non-paged memory
list_del corruption, ffff0000f68be780->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:58!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6559 Comm: kworker/u9:4 Not tainted 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Workqueue: hci4 hci_conn_timeout
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid_or_report+0x124/0x1b4 lib/list_debug.c:56
lr : __list_del_entry_valid_or_report+0x124/0x1b4 lib/list_debug.c:56
sp : ffff8000a6487950
x29: ffff8000a6487950 x28: ffff0000ca330658 x27: 1fffe0001ed17cf0
x26: dfff800000000000 x25: ffff0000f68be798 x24: ffff0000ca330658
x23: ffff80008a2fba20 x22: dfff800000000000 x21: dead000000000122
x20: dead000000000100 x19: ffff0000f68be780 x18: 1fffe000337a0688
x17: 6165642820314e4f x16: ffff80008b007230 x15: 0000000000000001
x14: 1fffe000337a06f2 x13: 0000000000000000 x12: 0000000000000000
x11: ffff6000337a06f3 x10: 0000000000ff0100 x9 : a68419ba81ee9900
x8 : a68419ba81ee9900 x7 : ffff800080563af4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000807de334
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000004e
Call trace:
 __list_del_entry_valid_or_report+0x124/0x1b4 lib/list_debug.c:56 (P)
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 _hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:647 [inline]
 hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:851 [inline]
 hci_cmd_sync_dequeue_once+0x1e0/0x2c8 net/bluetooth/hci_sync.c:870
 hci_cancel_connect_sync+0xdc/0x128 net/bluetooth/hci_sync.c:-1
 hci_abort_conn+0x158/0x310 net/bluetooth/hci_conn.c:2923
 hci_conn_timeout+0xdc/0x1e8 net/bluetooth/hci_conn.c:580
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x958/0xed8 kernel/workqueue.c:3400
 kthread+0x5fc/0x75c kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
Code: 912e0000 aa1303e1 f2fbd5a2 973f8a26 (d4210000) 
---[ end trace 0000000000000000 ]---