// https://syzkaller.appspot.com/bug?id=3c1f47967b7cbd399d3ba3e65f297a29aa1c5f92
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

long r[1];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  memcpy((void*)0x2002b000, "/dev/sg#", 9);
  r[0] = syz_open_dev(0x2002b000, 0, 0x142);
  *(uint8_t*)0x20671f39 = 0x23;
  *(uint8_t*)0x20671f3a = 0;
  *(uint8_t*)0x20671f3b = 8;
  *(uint8_t*)0x20671f3c = 3;
  *(uint64_t*)0x20671f41 = 0;
  *(uint64_t*)0x20671f49 = 0;
  *(uint8_t*)0x20671f51 = 9;
  *(uint8_t*)0x20671f52 = 8;
  *(uint8_t*)0x20671f53 = 0x8a;
  *(uint8_t*)0x20671f54 = -1;
  *(uint64_t*)0x20671f59 = 0x77359400;
  *(uint64_t*)0x20671f61 = 0;
  *(uint8_t*)0x20671f69 = 4;
  *(uint8_t*)0x20671f6a = -1;
  *(uint8_t*)0x20671f6b = 6;
  *(uint8_t*)0x20671f6c = 3;
  *(uint32_t*)0x20671f71 = 2;
  *(uint8_t*)0x20671f81 = 1;
  *(uint8_t*)0x20671f82 = 9;
  *(uint8_t*)0x20671f83 = 0xb2;
  *(uint8_t*)0x20671f84 = 0x92;
  *(uint8_t*)0x20671f89 = 2;
  *(uint8_t*)0x20671f8a = 9;
  *(uint8_t*)0x20671f8b = 5;
  *(uint8_t*)0x20671f8c = 9;
  *(uint8_t*)0x20671f99 = 0;
  *(uint8_t*)0x20671f9a = 2;
  *(uint8_t*)0x20671f9b = 0xfa;
  *(uint8_t*)0x20671f9c = 0x20;
  *(uint32_t*)0x20671fa1 = 8;
  *(uint8_t*)0x20671fb1 = 0x20;
  *(uint8_t*)0x20671fb2 = 1;
  *(uint8_t*)0x20671fb3 = -1;
  *(uint8_t*)0x20671fb4 = 1;
  *(uint32_t*)0x20671fb9 = 4;
  *(uint32_t*)0x20671fbd = 0x7fff;
  *(uint32_t*)0x20671fc1 = 3;
  *(uint8_t*)0x20671fc9 = 0xf9;
  *(uint8_t*)0x20671fca = 0xb5;
  *(uint8_t*)0x20671fcb = 1;
  *(uint8_t*)0x20671fcc = 0x39;
  *(uint64_t*)0x20671fd1 = 0;
  *(uint64_t*)0x20671fd9 = 0;
  *(uint8_t*)0x20671fe1 = 4;
  *(uint8_t*)0x20671fe2 = 0xdf;
  *(uint8_t*)0x20671fe3 = 0;
  *(uint8_t*)0x20671fe4 = 7;
  *(uint8_t*)0x20671fe9 = 0xfc;
  *(uint32_t*)0x20671fed = 0xd5;
  *(uint32_t*)0x20671ff1 = 0xfffff571;
  *(uint8_t*)0x20671ff9 = 0x6f;
  *(uint8_t*)0x20671ffa = 0;
  *(uint8_t*)0x20671ffb = 0xb8;
  *(uint8_t*)0x20671ffc = 0;
  *(uint64_t*)0x20672001 = 0;
  *(uint64_t*)0x20672009 = 0x1c9c380;
  *(uint8_t*)0x20672011 = 0x7d;
  *(uint8_t*)0x20672012 = 0xac;
  *(uint8_t*)0x20672013 = -1;
  *(uint8_t*)0x20672014 = 0x8a;
  *(uint32_t*)0x20672019 = 7;
  *(uint32_t*)0x2067201d = 0;
  *(uint8_t*)0x20672029 = 6;
  *(uint8_t*)0x2067202a = 0;
  *(uint8_t*)0x2067202b = 6;
  *(uint8_t*)0x2067202c = 0;
  *(uint64_t*)0x20672031 = 0x77359400;
  *(uint64_t*)0x20672039 = 0;
  *(uint8_t*)0x20672041 = 0;
  *(uint8_t*)0x20672042 = 5;
  *(uint8_t*)0x20672043 = 0x4a;
  *(uint8_t*)0x20672044 = 0;
  *(uint8_t*)0x20672049 = 8;
  *(uint8_t*)0x2067204a = 0x40;
  *(uint8_t*)0x20672059 = 7;
  *(uint8_t*)0x2067205a = 3;
  *(uint8_t*)0x2067205b = 8;
  *(uint8_t*)0x2067205c = 0x13;
  *(uint32_t*)0x20672061 = 9;
  *(uint8_t*)0x20672071 = 0;
  *(uint8_t*)0x20672072 = 1;
  *(uint8_t*)0x20672073 = 7;
  *(uint8_t*)0x20672074 = 2;
  *(uint32_t*)0x20672079 = 0;
  *(uint64_t*)0x2067207d = 0x2077b000;
  *(uint8_t*)0x20672089 = 0;
  *(uint8_t*)0x2067208a = 0x94;
  *(uint8_t*)0x2067208b = 1;
  *(uint8_t*)0x2067208c = 0;
  *(uint64_t*)0x20672091 = 0x77359400;
  *(uint64_t*)0x20672099 = 0;
  *(uint8_t*)0x206720a1 = 0x1f;
  *(uint8_t*)0x206720a2 = 4;
  *(uint8_t*)0x206720a3 = 9;
  *(uint8_t*)0x206720a4 = 0x88;
  *(uint32_t*)0x206720a9 = 0xfffffbff;
  syscall(__NR_write, r[0], 0x20671f39, 0x180);
  syscall(__NR_read, r[0], 0x2042a000, 0);
}

int main()
{
  loop();
  return 0;
}