------------[ cut here ]------------
kernel BUG at net/phonet/socket.c:213!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 5770 Comm: syz.2.236 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : pn_socket_autobind+0x184/0x188 net/phonet/socket.c:213
lr : pn_socket_autobind+0x184/0x188 net/phonet/socket.c:213
sp : ffff800098ba7a20
x29: ffff800098ba7a70 x28: ffff700013174f68 x27: ffff0000f0b12a40
x26: 0000000000000000 x25: ffff800098ba7b60 x24: 1ffff00013174f85
x23: dfff800000000000 x22: dfff800000000000 x21: ffff700013174f44
x20: 00000000ffffffea x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffb2bb5910
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
x11: ffff800080153d08 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff800085cb4848
x2 : 0000000000000000 x1 : ffff0000d2bdd700 x0 : 0000000000000000
Call trace:
 pn_socket_autobind+0x184/0x188 net/phonet/socket.c:213 (P)
 pn_socket_sendmsg+0x50/0xd4 net/phonet/socket.c:421
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg+0xc8/0x138 net/socket.c:802
 __sys_sendto+0x254/0x338 net/socket.c:2265
 __do_sys_sendto net/socket.c:2272 [inline]
 __se_sys_sendto net/socket.c:2268 [inline]
 __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2268
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Code: aa1303e0 96bab47b 17ffffdd 96a62791 (d4210000) 
---[ end trace 0000000000000000 ]---