non-paged memory
list_del corruption, ffff0000c9622780->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:58!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6092 Comm: kworker/u9:1 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: hci4 hci_conn_timeout
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid_or_report+0x124/0x1b4 lib/list_debug.c:56
lr : __list_del_entry_valid_or_report+0x124/0x1b4 lib/list_debug.c:56
sp : ffff80009dce7950
x29: ffff80009dce7950 x28: ffff0000c9e64618 x27: 1fffe000192c44f0
x26: dfff800000000000 x25: ffff0000c9622798 x24: ffff0000c9e64618
x23: ffff80008a1d2e1c x22: dfff800000000000 x21: dead000000000122
x20: dead000000000100 x19: ffff0000c9622780 x18: 1fffe000337e1476
x17: ffff80008f62e000 x16: ffff80008aec8e2c x15: 0000000000000001
x14: 1fffe000337e4220 x13: 0000000000000000 x12: 0000000000000000
x11: ffff80009311ec08 x10: 0000000000ff0100 x9 : 8d8776eb38faab00
x8 : 8d8776eb38faab00 x7 : ffff800080489294 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000010
x2 : 0000000000000006 x1 : 0000000100000000 x0 : 000000000000004e
Call trace:
 __list_del_entry_valid_or_report+0x124/0x1b4 lib/list_debug.c:56 (P)
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 _hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:647 [inline]
 hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:851 [inline]
 hci_cmd_sync_dequeue_once+0x1e0/0x2c8 net/bluetooth/hci_sync.c:870
 hci_cancel_connect_sync+0xdc/0x128 net/bluetooth/hci_sync.c:-1
 hci_abort_conn+0x158/0x310 net/bluetooth/hci_conn.c:2902
 hci_conn_timeout+0xdc/0x1e8 net/bluetooth/hci_conn.c:580
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x958/0xed8 kernel/workqueue.c:3402
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
Code: 910e8000 aa1303e1 f2fbd5a2 9741d70d (d4210000) 
---[ end trace 0000000000000000 ]---