EXT4-fs (loop2): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
BUG: kernel NULL pointer dereference, address: 0000000000000000
BUG: unable to handle page fault for address: ffffc900036f0000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 15800067 P4D 15800067 PUD 166e7067 PMD 1f862067 PTE 0
Thread overran stack, or stack corrupted
Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 5491 Comm: syz.2.43 Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:number+0x85b/0xf90 lib/vsprintf.c:551
Code: 4b 8d 5c 37 02 48 3b 5c 24 10 73 22 e8 fe ef de f5 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 8e 00 00 00 48 8b 44 24 38 <88> 03 eb 05 e8 dc ef de f5 4b 8d 5c 37 03 48 3b 5c 24 10 73 1e e8
RSP: 0018:ffffc900036ec480 EFLAGS: 00010086
RAX: 00000000ffff1030 RBX: ffffc900036f0000 RCX: ffffffff8bb4d169
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffc900036f0000
RBP: ffffc900036ec590 R08: ffffffff8bb4d01f R09: 0000000000000000
R10: ffffc900036ec500 R11: fffff520006dd8a3 R12: 0000000000000003
R13: dffffc0000000000 R14: 00000000000035ec R15: ffffc900036eca12
FS:  00007fa69b54d6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900036f0000 CR3: 000000002a90a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 pointer_string lib/vsprintf.c:742 [inline]
 pointer+0x422/0x1210 lib/vsprintf.c:2490
 </TASK>
Modules linked in:
CR2: ffffc900036f0000
---[ end trace 0000000000000000 ]---
RIP: 0010:number+0x85b/0xf90 lib/vsprintf.c:551
Code: 4b 8d 5c 37 02 48 3b 5c 24 10 73 22 e8 fe ef de f5 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 8e 00 00 00 48 8b 44 24 38 <88> 03 eb 05 e8 dc ef de f5 4b 8d 5c 37 03 48 3b 5c 24 10 73 1e e8
RSP: 0018:ffffc900036ec480 EFLAGS: 00010086
RAX: 00000000ffff1030 RBX: ffffc900036f0000 RCX: ffffffff8bb4d169
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffc900036f0000
RBP: ffffc900036ec590 R08: ffffffff8bb4d01f R09: 0000000000000000
R10: ffffc900036ec500 R11: fffff520006dd8a3 R12: 0000000000000003
R13: dffffc0000000000 R14: 00000000000035ec R15: ffffc900036eca12
FS:  00007fa69b54d6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900036f0000 CR3: 000000002a90a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	4b 8d 5c 37 02       	lea    0x2(%r15,%r14,1),%rbx
   5:	48 3b 5c 24 10       	cmp    0x10(%rsp),%rbx
   a:	73 22                	jae    0x2e
   c:	e8 fe ef de f5       	call   0xf5def00f
  11:	48 89 d8             	mov    %rbx,%rax
  14:	48 c1 e8 03          	shr    $0x3,%rax
  18:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax
  1d:	84 c0                	test   %al,%al
  1f:	0f 85 8e 00 00 00    	jne    0xb3
  25:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
* 2a:	88 03                	mov    %al,(%rbx) <-- trapping instruction
  2c:	eb 05                	jmp    0x33
  2e:	e8 dc ef de f5       	call   0xf5def00f
  33:	4b 8d 5c 37 03       	lea    0x3(%r15,%r14,1),%rbx
  38:	48 3b 5c 24 10       	cmp    0x10(%rsp),%rbx
  3d:	73 1e                	jae    0x5d
  3f:	e8                   	.byte 0xe8