// https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/capability.h>
#include <linux/futex.h>
#include <linux/net.h>
#include <linux/usb/ch9.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void thread_start(void* (*fn)(void*), void* arg)
{
  pthread_t th;
  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setstacksize(&attr, 128 << 10);
  int i;
  for (i = 0; i < 100; i++) {
    if (pthread_create(&th, &attr, fn, arg) == 0) {
      pthread_attr_destroy(&attr);
      return;
    }
    if (errno == EAGAIN) {
      usleep(50);
      continue;
    }
    break;
  }
  exit(1);
}

typedef struct {
  int state;
} event_t;

static void event_init(event_t* ev)
{
  ev->state = 0;
}

static void event_reset(event_t* ev)
{
  ev->state = 0;
}

static void event_set(event_t* ev)
{
  if (ev->state)
    exit(1);
  __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
  syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
  while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

static int event_isset(event_t* ev)
{
  return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
  uint64_t start = current_time_ms();
  uint64_t now = start;
  for (;;) {
    uint64_t remain = timeout - (now - start);
    struct timespec ts;
    ts.tv_sec = remain / 1000;
    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
    if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
      return 1;
    now = current_time_ms();
    if (now - start > timeout)
      return 0;
  }
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
  struct usb_endpoint_descriptor desc;
  int handle;
};

struct usb_iface_index {
  struct usb_interface_descriptor* iface;
  uint8_t bInterfaceNumber;
  uint8_t bAlternateSetting;
  uint8_t bInterfaceClass;
  struct usb_endpoint_index eps[USB_MAX_EP_NUM];
  int eps_num;
};

struct usb_device_index {
  struct usb_device_descriptor* dev;
  struct usb_config_descriptor* config;
  uint8_t bDeviceClass;
  uint8_t bMaxPower;
  int config_length;
  struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
  int ifaces_num;
  int iface_cur;
};

struct usb_info {
  int fd;
  struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length,
                                 struct usb_device_index* index)
{
  if (length < sizeof(*index->dev) + sizeof(*index->config))
    return false;
  memset(index, 0, sizeof(*index));
  index->dev = (struct usb_device_descriptor*)buffer;
  index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
  index->bDeviceClass = index->dev->bDeviceClass;
  index->bMaxPower = index->config->bMaxPower;
  index->config_length = length - sizeof(*index->dev);
  index->iface_cur = -1;
  size_t offset = 0;
  while (true) {
    if (offset + 1 >= length)
      break;
    uint8_t desc_length = buffer[offset];
    uint8_t desc_type = buffer[offset + 1];
    if (desc_length <= 2)
      break;
    if (offset + desc_length > length)
      break;
    if (desc_type == USB_DT_INTERFACE &&
        index->ifaces_num < USB_MAX_IFACE_NUM) {
      struct usb_interface_descriptor* iface =
          (struct usb_interface_descriptor*)(buffer + offset);
      index->ifaces[index->ifaces_num].iface = iface;
      index->ifaces[index->ifaces_num].bInterfaceNumber =
          iface->bInterfaceNumber;
      index->ifaces[index->ifaces_num].bAlternateSetting =
          iface->bAlternateSetting;
      index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
      index->ifaces_num++;
    }
    if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
      struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
      if (iface->eps_num < USB_MAX_EP_NUM) {
        memcpy(&iface->eps[iface->eps_num].desc, buffer + offset,
               sizeof(iface->eps[iface->eps_num].desc));
        iface->eps_num++;
      }
    }
    offset += desc_length;
  }
  return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev,
                                              size_t dev_len)
{
  int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
  if (i >= USB_MAX_FDS)
    return NULL;
  if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
    return NULL;
  __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
  return &usb_devices[i].index;
}

static struct usb_device_index* lookup_usb_index(int fd)
{
  int i;
  for (i = 0; i < USB_MAX_FDS; i++) {
    if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
      return &usb_devices[i].index;
    }
  }
  return NULL;
}

struct vusb_connect_string_descriptor {
  uint32_t len;
  char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
  uint32_t qual_len;
  char* qual;
  uint32_t bos_len;
  char* bos;
  uint32_t strs_len;
  struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0};

static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04};

static bool
lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
                           const struct usb_ctrlrequest* ctrl,
                           char** response_data, uint32_t* response_length)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  uint8_t str_idx;
  if (!index)
    return false;
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_GET_DESCRIPTOR:
      switch (ctrl->wValue >> 8) {
      case USB_DT_DEVICE:
        *response_data = (char*)index->dev;
        *response_length = sizeof(*index->dev);
        return true;
      case USB_DT_CONFIG:
        *response_data = (char*)index->config;
        *response_length = index->config_length;
        return true;
      case USB_DT_STRING:
        str_idx = (uint8_t)ctrl->wValue;
        if (descs && str_idx < descs->strs_len) {
          *response_data = descs->strs[str_idx].str;
          *response_length = descs->strs[str_idx].len;
          return true;
        }
        if (str_idx == 0) {
          *response_data = (char*)&default_lang_id[0];
          *response_length = default_lang_id[0];
          return true;
        }
        *response_data = (char*)&default_string[0];
        *response_length = default_string[0];
        return true;
      case USB_DT_BOS:
        *response_data = descs->bos;
        *response_length = descs->bos_len;
        return true;
      case USB_DT_DEVICE_QUALIFIER:
        if (!descs->qual) {
          struct usb_qualifier_descriptor* qual =
              (struct usb_qualifier_descriptor*)response_data;
          qual->bLength = sizeof(*qual);
          qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
          qual->bcdUSB = index->dev->bcdUSB;
          qual->bDeviceClass = index->dev->bDeviceClass;
          qual->bDeviceSubClass = index->dev->bDeviceSubClass;
          qual->bDeviceProtocol = index->dev->bDeviceProtocol;
          qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
          qual->bNumConfigurations = index->dev->bNumConfigurations;
          qual->bRESERVED = 0;
          *response_length = sizeof(*qual);
          return true;
        }
        *response_data = descs->qual;
        *response_length = descs->qual_len;
        return true;
      default:
        break;
      }
      break;
    default:
      break;
    }
    break;
  default:
    break;
  }
  return false;
}

typedef bool (*lookup_connect_out_response_t)(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done);

static bool lookup_connect_response_out_generic(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done)
{
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_SET_CONFIGURATION:
      *done = true;
      return true;
    default:
      break;
    }
    break;
  }
  return false;
}

#define ATH9K_FIRMWARE_DOWNLOAD 0x30
#define ATH9K_FIRMWARE_DOWNLOAD_COMP 0x31

static bool lookup_connect_response_out_ath9k(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done)
{
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_SET_CONFIGURATION:
      return true;
    default:
      break;
    }
    break;
  case USB_TYPE_VENDOR:
    switch (ctrl->bRequest) {
    case ATH9K_FIRMWARE_DOWNLOAD:
      return true;
    case ATH9K_FIRMWARE_DOWNLOAD_COMP:
      *done = true;
      return true;
    default:
      break;
    }
    break;
  }
  return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
  __u8 driver_name[UDC_NAME_LENGTH_MAX];
  __u8 device_name[UDC_NAME_LENGTH_MAX];
  __u8 speed;
};

enum usb_raw_event_type {
  USB_RAW_EVENT_INVALID = 0,
  USB_RAW_EVENT_CONNECT = 1,
  USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
  __u32 type;
  __u32 length;
  __u8 data[0];
};

struct usb_raw_ep_io {
  __u16 ep;
  __u16 flags;
  __u32 length;
  __u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
  __u32 type_control : 1;
  __u32 type_iso : 1;
  __u32 type_bulk : 1;
  __u32 type_int : 1;
  __u32 dir_in : 1;
  __u32 dir_out : 1;
};

struct usb_raw_ep_limits {
  __u16 maxpacket_limit;
  __u16 max_streams;
  __u32 reserved;
};

struct usb_raw_ep_info {
  __u8 name[USB_RAW_EP_NAME_MAX];
  __u32 addr;
  struct usb_raw_ep_caps caps;
  struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
  struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
  return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver,
                        const char* device)
{
  struct usb_raw_init arg;
  strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
  strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
  arg.speed = speed;
  return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
  return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_configure(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
  return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_stall(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

static int lookup_endpoint(int fd, uint8_t bEndpointAddress)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  int ep;
  if (!index)
    return -1;
  if (index->iface_cur < 0)
    return -1;
  for (ep = 0; index->ifaces[index->iface_cur].eps_num; ep++)
    if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress ==
        bEndpointAddress)
      return index->ifaces[index->iface_cur].eps[ep].handle;
  return -1;
}

static void set_interface(int fd, int n)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  int ep;
  if (!index)
    return;
  if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
    for (ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
      int rv = usb_raw_ep_disable(
          fd, index->ifaces[index->iface_cur].eps[ep].handle);
      if (rv < 0) {
      } else {
      }
    }
  }
  if (n >= 0 && n < index->ifaces_num) {
    for (ep = 0; ep < index->ifaces[n].eps_num; ep++) {
      int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
      if (rv < 0) {
      } else {
        index->ifaces[n].eps[ep].handle = rv;
      }
    }
    index->iface_cur = n;
  }
}

static int configure_device(int fd)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  if (!index)
    return -1;
  int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
  if (rv < 0) {
    return rv;
  }
  rv = usb_raw_configure(fd);
  if (rv < 0) {
    return rv;
  }
  set_interface(fd, 0);
  return 0;
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
  struct usb_raw_event inner;
  struct usb_ctrlrequest ctrl;
  char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
  struct usb_raw_ep_io inner;
  char data[USB_MAX_PACKET_SIZE];
};

static volatile long
syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
                     const struct vusb_connect_descriptors* descs,
                     lookup_connect_out_response_t lookup_connect_response_out)
{
  if (!dev) {
    return -1;
  }
  int fd = usb_raw_open();
  if (fd < 0) {
    return fd;
  }
  if (fd >= MAX_FDS) {
    close(fd);
    return -1;
  }
  struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
  if (!index) {
    return -1;
  }
  char device[32];
  sprintf(&device[0], "dummy_udc.%llu", procid);
  int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
  if (rv < 0) {
    return rv;
  }
  rv = usb_raw_run(fd);
  if (rv < 0) {
    return rv;
  }
  bool done = false;
  while (!done) {
    struct usb_raw_control_event event;
    event.inner.type = 0;
    event.inner.length = sizeof(event.ctrl);
    rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
    if (rv < 0) {
      return rv;
    }
    if (event.inner.type != USB_RAW_EVENT_CONTROL)
      continue;
    char* response_data = NULL;
    uint32_t response_length = 0;
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      if (!lookup_connect_response_in(fd, descs, &event.ctrl, &response_data,
                                      &response_length)) {
        usb_raw_ep0_stall(fd);
        continue;
      }
    } else {
      if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
        usb_raw_ep0_stall(fd);
        continue;
      }
      response_data = NULL;
      response_length = event.ctrl.wLength;
    }
    if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
        event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
      rv = configure_device(fd);
      if (rv < 0) {
        return rv;
      }
    }
    struct usb_raw_ep_io_data response;
    response.inner.ep = 0;
    response.inner.flags = 0;
    if (response_length > sizeof(response.data))
      response_length = 0;
    if (event.ctrl.wLength < response_length)
      response_length = event.ctrl.wLength;
    response.inner.length = response_length;
    if (response_data)
      memcpy(&response.data[0], response_data, response_length);
    else
      memset(&response.data[0], 0, response_length);
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
    } else {
      rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
    }
    if (rv < 0) {
      return rv;
    }
  }
  sleep_ms(200);
  return fd;
}

static volatile long syz_usb_connect(volatile long a0, volatile long a1,
                                     volatile long a2, volatile long a3)
{
  uint64_t speed = a0;
  uint64_t dev_len = a1;
  const char* dev = (const char*)a2;
  const struct vusb_connect_descriptors* descs =
      (const struct vusb_connect_descriptors*)a3;
  return syz_usb_connect_impl(speed, dev_len, dev, descs,
                              &lookup_connect_response_out_generic);
}

static volatile long syz_usb_connect_ath9k(volatile long a0, volatile long a1,
                                           volatile long a2, volatile long a3)
{
  uint64_t speed = a0;
  uint64_t dev_len = a1;
  const char* dev = (const char*)a2;
  const struct vusb_connect_descriptors* descs =
      (const struct vusb_connect_descriptors*)a3;
  return syz_usb_connect_impl(speed, dev_len, dev, descs,
                              &lookup_connect_response_out_ath9k);
}

static volatile long syz_usb_ep_write(volatile long a0, volatile long a1,
                                      volatile long a2, volatile long a3)
{
  int fd = a0;
  uint8_t ep = a1;
  uint32_t len = a2;
  char* data = (char*)a3;
  int ep_handle = lookup_endpoint(fd, ep);
  if (ep_handle < 0) {
    return -1;
  }
  struct usb_raw_ep_io_data io_data;
  io_data.inner.ep = ep_handle;
  io_data.inner.flags = 0;
  if (len > sizeof(io_data.data))
    len = sizeof(io_data.data);
  io_data.inner.length = len;
  memcpy(&io_data.data[0], data, len);
  int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data);
  if (rv < 0) {
    return rv;
  }
  sleep_ms(200);
  return 0;
}

static volatile long syz_usb_disconnect(volatile long a0)
{
  int fd = a0;
  int rv = close(fd);
  sleep_ms(200);
  return rv;
}

#define XT_TABLE_SIZE 1536
#define XT_MAX_ENTRIES 10

struct xt_counters {
  uint64_t pcnt, bcnt;
};

struct ipt_getinfo {
  char name[32];
  unsigned int valid_hooks;
  unsigned int hook_entry[5];
  unsigned int underflow[5];
  unsigned int num_entries;
  unsigned int size;
};

struct ipt_get_entries {
  char name[32];
  unsigned int size;
  void* entrytable[XT_TABLE_SIZE / sizeof(void*)];
};

struct ipt_replace {
  char name[32];
  unsigned int valid_hooks;
  unsigned int num_entries;
  unsigned int size;
  unsigned int hook_entry[5];
  unsigned int underflow[5];
  unsigned int num_counters;
  struct xt_counters* counters;
  char entrytable[XT_TABLE_SIZE];
};

struct ipt_table_desc {
  const char* name;
  struct ipt_getinfo info;
  struct ipt_replace replace;
};

static struct ipt_table_desc ipv4_tables[] = {
    {.name = "filter"}, {.name = "nat"},      {.name = "mangle"},
    {.name = "raw"},    {.name = "security"},
};

static struct ipt_table_desc ipv6_tables[] = {
    {.name = "filter"}, {.name = "nat"},      {.name = "mangle"},
    {.name = "raw"},    {.name = "security"},
};

#define IPT_BASE_CTL 64
#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
#define IPT_SO_GET_INFO (IPT_BASE_CTL)
#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)

struct arpt_getinfo {
  char name[32];
  unsigned int valid_hooks;
  unsigned int hook_entry[3];
  unsigned int underflow[3];
  unsigned int num_entries;
  unsigned int size;
};

struct arpt_get_entries {
  char name[32];
  unsigned int size;
  void* entrytable[XT_TABLE_SIZE / sizeof(void*)];
};

struct arpt_replace {
  char name[32];
  unsigned int valid_hooks;
  unsigned int num_entries;
  unsigned int size;
  unsigned int hook_entry[3];
  unsigned int underflow[3];
  unsigned int num_counters;
  struct xt_counters* counters;
  char entrytable[XT_TABLE_SIZE];
};

struct arpt_table_desc {
  const char* name;
  struct arpt_getinfo info;
  struct arpt_replace replace;
};

static struct arpt_table_desc arpt_tables[] = {
    {.name = "filter"},
};

#define ARPT_BASE_CTL 96
#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)

static void checkpoint_iptables(struct ipt_table_desc* tables, int num_tables,
                                int family, int level)
{
  struct ipt_get_entries entries;
  socklen_t optlen;
  int fd, i;
  fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < num_tables; i++) {
    struct ipt_table_desc* table = &tables[i];
    strcpy(table->info.name, table->name);
    strcpy(table->replace.name, table->name);
    optlen = sizeof(table->info);
    if (getsockopt(fd, level, IPT_SO_GET_INFO, &table->info, &optlen)) {
      switch (errno) {
      case EPERM:
      case ENOENT:
      case ENOPROTOOPT:
        continue;
      }
      exit(1);
    }
    if (table->info.size > sizeof(table->replace.entrytable))
      exit(1);
    if (table->info.num_entries > XT_MAX_ENTRIES)
      exit(1);
    memset(&entries, 0, sizeof(entries));
    strcpy(entries.name, table->name);
    entries.size = table->info.size;
    optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
    if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
      exit(1);
    table->replace.valid_hooks = table->info.valid_hooks;
    table->replace.num_entries = table->info.num_entries;
    table->replace.size = table->info.size;
    memcpy(table->replace.hook_entry, table->info.hook_entry,
           sizeof(table->replace.hook_entry));
    memcpy(table->replace.underflow, table->info.underflow,
           sizeof(table->replace.underflow));
    memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
  }
  close(fd);
}

static void reset_iptables(struct ipt_table_desc* tables, int num_tables,
                           int family, int level)
{
  struct xt_counters counters[XT_MAX_ENTRIES];
  struct ipt_get_entries entries;
  struct ipt_getinfo info;
  socklen_t optlen;
  int fd, i;
  fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < num_tables; i++) {
    struct ipt_table_desc* table = &tables[i];
    if (table->info.valid_hooks == 0)
      continue;
    memset(&info, 0, sizeof(info));
    strcpy(info.name, table->name);
    optlen = sizeof(info);
    if (getsockopt(fd, level, IPT_SO_GET_INFO, &info, &optlen))
      exit(1);
    if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
      memset(&entries, 0, sizeof(entries));
      strcpy(entries.name, table->name);
      entries.size = table->info.size;
      optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
      if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
        exit(1);
      if (memcmp(table->replace.entrytable, entries.entrytable,
                 table->info.size) == 0)
        continue;
    }
    table->replace.num_counters = info.num_entries;
    table->replace.counters = counters;
    optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
             table->replace.size;
    if (setsockopt(fd, level, IPT_SO_SET_REPLACE, &table->replace, optlen))
      exit(1);
  }
  close(fd);
}

static void checkpoint_arptables(void)
{
  struct arpt_get_entries entries;
  socklen_t optlen;
  unsigned i;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
    struct arpt_table_desc* table = &arpt_tables[i];
    strcpy(table->info.name, table->name);
    strcpy(table->replace.name, table->name);
    optlen = sizeof(table->info);
    if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &table->info, &optlen)) {
      switch (errno) {
      case EPERM:
      case ENOENT:
      case ENOPROTOOPT:
        continue;
      }
      exit(1);
    }
    if (table->info.size > sizeof(table->replace.entrytable))
      exit(1);
    if (table->info.num_entries > XT_MAX_ENTRIES)
      exit(1);
    memset(&entries, 0, sizeof(entries));
    strcpy(entries.name, table->name);
    entries.size = table->info.size;
    optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
    if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
      exit(1);
    table->replace.valid_hooks = table->info.valid_hooks;
    table->replace.num_entries = table->info.num_entries;
    table->replace.size = table->info.size;
    memcpy(table->replace.hook_entry, table->info.hook_entry,
           sizeof(table->replace.hook_entry));
    memcpy(table->replace.underflow, table->info.underflow,
           sizeof(table->replace.underflow));
    memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
  }
  close(fd);
}

static void reset_arptables()
{
  struct xt_counters counters[XT_MAX_ENTRIES];
  struct arpt_get_entries entries;
  struct arpt_getinfo info;
  socklen_t optlen;
  unsigned i;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
    struct arpt_table_desc* table = &arpt_tables[i];
    if (table->info.valid_hooks == 0)
      continue;
    memset(&info, 0, sizeof(info));
    strcpy(info.name, table->name);
    optlen = sizeof(info);
    if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &info, &optlen))
      exit(1);
    if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
      memset(&entries, 0, sizeof(entries));
      strcpy(entries.name, table->name);
      entries.size = table->info.size;
      optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
      if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
        exit(1);
      if (memcmp(table->replace.entrytable, entries.entrytable,
                 table->info.size) == 0)
        continue;
    } else {
    }
    table->replace.num_counters = info.num_entries;
    table->replace.counters = counters;
    optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
             table->replace.size;
    if (setsockopt(fd, SOL_IP, ARPT_SO_SET_REPLACE, &table->replace, optlen))
      exit(1);
  }
  close(fd);
}

#define NF_BR_NUMHOOKS 6
#define EBT_TABLE_MAXNAMELEN 32
#define EBT_CHAIN_MAXNAMELEN 32
#define EBT_BASE_CTL 128
#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
#define EBT_SO_GET_INFO (EBT_BASE_CTL)
#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO + 1)
#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES + 1)
#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO + 1)

struct ebt_replace {
  char name[EBT_TABLE_MAXNAMELEN];
  unsigned int valid_hooks;
  unsigned int nentries;
  unsigned int entries_size;
  struct ebt_entries* hook_entry[NF_BR_NUMHOOKS];
  unsigned int num_counters;
  struct ebt_counter* counters;
  char* entries;
};

struct ebt_entries {
  unsigned int distinguisher;
  char name[EBT_CHAIN_MAXNAMELEN];
  unsigned int counter_offset;
  int policy;
  unsigned int nentries;
  char data[0] __attribute__((aligned(__alignof__(struct ebt_replace))));
};

struct ebt_table_desc {
  const char* name;
  struct ebt_replace replace;
  char entrytable[XT_TABLE_SIZE];
};

static struct ebt_table_desc ebt_tables[] = {
    {.name = "filter"}, {.name = "nat"}, {.name = "broute"},
};

static void checkpoint_ebtables(void)
{
  socklen_t optlen;
  unsigned i;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
    struct ebt_table_desc* table = &ebt_tables[i];
    strcpy(table->replace.name, table->name);
    optlen = sizeof(table->replace);
    if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_INFO, &table->replace,
                   &optlen)) {
      switch (errno) {
      case EPERM:
      case ENOENT:
      case ENOPROTOOPT:
        continue;
      }
      exit(1);
    }
    if (table->replace.entries_size > sizeof(table->entrytable))
      exit(1);
    table->replace.num_counters = 0;
    table->replace.entries = table->entrytable;
    optlen = sizeof(table->replace) + table->replace.entries_size;
    if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_ENTRIES, &table->replace,
                   &optlen))
      exit(1);
  }
  close(fd);
}

static void reset_ebtables()
{
  struct ebt_replace replace;
  char entrytable[XT_TABLE_SIZE];
  socklen_t optlen;
  unsigned i, j, h;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
    struct ebt_table_desc* table = &ebt_tables[i];
    if (table->replace.valid_hooks == 0)
      continue;
    memset(&replace, 0, sizeof(replace));
    strcpy(replace.name, table->name);
    optlen = sizeof(replace);
    if (getsockopt(fd, SOL_IP, EBT_SO_GET_INFO, &replace, &optlen))
      exit(1);
    replace.num_counters = 0;
    table->replace.entries = 0;
    for (h = 0; h < NF_BR_NUMHOOKS; h++)
      table->replace.hook_entry[h] = 0;
    if (memcmp(&table->replace, &replace, sizeof(table->replace)) == 0) {
      memset(&entrytable, 0, sizeof(entrytable));
      replace.entries = entrytable;
      optlen = sizeof(replace) + replace.entries_size;
      if (getsockopt(fd, SOL_IP, EBT_SO_GET_ENTRIES, &replace, &optlen))
        exit(1);
      if (memcmp(table->entrytable, entrytable, replace.entries_size) == 0)
        continue;
    }
    for (j = 0, h = 0; h < NF_BR_NUMHOOKS; h++) {
      if (table->replace.valid_hooks & (1 << h)) {
        table->replace.hook_entry[h] =
            (struct ebt_entries*)table->entrytable + j;
        j++;
      }
    }
    table->replace.entries = table->entrytable;
    optlen = sizeof(table->replace) + table->replace.entries_size;
    if (setsockopt(fd, SOL_IP, EBT_SO_SET_ENTRIES, &table->replace, optlen))
      exit(1);
  }
  close(fd);
}

static void checkpoint_net_namespace(void)
{
  checkpoint_ebtables();
  checkpoint_arptables();
  checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]),
                      AF_INET, SOL_IP);
  checkpoint_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]),
                      AF_INET6, SOL_IPV6);
}

static void reset_net_namespace(void)
{
  reset_ebtables();
  reset_arptables();
  reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]),
                 AF_INET, SOL_IP);
  reset_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]),
                 AF_INET6, SOL_IPV6);
}

static void setup_common()
{
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void loop();

static void sandbox_common()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  setsid();
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = (200 << 20);
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 32 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 0;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
  typedef struct {
    const char* name;
    const char* value;
  } sysctl_t;
  static const sysctl_t sysctls[] = {
      {"/proc/sys/kernel/shmmax", "16777216"},
      {"/proc/sys/kernel/shmall", "536870912"},
      {"/proc/sys/kernel/shmmni", "1024"},
      {"/proc/sys/kernel/msgmax", "8192"},
      {"/proc/sys/kernel/msgmni", "1024"},
      {"/proc/sys/kernel/msgmnb", "1024"},
      {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
  };
  unsigned i;
  for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
    write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid)
{
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static void drop_caps(void)
{
  struct __user_cap_header_struct cap_hdr = {};
  struct __user_cap_data_struct cap_data[2] = {};
  cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
  cap_hdr.pid = getpid();
  if (syscall(SYS_capget, &cap_hdr, &cap_data))
    exit(1);
  const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
  cap_data[0].effective &= ~drop;
  cap_data[0].permitted &= ~drop;
  cap_data[0].inheritable &= ~drop;
  if (syscall(SYS_capset, &cap_hdr, &cap_data))
    exit(1);
}

static int do_sandbox_none(void)
{
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  setup_common();
  sandbox_common();
  drop_caps();
  if (unshare(CLONE_NEWNET)) {
  }
  loop();
  exit(1);
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  int i;
  for (i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_loop()
{
  checkpoint_net_namespace();
}

static void reset_loop()
{
  reset_net_namespace();
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void close_fds()
{
  int fd;
  for (fd = 3; fd < MAX_FDS; fd++)
    close(fd);
}

struct thread_t {
  int created, call;
  event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    event_wait(&th->ready);
    event_reset(&th->ready);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    event_set(&th->done);
  }
  return 0;
}

static void execute_one(void)
{
  int i, call, thread;
  for (call = 0; call < 7; call++) {
    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
         thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        event_init(&th->ready);
        event_init(&th->done);
        event_set(&th->done);
        thread_start(thr, th);
      }
      if (!event_isset(&th->done))
        continue;
      event_reset(&th->done);
      th->call = call;
      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
      event_set(&th->ready);
      event_timedwait(&th->done,
                      45 + (call == 0 ? 3000 : 0) + (call == 1 ? 300 : 0) +
                          (call == 2 ? 3000 : 0) + (call == 3 ? 300 : 0) +
                          (call == 4 ? 300 : 0) + (call == 5 ? 300 : 0) +
                          (call == 6 ? 300 : 0));
      break;
    }
  }
  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
    sleep_ms(1);
  close_fds();
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  setup_loop();
  int iter;
  for (iter = 0;; iter++) {
    reset_loop();
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

void execute_call(int call)
{
  intptr_t res = 0;
  switch (call) {
  case 0:
    *(uint8_t*)0x200000c0 = 0x12;
    *(uint8_t*)0x200000c1 = 1;
    *(uint16_t*)0x200000c2 = 0x200;
    *(uint8_t*)0x200000c4 = -1;
    *(uint8_t*)0x200000c5 = -1;
    *(uint8_t*)0x200000c6 = -1;
    *(uint8_t*)0x200000c7 = 0x40;
    *(uint16_t*)0x200000c8 = 0xcf3;
    *(uint16_t*)0x200000ca = 0x9271;
    *(uint16_t*)0x200000cc = 0x108;
    *(uint8_t*)0x200000ce = 1;
    *(uint8_t*)0x200000cf = 2;
    *(uint8_t*)0x200000d0 = 3;
    *(uint8_t*)0x200000d1 = 0x1c;
    *(uint8_t*)0x200000d2 = 9;
    *(uint8_t*)0x200000d3 = 2;
    *(uint16_t*)0x200000d4 = 0x48;
    *(uint8_t*)0x200000d6 = 1;
    *(uint8_t*)0x200000d7 = 1;
    *(uint8_t*)0x200000d8 = 0;
    *(uint8_t*)0x200000d9 = 0x80;
    *(uint8_t*)0x200000da = 0xfa;
    *(uint8_t*)0x200000db = 9;
    *(uint8_t*)0x200000dc = 4;
    *(uint8_t*)0x200000dd = 0;
    *(uint8_t*)0x200000de = 0;
    *(uint8_t*)0x200000df = 6;
    *(uint8_t*)0x200000e0 = -1;
    *(uint8_t*)0x200000e1 = 0;
    *(uint8_t*)0x200000e2 = 0;
    *(uint8_t*)0x200000e3 = 0;
    *(uint8_t*)0x200000e4 = 9;
    *(uint8_t*)0x200000e5 = 5;
    *(uint8_t*)0x200000e6 = 1;
    *(uint8_t*)0x200000e7 = 2;
    *(uint16_t*)0x200000e8 = 0x200;
    *(uint8_t*)0x200000ea = 0;
    *(uint8_t*)0x200000eb = 0;
    *(uint8_t*)0x200000ec = 0;
    *(uint8_t*)0x200000ed = 9;
    *(uint8_t*)0x200000ee = 5;
    *(uint8_t*)0x200000ef = 0x82;
    *(uint8_t*)0x200000f0 = 2;
    *(uint16_t*)0x200000f1 = 0x200;
    *(uint8_t*)0x200000f3 = 0;
    *(uint8_t*)0x200000f4 = 0;
    *(uint8_t*)0x200000f5 = 0;
    *(uint8_t*)0x200000f6 = 9;
    *(uint8_t*)0x200000f7 = 5;
    *(uint8_t*)0x200000f8 = 0x83;
    *(uint8_t*)0x200000f9 = 3;
    *(uint16_t*)0x200000fa = 0x40;
    *(uint8_t*)0x200000fc = 1;
    *(uint8_t*)0x200000fd = 0;
    *(uint8_t*)0x200000fe = 0;
    *(uint8_t*)0x200000ff = 9;
    *(uint8_t*)0x20000100 = 5;
    *(uint8_t*)0x20000101 = 4;
    *(uint8_t*)0x20000102 = 3;
    *(uint16_t*)0x20000103 = 0x40;
    *(uint8_t*)0x20000105 = 1;
    *(uint8_t*)0x20000106 = 0;
    *(uint8_t*)0x20000107 = 0;
    *(uint8_t*)0x20000108 = 9;
    *(uint8_t*)0x20000109 = 5;
    *(uint8_t*)0x2000010a = 5;
    *(uint8_t*)0x2000010b = 2;
    *(uint16_t*)0x2000010c = 0x200;
    *(uint8_t*)0x2000010e = 0;
    *(uint8_t*)0x2000010f = 0;
    *(uint8_t*)0x20000110 = 0;
    *(uint8_t*)0x20000111 = 9;
    *(uint8_t*)0x20000112 = 5;
    *(uint8_t*)0x20000113 = 6;
    *(uint8_t*)0x20000114 = 2;
    *(uint16_t*)0x20000115 = 0x200;
    *(uint8_t*)0x20000117 = 0;
    *(uint8_t*)0x20000118 = 0;
    *(uint8_t*)0x20000119 = 0;
    res = -1;
    res = syz_usb_connect_ath9k(3, 0x92, 0x200000c0, 0);
    if (res != -1)
      r[0] = res;
    break;
  case 1:
    syz_usb_disconnect(-1);
    break;
  case 2:
    res = -1;
    res = syz_usb_connect(0, 0x36, 0x20000340, 0);
    if (res != -1)
      r[1] = res;
    break;
  case 3:
    syz_usb_disconnect(r[1]);
    break;
  case 4:
    syz_usb_disconnect(-1);
    break;
  case 5:
    syz_usb_disconnect(-1);
    break;
  case 6:
    memcpy(
        (void*)0x20000380,
        "\x05\x0c\x00\x4e\x83\xe8\x91\x02\xec\x8b\xde\x08\x7a\x6b\xfe\xde\x66"
        "\xe1\x7d\x55\xdc\x48\xfb\x42\xba\xad\xd1\x31\xb8\x40\x6d\x72\x32\xf1"
        "\xbd\x2c\x04\x3c\xbe\x8f\x6a\x60\x1d\xff\x94\xe5\x3c\x70\x56\xe8\x2e"
        "\xf6\x26\xd0\xa8\xb9\xd7\x7a\x17\xbf\xf4\x50\x9b\x9a\x9a\x3c\x6d\x35"
        "\x33\x7f\xec\x00\x25\x51\xd9\xe8\x31\x78\x8a\xd9\x8b\x8a\x00\xa8\xab"
        "\xaf\x61\xda\x2c\x59\x57\x35\x72\x22\x18\xb0\x55\xa9\x47\xcc\x9d\x0a"
        "\x30\x05\x10\x86\x5a\x33\x8b\x82\x2f\x39\x06\x61\xba\xcc\xa7\x66\x01"
        "\x52\x78\x85\x6e\x6f\x67\xe6\x1b\x89\x3c\xe7\x1b\x9a\x3a\xa3\xf0\x97"
        "\x84\x8b\x4a\x2e\xc8\x86\xa5\xf9\x7c\x47\xd7\x65\x41\xf0\xdd\xf1\xaa"
        "\x6d\xe2\x6d\x3c\x9b\x97\x41\xb1\x57\xea\x6c\xe0\x5a\x7a\x28\x96\x62"
        "\xc2\x52\x70\x7b\x50\x3d\xe4\xe2\x27\x1a\xcc\x41\x8a\xef\xd1\xc2\xb6"
        "\x10\xc2\xcf\x0d\x2d\x85\x69\x02\x5f\xdd\x09\xcb\xbc\xad\x3f\x7d\x3f"
        "\x7e\x8f\x97\x81\xdb\x43\xba\x3a\x52\x94\x85\xac\x8e\xaa\xcc\x11\x05"
        "\xb3\x7f\x14\xcc\xea\x22\xf8\x2c\x78\x62\x06\x4c\x10\xc2\xb6\x18\x35"
        "\x40\x1f\x79\xf8\xa5\x0e\x78\xbd\x95\xbd\x4c\xbb\xb5\x10\x8d\x3d\x6b"
        "\x6e\x11\xbc\xb0\x32\xf4\x75\x66\x3a\xf1\x0d\x9d\xd1\x24\x67\x88\x2e"
        "\xcb\x68\xcb\xdb\x05\x59\x48\xf1\x1d\xd0\x4c\x9e\x7f\xfc\x97\x91\x6b"
        "\x19\xa8\x79\xf9\xf5\x30\xa8\x88\x21\xb8\x47\xa5\x40\x99\x01\x57\x05"
        "\x63\xac\xa7\xe0\xce\xec\xf5\x4d\xde\x2c\xd1\xdc\xd9\x93\x60\x36\xa7"
        "\x36\x4e\xdc\x68\x7a\xda\xd3\x0c\xe2\x58\x28\xcb\x0d\x68\x10\xd2\xe0"
        "\xfa\x6d\x1e\xb8\xfa\xf9\x8a\xad\xb1\x01\xbd\x58\x3b\xb3\x5c\x2b\x93"
        "\x25\x0f\x1b\xb3\xcd\x4f\x95\xa4\x3f\xdd\x56\x70\xe5\x9a\x7d\x5a\x3b"
        "\x97\xa2\x08\x00\xfe\xc9\x7a\xb0\x18\x18\xf1\x96\xa7\xed\x03\x52\x35"
        "\xcc\xf8\x4d\xb1\x09\x00\x00\x00\x16\x8c\xfa\x07\x1e\x68\x16\x8e\xfb"
        "\xbd\x33\x2d\x1b\xd6\xd0\x2d\x7b\xc3\xd2\x3d\xd3\x83\x59\x06\x78\x49"
        "\x36\xa1\x0e\x87\x2a\xf2\xea\xcd\x96\x13\xa7\x93\x68\xce\x7d\x54\x02"
        "\xde\x4f\x66\x27\x78\x26\x1e\xd7\x05\x5e\x9b\x6d\x6e\xb7\xda\x91\x60"
        "\x9d\x23\xe4\xc9\x33\x5d\x9d\xe6\x3a\x7d\xf1\xad\xe3\xbc\xe7\xa5\x32"
        "\xbb\xf8\x53\xc6\x2f\x26\x9f\x79\x41\x98\x16\x26\xb8\xfa\x1c\x2e\x8d"
        "\x02\x69\x30\x90\x34\xff\x82\x89\x3c\x9f\x7c\xa8\x4b\xbf\xd4\x6f\x49"
        "\x35\x71\x0f\x74\xd5\x51\xee\x9e\xeb\x63\xb1\x73\xdd\xba\xcf\xb5\xf1"
        "\xa7\x5d\x30\x7a\x3e\x0b\xcf\xb6\xc8\xee\x0e\xfd\x8f\xdb\x3c\x03\x80"
        "\xbf\xb5\x06\xd7\x3e\x45\x7a\xf8\xc2\x26\x3b\xd0\x0e\xa1\x0f\xd2\x74"
        "\xf2\x94\xb7\x70\xe8\x7e\xcf\xe1\x0a\xc2\x15\xa1\x2d\xe1\x12\x69\x8c"
        "\x67\xc3\xa6\xef\x72\xe2\x14\xe0\x7c\xa6\xca\x37\x66\xd8\x1d\x35\x5a"
        "\xf3\x58\x30\xd9\xd7\x66\x40\xba\xcd\xfa\xf3\xee\xdb\x5a\x65\x6c\xfd"
        "\x1e\xdc\x2c\x76\xdf\x8a\xfa\xfd\xba\xc2\x0a\xcc\x8d\xe4\xd4\x93\x81"
        "\x4d\xa4\x8b\x7b\x9a\xe1\xfe\x6c\xc0\xd1\x02\x87\x79\x32\x7a\xfe\xb3"
        "\x21\x5f\xf4\xef\x4a\x58\xd2\xf0\x6c\xae\x67\xe1\x53\xee\xcf\x67\x34"
        "\xbb\xe7\x61\x6a\xe9\xe8\x1d\x7e\x33\x67\xc1\x8e\x16\xd3\x92\xa9\x68"
        "\xbf\x39\xab\x1e\x0e\x59\x74\x2d\x06\x9f\x9d\xdc\x82\x92\x7d\xca\x25"
        "\xa3\x83\x79\x3c\xa2\x94\xe1\x5e\x7d\x6d\xfc\xd0\x19\x08\x4d\x34\x75"
        "\xe4\x55\x54\x56\xd4\xd5\x96\xe0\x0c\x39\x61\x42\x45\xb6\x07\xa9\x3b"
        "\xcb\x29\xe5\x28\x6e\x13\x91\xb9\x03\x96\x63\x82\x55\x56\xef\xd3\x9a"
        "\xd9\x50\x9f\x9e\x65\x8f\x62\xc6\x68\x50\xd0\x2b\x04\xf7\x81\x32\x1a"
        "\xb3\x91\x4f\x54\xda\xac\xe0\x72\xe4\x65\xb1\x57\x6c\xbd\x33\x3b\x91"
        "\x97\x25\x59\xf7\x41\x1c\xa2\x5b\xba\xf1\xfe\x40\xbb\x3e\x9a\x68\x0f"
        "\x33\x30\x25\xec\xc7\xfb\x1a\x4e\x8a\xf1\x1a\x82\x93\xa9\x1e\x86\x09"
        "\x15\x85\x72\x34\x1b\xa4\x29\x68\x72\x24\x21\x2a\xc9\x77\xfa\x05\x8c"
        "\x4b\xd6\xf9\xe0\xc8\x32\x9e\x97\x05\x22\x2a\x3b\x0e\x46\x3c\x59\x7f"
        "\x5b\x6b\x40\x71\x68\xc1\x6c\x3a\x16\x69\x60\x4e\x00\x70\x4c\x00\xf5"
        "\x01\xfd\x3f\xef\x6f\x85\x35\xc6\xce\xf3\x34\xa2\x57\x89\xce\x6b\x7b"
        "\xf6\xdc\x21\x8b\x69\xd3\x6b\x87\xc5\x82\x15\x7c\x1b\xa2\x05\xeb\x30"
        "\xbc\x33\xe2\x56\x71\x24\x7e\xaa\x67\x47\x1e\x70\x4b\x92\x2d\x30\xd1"
        "\xc8\xde\xb9\xf3\x97\xa2\xfc\x43\x49\xcd\xc9\xa3\x73\x17\x13\x0f\x2d"
        "\x78\x51\xf8\xef\x5e\x2d\xd5\xdf\x46\x11\xcc\x1d\x57\x1a\xc1\xf6\x04"
        "\x5a\xc1\xb5\x9f\xc1\x2b\xaf\xb8\x8f\x50\xe1\x12\x6f\x64\x80\xd9\xea"
        "\x22\x3c\x12\x3c\x99\x15\x0f\x05\xd0\x18\xd1\xc8\xe5\x8e\xfc\x47\xeb"
        "\xfe\xc2\xd8\xe9\x15\xd9\x32\xae\xf4\x73\xa0\x03\x90\x32\xf8\x83\x64"
        "\xb8\x84\x9f\x8b\xc0\x22\xff\x7a\x10\x50\x13\x23\x01\xb5\xaf\x21\xcc"
        "\x1a\x29\x61\x9f\x9a\xeb\xaa\xd6\xa4\x4d\x2e\x23\x40\xaa\xdd\x83\x3a"
        "\x21\x71\xbf\x87\x05\x4c\x34\x2f\xab\x6f\x9b\x82\xa1\xb9\x0f\x4b\x78"
        "\xcf\x46\x7a\x67\xa0\x28\x89\xd8\xd2\x1c\xdc\xbe\x4d\xd8\x66\x8e\xc2"
        "\xd3\x02\x78\x0c\xfc\x6e\xad\x02\x28\xc6\x65\x16\xd9\xd0\x44\xac\x11"
        "\xae\x5c\x3c\x3f\x8e\x2a\x1f\x3e\x59\x56\x79\x63\x35\x1d\x7f\xd6\x7c"
        "\x6a\x04\xd2\x1b\x3f\x50\xe2\xfe\xaa\x57\x7b\xad\x68\x44\xd4\x9b\xa3"
        "\x1d\xbf\x1d\xb3\x4f\x23\x90\x22\x2b\xbd\xc7\x91\xc8\xc2\x7b\x1c\xb7"
        "\xbd\xf0\x0c\x3c\x7e\x4b\xc2\x39\x46\x8e\xa9\x3b\x7a\x95\xcf\x48\x64"
        "\x3d\x1c\x17\xf2\x99\x0a\xe3\x3d\xfc\xb8\x17\xcc\xed\x04\x21\xd5\xcd"
        "\x3b\x7e\x49\x83\x83\x52\x36\xe7\x36\xcf\x0b\xc5\x5f\xbe\x75\x42\x11"
        "\x4e\x6f\xa9\xf1\x59\x6f\xc0\x32\x9e\x3d\x26\xf9\x7c\x4b\x7d\x54\xca"
        "\x96\x3c\x89\x64\x5d\x29\x43\xa7\xec\x65\xed\x43\xfd\xe2\x14\xbe\xb1"
        "\xc6\x64\x8d\x43\x84\x96\xbe\x30\x06\x33\xdb\x5d\xad\x50\x63\xed\x9a"
        "\xbc\x25\xc3\x8b\x6e\x14\x14\xc3\x27\x2f\x0d\xc1\x12\xed\x78\x50\x77"
        "\xb7\xcc\x79\x12\xb6\x5f\x53\xcb\x68\x39\x49\xfc\x32\x31\x5a\x29\xdc"
        "\x27\x6c\xb7\x05\x05\x31\x17\xb6\xcf\x7a\x28\xc7\x6a\xc5\xd5\x8c\x3c"
        "\x01\xa7\x1e\x41\xd9\x00\x53\x81\xa9\x1b\x01\xc4\xf2\x57\x77\x4f\xef"
        "\x58\xb2\x30\x88\xc0\xf3\xcf\xd1\xc4\xa4\xfb\x01\x05\x2c\x60\x69\x20"
        "\x92\x59\x36\x85\xce\x62\xec\x42\x47\xdb\x78\x65\x04\x7c\x69\x32\x0b"
        "\x14\x62\x7f\x88\x41\x37\x10\x5d\x43\xf1\xeb\xa6\xcd\x3e\xe1\xfd\xf2"
        "\xba\xe1\x1c\x5c\x3e\xd8\x72\x8c\x73\x95\xd0\xb1\x73\xee\x85\xe6\x30"
        "\x56\x94\x1b\xff\xd8\xf2\xe9\x8b\xa0\x55\x5c\xe3\xb4\x58\xc3\xdd\xca"
        "\xa7\xa8\xd8\x73\x9f\xe5\x9c\xd1\xcc\x4e\xcc\x00\xde\x56\x1e\xbf\x46"
        "\xbb\x88\x5e\x47\xe1\x69\x93\x0f\x70\x88\xd3\xb1\xf8\x94\x20\xa3\xb8"
        "\xda\xf0\x65\xba\x57\xca\xc0\xac\x06\xe6\x80\x83\x8a\x21\xcb\xfe\xe6"
        "\xaa\xb5\x79\x6b\x9a\xe6\xa4\x67\x37\x89\x98\xe7\x42\xe6\xb4\xd2\xba"
        "\xa9\xbf\x5a\xb9\xbd\x44\xa2\xea\x3e\x1c\xfb\x7a\x8a\x6d\xc3\x4f\x30"
        "\x39\xf6\xda\xff\x5b\xeb\xcb\xab\xd0\x68\x3a\xd9\x04\x9f\x28\x85\x32"
        "\xec\x53\xc6\x99\x13\xda\xd3\x0c\x1f\x0b\x1a\xe0\x32\xb9\xc3\x5d\x4d"
        "\xaf\x44\x89\xd7\x5f\xbe\x3a\xcf\x2b\xd3\x8d\x84\x5f\x55\x54\x60\xde"
        "\x89\xf1\xf8\x54\x84\x56\x96\xa9\xed\xf9\x21\x89\xb4\x7e\x7d\xeb\x02"
        "\x83\x3f\x70\x40\xd6\xe5\xa1\x59\x59\xc7\x2c\x71\x22\x82\xfb\x40\x00"
        "\x8c\xf3\x10\xc9\x9e\x52\x1c\x70\x95\x35\x13\x2a\x25\x34\xfb\x02\xb1"
        "\x8c\x01\xe8\xc8\xd5\x17\xb7\x23\x11\xf1\x62\x1b\x67\x38\x10\x49\xaf"
        "\xf0\x19\x4f\x39\x05\x31\xe4\xdf\x7d\x34\x94\xd3\x62\xf7\xfa\x06\x00"
        "\x00\xb0\x00\xf5\xe1\xb4\x59\xb0\x95\x1f\x76\x0f\x43\xfd\x8a\x99\x32"
        "\x1e\xa6\xcb\xd1\xa5\x00\x0d\x56\x2d\x8e\x65\x33\x9d\xed\xcf\x6f\xe0"
        "\xef\xaf\xa1\x84\xf7\x87\x15\x4b\x08\xad\x74\xf5\x2e\x2c\xa5\x1b\x29"
        "\x42\x35\x00\x23\xf8\x7f\x1e\xf4\xd1\xf4\xcf\xa7\xd8\x78\xbc\xeb\xa5"
        "\x87\x5b\x3c\xe9\xc7\x15\x56\xda\x9b\x65\x4a\xb3\xab\x9c\x92\x78\x12"
        "\x8c\xb3\x5b\xff\xc6\xe6\xa8\x9c\xa1\x37\xe3\xf7\x45\x8d\x08\xaa\x2e"
        "\x63\x99\xf3\xbe\xf8\x2b\xd2\x64\x65\xaf\x46\x6d\x14\x4b\xbb\x1c\x27"
        "\xa8\xe0\xe8\xb2\x36\xcd\x63\xdd\xd5\x7d\x22\x4b\x86\x06\x1e\x06\xf5"
        "\xda\xec\x86\xc6\xec\x0e\x12\x6a\x7f\xa1\x83\x3b\xd6\x81\x9a\xf4\x34"
        "\xa5\x57\xf1\xf6\x39\x32\x68\x70\xe8\x0b\xde\x65\x01\xde\xf4\xe1\xed"
        "\x46\x98\x2a\xb6\x3d\xb2\xf4\x21\x06\xfa\xdf\x52\xe4\x1e\xcb\x97\x72"
        "\x2c\xf8\x9a\xe9\xad\xf3\x16\xc8\x47\x2a\x1f\x9b\x05\xff\xfc\xd2\xb5"
        "\xfd\xf6\x83\x57\x0b\x90\x79\xe2\x36\xbe\xb4\x70\x6e\x05\x96\xba\xf1"
        "\xc7\xf1\x80\x54\x4d\x34\x11\x4c\x76\xc8\x10\x70\xd7\x76\x97\xe8\x9c"
        "\x6d\xb2\xc5\x74\x37\xea\x2b\x7a\x4a\x41\xfe\x23\x2e\xa6\x9a\xfd\xfc"
        "\x49\x55\xbd\x7b\x12\xeb\x72\x4b\x49\x58\x09\x9f\xc1\xda\x47\x15\x37"
        "\x31\x37\xc3\xb6\x55\x35\x7f\xc1\xea\xdf\x01\x80\x41\x9e\x26\x67\xc1"
        "\x9f\xd5\xac\xb0\x03\xbc\xb6\xdc\xd0\x56\x56\xcf\xf8\x73\x7a\x0b\x70"
        "\x88\x0d\xf1\x7a\x15\x4a\x89\xbf\x5f\x0a\x72\x66\x4c\xa5\x7c\x95\x74"
        "\xdb\x73\xbe\xc1\x17\xc8\x51\xe3\x99\xcd\xf5\xd4\xd4\x39\xe2\xdc\x7d"
        "\xff\xbe\xe0\x0a\x4c\xb4\x58\x9e\xb6\x14\xcb\x4e\x30\x14\xce\x9d\x8c"
        "\x75\x0b\x3c\x9c\x36\xd6\x43\xec\x8e\x8c\xde\xb1\x36\x27\x8a\x5d\xfa"
        "\x64\x47\x36\xfb\x64\x0f\x7f\xf5\x32\x97\x6a\xb7\x45\xfa\x35\x60\xba"
        "\x5c\x9a\x31\xec\x73\xbc\xc3\xdf\xc0\xa5\x1f\x59\x03\x33\x31\x60\xd6"
        "\xa3\x49\xe4\xe9\xad\x9e\xb2\x5f\x25\xac\x88\xe0\xde\xb8\x4b\xa2\x61"
        "\x92\xf4\x40\xd2\xaf\xbd\x03\x9e\xd2\x60\xcd\x41\xd8\xf8\xbc\xbd\xd6"
        "\xfa\x21\x82\xac\xbc\xde\xac\x53\x81\x81\xfd\x5e\xfb\x08\x87\x7e\x6a"
        "\x73\xaf\x1d\xb1\x41\x44\xe7\xa2\x5a\x44\x67\xb1\x5a\x6b\x32\x68\x3b"
        "\x97\x7f\x8a\x69\x96\x05\x2e\x30\x97\x32\x0b\xeb\x64\xad\xe1\x8f\x1c"
        "\xaa\x48\x09\x36\xe2\x77\xf9\xdd\xd4\x1a\xe6\x47\xec\x20\x83\xe8\x1c"
        "\x8b\xb8\xa8\x51\x47\x5a\x81\x52\xdf\xff\xaa\x74\xb4\x74\x26\xc9\xc7"
        "\x43\x0b\x23\x00\x4b\x87\xec\x1c\xd3\x90\x1d\x7d\x81\xa6\xa2\x43\xe6"
        "\x1f\x1c\x35\x34\xaf\xef\x05\x14\xbb\x45\x41\xe5\x16\xe7\xdb\x11\xcb"
        "\x58\x07\x5c\xfa\x5c\x43\xe1\x87\x40\x31\x03\x6b\x77\x66\xf0\xf8\x6f"
        "\x53\x21\x57\x66\xf4\xb6\x9b\x00\xc5\xe2\xa1\x0e\x09\x71\x59\x86\xa5"
        "\xbf\x52\x3b\xf5\xab\x9c\xb4\xdb\x36\x4c\x5b\x92\x84\x39\xd7\xbd\x31"
        "\x58\x6f\x76\x29\xc2\xc4\x9c\x9b\x41\xae\xfd\x6c\xd7\xdf\xa0\x42\x8c"
        "\x82\x62\x6a\x2b\x9b\x09\xe1\xda\x5d\xfb\xbe\xa0\xe6\xc8\x0f\xf2\x6c"
        "\x25\xca\xfe\xdf\x0b\x60\xe5\x72\xed\x85\xff\x84\x92\x9b\x55\xe5\xf3"
        "\xda\xb8\xb1\xb4\x74\xc7\x32\x7c\xef\x1c\x06\x5e\xff\x86\xce\xb0\xc3"
        "\xf4\x8d\xfb\x8b\xf7\x3c\x8b\x7b\x4b\xc3\xb5\xee\x45\x4f\x3f\x98\x96"
        "\x66\xa0\x3f\x0a\x43\xc5\x86\x65\x01\x66\xeb\x39\x94\x15\x40\xa4\xe7"
        "\xb0\x10\xb8\x30\xc7\x6b\x73\x46\xc4\xa4\xa6\x12\x54\x97\xcf\xe7\x0f"
        "\xa8\xc4\x77\xd7\x66\xb2\x37\x61\x89\x39\x5e\x15\x83\x05\x71\x55\xa5"
        "\x17\x98\xb0\x39\xb5\x46\xc2\xe5\x47\xd6\xc4\xc2\x01\x39\x00\x70\x14"
        "\xdf\x69\xc6\xdf\xf9\x4c\x48\xca\x14\x65\xd6\x63\x23\xe2\x5f\x8f\xf9"
        "\x4f\xc9\x88\xeb\x26\x17\x52\xa9\x9b\x36\x14\x09\xa5\xba\x87\x9c\x75"
        "\x69\xa8\x46\xd5\x94\x50\x7a\x26\xc5\x99\xf8\x08\x1a\x84\xa3\x93\x7c"
        "\x95\xb5\xc7\xdc\x31\xf1\x15\xa7\xda\xa0\x11\xe3\x27\xb5\x03\x3c\x3a"
        "\x25\x07\xbc\x0a\xf6\x87\xbe\x52\xa8\xb4\xf4\x75\x0e\xbf\xd0\x7a\xa5"
        "\xe8\x76\xc0\xcb\xb3\xba\x7b\x44\x6a\x9b\x94\x97\x92\x6d\x4f\x6b\xad"
        "\x23\x6f\xc8\x86\x18\x0b\x9b\x93\xfe\x4b\x5d\x8e\x23\x4c\x84\x8d\xca"
        "\x48\xef\x2d\xf3\xb1\x1a\x59\x55\x45\xa9\x00\x3a\xc1\xa8\x6f\x9c\x42"
        "\x83\x8f\xa4\xff\x23\xa3\x4e\x43\x5f\x32\xc0\x81\x6a\x02\x55\x54\x69"
        "\x6c\x47\xad\xd7\x42\x24\x3d\xf5\xe5\x2a\x08\x52\x72\xad\x8a\xee\x35"
        "\xc5\x65\x58\x50\x5c\x6d\xad\x45\xbd\x51\x7f\xaa\x49\x9b\x6b\x5e\xcc"
        "\x99\x05\x1c\xe0\x90\x1a\x65\x1b\x93\x43\x0f\x57\x45\x6d\x9f\x4a\xe8"
        "\x50\x2b\xfa\x82\xec\x75\x6e\xd9\x52\x2f\xcc\xe8\xf5\xfb\xad\xf0\xfc"
        "\xcb\xfb\xb8\x8a\x47\xd7\x0f\x9e\xf6\x0a\xed\x90\x81\xc8\x0d\x78\xb0"
        "\x18\x62\xd6\x33\x57\x75\x07\x69\xac\xf7\xa8\x37\x3d\x56\x81\x45\x72"
        "\xe7\xfc\xc8\xe3\x2b\xfd\xde\x85\xf6\x51\xfb\xdc\x17\xd8\xb6\x25\x19"
        "\x85\x81\xc6\xa0\x0c\x60\x3d\x56\xb8\x62\x82\x9d\xcf\x46\x6a\x4c\xc1"
        "\x21\xb4\x10\x76\x64\xe0\x8c\x58\x4b\xd2\x10\x6a\x91\x8b\x01\xc6\x4c"
        "\x78\x59\xf1\x47\x15\xcb\x04\x27\xc3\x13\x78\x3d\xcf\xe7\xfa\xb0\x2e"
        "\x30\xfe\x36\x4a\x1b\xd5\x9e\x68\xf9\x62\xa9\x6b\x4e\x9c\x5d\xb1\x11"
        "\x83\x88\xdd\x04\x89\x1e\x22\x82\x11\x28\x40\xf3\x13\x12\x77\xfa\xfa"
        "\xfb\x4f\x1d\x90\xb0\x17\x3f\x39\x3e\x8a\x1b\xe6\x47\x48\xb4\x35\x80"
        "\xee\xa2\x4b\xac\xce\xe4\x7c\xfb\x3e\xd4\x63\xd7\x0a\x6e\x5d\xda\xab"
        "\x38\xa0\x60\x5b\x66\x6c\xae\x99\x53\x5d\x3f\x75\x61\xa1\x39\xe9\xb1"
        "\xae\x83\x58\x88\xc5\x74\xbb\xe7\x1e\x70\xfe\x18\x89\xc7\xfc\xb1\x98"
        "\x4a\xf4\x87\xde\xda\xad\x9c\xa3\xe6\xdd\x99\x5b\x74\xc9\x13\x7e\xa4"
        "\xd0\x6b\x25\xc2\x8c\x51\x18\x4a\xf9\x99\x88\xcc\x80\xdb\x20\xa5\x36"
        "\x8a\xca\x5e\x8b\x56\xba\xdd\x29\xb7\x2e\x84\xbe\x54\xb2\x44\x7f\xea"
        "\x2b\xdd\xae\x5c\xec\x17\x10\x8a\xbb\x2c\x8c\xc7\xa7\x95\xe1\x75\xff"
        "\xef\x37\x20\x83\x88\x27\xe2\x70\x83\x68\xaa\x3f\x1a\x7e\x5a\xa8\xce"
        "\x96\x0b\x3c\x8e\xe5\x0c\xe9\xcf\x9c\x28\xe7\xc5\x3e\x9b\x50\xd7\xb7"
        "\xea\x7b\xdc\x50\x56\x07\x13\x23\xaa\xf0\x55\xde\xb7\xf4\x1b\x10\x72"
        "\x9c\xbf\x92\x05\x1e\x06\x64\xb2\x1c\xe8\x66\xe0\x16\xa4\x02\xdd\x1e"
        "\x64\xe9\x88\x09\xda\x7f\x8d\x66\x08\x65\x21\x2f\x94\xa8\xf8\xcb\x91"
        "\x96\xb4\x10\xa3\xdf\x99\x96\x34\x88\x01\xb5\xbf\xec\x32\xb7\x5f\x25"
        "\x9d\xb1\x9b\xe5\x6b\xbd\x6e\x52\xbe\x15\xcf\xfa\x55\x8b\xe4\x2a\xde"
        "\xaa\x7f\x00\x10\xbe\x96\xb1\x81\x97\x68\x47\xcb\x68\x17\x6f\xca\xdc"
        "\x3c\xa5\xc9\x76\x36\x59\x5a\x89\xf5\x9f\xe7\x19\x9c\x3e\x57\x8c\xe7"
        "\x25\x52\xfb\x51\xed\x6f\xbd\x1d\x64\x0c\xf3\xf3\xa3\x78\xcc\x76\x64"
        "\x99\xfd\xcf\x12\x88\xe1\x7e\x3e\xb5\x36\x15\x22\x42\x9d\xed\x97\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00",
        3081);
    sprintf((char*)0x20000f89, "%023llo", (long long)-1);
    *(uint64_t*)0x20000fa0 = -1;
    *(uint16_t*)0x20000fa8 = -1;
    *(uint64_t*)0x20000faa = 0;
    syz_usb_ep_write(r[0], 0x82, 0xc0c, 0x20000380);
    break;
  }
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  for (procid = 0; procid < 6; procid++) {
    if (fork() == 0) {
      do_sandbox_none();
    }
  }
  sleep(1000000);
  return 0;
}