3ce7e4df566af3 r12 0 r13 0 r14 0 r15 0 rip 0xffffffff82c644c7 proc_trampoline+0xc7 cs 0x8 rflags 0x246 rsp 0xffff800032398dd0 ss 0 proc_trampoline+0xc7: movl $0,%gs:0x688 ddb{0}> show proc PROC (sh) tid=315817 pid=76321 tcnt=1 stat=onproc flags process=100002 proc=0 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045fe9a10,0xffff800045fe9258 process=0xffff800045fe66a0 user=0xffff800032393000, vmspace=0xffffee806fc01b78 estcpu=29, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 5950 107815 44395 0 2 0 0 syz-executor 5950 427509 44395 0 3 0 0x4000080 fsleep syz-executor 48741 342330 36711 0 2 0 0 syz-executor 60199 41754 63959 0 2 0 0 syz-executor 60199 192830 63959 0 2 0 0x4000000 syz-executor 60199 411001 63959 0 3 0 0x4000080 fsleep syz-executor 32156 139424 68361 0 2 0 0 syz-executor 32156 63587 68361 0 7 0 0x4000000 syz-executor *76321 315817 82511 0 7 0x100002 0 sh 80149 290619 1146 0 2 0x2 0 ifconfig 36658 335709 39608 0 2 0 0 syz-executor 36658 441964 39608 0 2 0 0x4000000 syz-executor 41347 76988 63648 0 2 0 0 syz-executor 41347 455914 63648 0 2 0 0x4000000 syz-executor 41347 259927 63648 0 2 0 0x4000000 syz-executor 1146 208550 69575 0 3 0x100002 0x88 sigsusp sh 63959 324952 46544 0 3 0x2 0x80 nanoslp syz-executor 36711 331358 46544 0 3 0x2 0x80 nanoslp syz-executor 82511 430604 46544 0 3 0x2 0x80 wait syz-executor 39608 106739 46544 0 3 0x2 0x80 nanoslp syz-executor 68361 197605 46544 0 3 0x2 0x80 nanoslp syz-executor 69575 411262 46544 0 3 0x2 0x80 wait syz-executor 63648 226771 46544 0 3 0x2 0x80 nanoslp syz-executor 44395 511963 46544 0 3 0x2 0x80 nanoslp syz-executor 46544 368053 70612 0 3 0x2 0x80 kqread syz-executor 70612 463153 74654 0 3 0x100002 0x88 sigsusp ksh 74654 395999 27968 0 3 0x10 0x88 kqread sshd-session 27968 508500 24004 0 3 0x12 0x80 kqread sshd-session 40626 199814 1 0 3 0x100003 0x80 ttyin getty 24004 147424 1 0 3 0 0x88 kqread sshd 13363 189944 65802 74 3 0x1100012 0x80 bpf pflogd 65802 471788 1 0 3 0 0x80 sbwait pflogd 18869 404238 30423 73 3 0x1100010 0x80 kqread syslogd 30423 120381 1 0 3 0x100002 0x80 sbwait syslogd 78236 313447 1 0 3 0x100000 0x80 kqread resolvd 47319 378613 68842 77 3 0x100012 0x80 kqread dhcpleased 44500 426499 68842 77 3 0x100012 0x80 kqread dhcpleased 68842 349573 1 0 3 0 0x80 kqread dhcpleased 57145 331684 0 0 3 0x14000 0x200 bored smr 12146 200850 0 0 2 0x14000 0x200 zerothread 34104 464171 0 0 3 0x14000 0x200 aiodoned aiodoned 83039 260627 0 0 3 0x14000 0x200 syncer update 39066 393493 0 0 3 0x14000 0x200 cleaner cleaner 90397 188310 0 0 3 0x14000 0x200 reaper reaper 39540 86829 0 0 3 0x14000 0x200 pgdaemon pagedaemon 12983 439468 0 0 3 0x14000 0x200 bored viomb 85535 462481 0 0 3 0x14000 0x40000200 acpi0 acpi0 61609 268123 0 0 3 0x14000 0x40000200 idle1 83666 202122 0 0 3 0x14000 0x200 bored softnet1 29265 352381 0 0 3 0x14000 0x200 bored softnet0 81813 84345 0 0 3 0x14000 0x200 smrbar systqmp 622 161313 0 0 3 0x14000 0x200 bored systq 6291 368047 0 0 3 0x14000 0x200 tmoslp softclockmp 81347 34226 0 0 3 0x14000 0x40000200 tmoslp softclock 3406 325558 0 0 3 0x14000 0x40000200 idle0 1 291093 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex &pmap->pm_mtx r = 0 (0xffffee806ccdf910) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 pmap_extract+0x68 #3 uvm_fault_upper_lookup+0x20b #4 uvm_fault+0x159 #5 upageflttrap+0xa9 #6 usertrap+0x430 #7 recall_trap+0x8 Process 32156 (syz-executor) thread 0xffff800045fe94e0 (63587) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a82180) #0 witness_lock+0x5f1 #1 syscall+0xaf4 #2 Xsyscall+0x128 Process 76321 (sh) thread 0xffff800045fe8550 (315817) exclusive rwlock amaplk r = 0 (0xffffee806c065678) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 uvm_fault_check+0x8a9 #3 uvm_fault+0x106 #4 upageflttrap+0xa9 #5 usertrap+0x430 #6 recall_trap+0x8 shared rwlock vmmaplk r = 0 (0xffffee806fc01c78) #0 witness_lock+0x5f1 #1 rw_do_enter_read+0x3e8 #2 uvmfault_lookup+0x122 #3 uvm_fault_check+0x4f #4 uvm_fault+0x106 #5 upageflttrap+0xa9 #6 usertrap+0x430 #7 recall_trap+0x8 exclusive mutex &pmap->pm_mtx r = 0 (0xffffee806ccdf910) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 pmap_extract+0x68 #3 uvm_fault_upper_lookup+0x20b #4 uvm_fault+0x159 #5 upageflttrap+0xa9 #6 usertrap+0x430 #7 recall_trap+0x8 Process 81813 (systqmp) thread 0xffff800045ffe298 (84345) shared rwlock systqmp r = 0 (0xffffffff838f7e88) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11053 12149K 12149K 166960K 12144 0 pcb 17 12K 12K 166960K 17 0 rtable 217 6K 6K 166960K 323 0 pf 34 17K 18K 166960K 45 0 ifaddr 40 6K 6K 166960K 42 0 ifgroup 55 2K 2K 166960K 55 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 70 0 ioctlops 0 0K 4K 166960K 1481 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1290 81K 81K 166960K 1359 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 19 69K 97K 166960K 131 0 proc 76 131K 180K 166960K 544 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 in_multi 85 5K 5K 166960K 85 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 25 122K 122K 166960K 25 0 exec 0 0K 1K 166960K 377 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 216 161K 169K 166960K 3008 0 UVM aobj 3 2K 2K 166960K 3 0 pinsyscall 44 88K 106K 166960K 1275 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 25 1K 1K 166960K 25 0 temp 34 9114K 9120K 166960K 3801 0 kqueue 13 20K 20K 166960K 25 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 31 0 28 1 0 1 1 0 8 0 rtentry 176 101 0 1 5 0 5 5 0 8 0 unpcb 144 39 0 22 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 8 0 4 1 0 1 1 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 64 0 56 1 0 1 1 0 8 0 nd6 152 19 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 15 0 0 1 0 1 1 0 8 0 pfstkey 128 15 0 0 1 0 1 1 0 8 0 pfstate 448 15 0 0 2 0 2 2 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 396 0 0 25 0 25 25 0 8 0 art_table 40 397 0 0 5 0 5 5 0 8 0 art_node 32 101 0 8 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1560 0 93 92 0 92 92 0 8 0 ffsino 296 1560 0 93 113 0 113 113 0 8 0 nchpl 144 1752 0 52 63 0 63 63 0 8 0 vnodes 216 1648 0 0 92 0 92 92 0 8 0 namei 1024 5343 0 5343 2 0 2 2 0 8 2 percpumem 16 51 0 0 1 0 1 1 0 8 0 kstatmem 264 27 0 0 2 0 2 2 0 8 0 scxspl 216 6062 0 6062 4 1 3 3 1 8 3 plimitpl 152 30 0 12 1 0 1 1 0 8 0 sigapl 424 448 0 399 7 0 7 7 0 8 1 knotepl 120 51 0 0 2 0 2 2 0 8 0 kqueuepl 224 21 0 12 1 0 1 1 0 8 0 pipepl 344 126 0 99 3 0 3 3 0 8 0 fdescpl 528 432 0 399 3 0 3 3 0 8 0 filepl 160 1541 0 1330 9 0 9 9 0 8 0 lockfpl 104 7 0 4 1 0 1 1 0 8 0 lockfspl 48 5 0 2 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 32 0 15 1 0 1 1 0 8 0 ucredpl 104 82 0 69 1 0 1 1 0 8 0 zombiepl 144 399 0 399 1 0 1 1 0 8 1 processpl 1232 448 0 399 5 0 5 5 0 8 0 procpl 664 455 0 399 5 0 5 5 0 8 0 sockpl 752 134 0 106 4 0 4 4 0 8 0 mcl8k 8192 1 0 0 1 0 1 1 0 8 0 mcl4k 4096 123 0 0 16 0 16 16 0 8 0 mcl2k 2048 17 0 0 3 0 3 3 0 8 0 mextrefs 64 13 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 133 0 0 9 0 9 9 0 8 0 bufpl 272 2272 0 105 145 0 145 145 0 8 0 anonpl 32 3730 0 0 31 0 31 31 0 247 0 amapchunkpl 152 8097 0 7654 18 0 18 18 0 158 0 amappl16 200 1553 0 1542 5 0 5 5 0 8 4 amappl15 192 5 0 5 1 0 1 1 0 8 1 amappl14 184 431 0 427 1 0 1 1 0 8 0 amappl13 176 193 0 181 1 0 1 1 0 8 0 amappl12 168 676 0 646 2 0 2 2 0 8 0 amappl11 160 7 0 7 1 0 1 1 0 8 1 amappl10 152 61 0 47 1 0 1 1 0 8 0 amappl9 144 274 0 274 1 0 1 1 0 8 1 amappl8 136 98 0 96 1 0 1 1 0 8 0 amappl7 128 166 0 153 1 0 1 1 0 8 0 amappl6 120 163 0 159 1 0 1 1 0 8 0 amappl5 112 111 0 101 1 0 1 1 0 8 0 amappl4 104 289 0 271 1 0 1 1 0 8 0 amappl3 96 1417 0 1330 3 0 3 3 0 8 0 amappl2 88 548 0 473 2 0 2 2 0 8 0 amappl1 80 10278 0 9667 15 0 15 15 0 8 1 amappl 88 2300 0 2157 4 0 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 432 0 399 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 432 0 399 1 0 1 1 0 8 0 vmmpekpl 168 5603 0 5574 2 0 2 2 0 8 0 vmmpepl 168 37048 0 35176 85 0 85 85 0 357 3 vmsppl 488 431 0 399 5 0 5 5 0 8 1 rwobjpl 80 14063 0 13056 24 0 24 24 0 8 0 pdppl 4096 871 0 798 105 18 87 87 0 8 14 pvpl 32 8954 0 0 74 1 73 73 0 265 0 pmappl 256 431 0 399 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 414 0 21 12 0 12 12 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x728c97f05850, count: -1 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 comcnputc(800,d) at comcnputc+0x250 db_putchar(a) at db_putchar+0x498 kprintf() at kprintf+0x223 db_printf(ffffffff8345fdac) at db_printf+0x9b fault(ffffffff83520c7f) at fault+0xa7 kpageflttrap(ffff80003339e970,98) at kpageflttrap+0x37d kerntrap(ffff80003339e970) at kerntrap+0x19d alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff800045fe94e0,ffffee806cc651b0,ffff80003339eb50) at dovutimens+0x368 sys_futimes(ffff800045fe94e0,ffff80003339eca0,ffff80003339ebf0) at sys_futimes+0x208 end trace frame: 0xffff80003339ec90, count: 0 ddb{1}> trace x86_ipi_db(ffff80002999dff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 comcnputc(800,d) at comcnputc+0x250 db_putchar(a) at db_putchar+0x498 kprintf() at kprintf+0x223 db_printf(ffffffff8345fdac) at db_printf+0x9b fault(ffffffff83520c7f) at fault+0xa7 kpageflttrap(ffff80003339e970,98) at kpageflttrap+0x37d kerntrap(ffff80003339e970) at kerntrap+0x19d alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dovutimens(ffff800045fe94e0,ffffee806cc651b0,ffff80003339eb50) at dovutimens+0x368 sys_futimes(ffff800045fe94e0,ffff80003339eca0,ffff80003339ebf0) at sys_futimes+0x208 syscall(ffff80003339eca0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xed3338cdd00, count: -16