// https://syzkaller.appspot.com/bug?id=beab55c4cae03ef184d4417017fbb439403a3597
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
  struct usb_endpoint_descriptor desc;
  int handle;
};

struct usb_iface_index {
  struct usb_interface_descriptor* iface;
  uint8_t bInterfaceNumber;
  uint8_t bAlternateSetting;
  uint8_t bInterfaceClass;
  struct usb_endpoint_index eps[USB_MAX_EP_NUM];
  int eps_num;
};

struct usb_device_index {
  struct usb_device_descriptor* dev;
  struct usb_config_descriptor* config;
  uint8_t bDeviceClass;
  uint8_t bMaxPower;
  int config_length;
  struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
  int ifaces_num;
  int iface_cur;
};

struct usb_info {
  int fd;
  struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length,
                                 struct usb_device_index* index)
{
  if (length < sizeof(*index->dev) + sizeof(*index->config))
    return false;
  memset(index, 0, sizeof(*index));
  index->dev = (struct usb_device_descriptor*)buffer;
  index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
  index->bDeviceClass = index->dev->bDeviceClass;
  index->bMaxPower = index->config->bMaxPower;
  index->config_length = length - sizeof(*index->dev);
  index->iface_cur = -1;
  size_t offset = 0;
  while (true) {
    if (offset + 1 >= length)
      break;
    uint8_t desc_length = buffer[offset];
    uint8_t desc_type = buffer[offset + 1];
    if (desc_length <= 2)
      break;
    if (offset + desc_length > length)
      break;
    if (desc_type == USB_DT_INTERFACE &&
        index->ifaces_num < USB_MAX_IFACE_NUM) {
      struct usb_interface_descriptor* iface =
          (struct usb_interface_descriptor*)(buffer + offset);
      index->ifaces[index->ifaces_num].iface = iface;
      index->ifaces[index->ifaces_num].bInterfaceNumber =
          iface->bInterfaceNumber;
      index->ifaces[index->ifaces_num].bAlternateSetting =
          iface->bAlternateSetting;
      index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
      index->ifaces_num++;
    }
    if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
      struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
      if (iface->eps_num < USB_MAX_EP_NUM) {
        memcpy(&iface->eps[iface->eps_num].desc, buffer + offset,
               sizeof(iface->eps[iface->eps_num].desc));
        iface->eps_num++;
      }
    }
    offset += desc_length;
  }
  return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev,
                                              size_t dev_len)
{
  int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
  if (i >= USB_MAX_FDS)
    return NULL;
  if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
    return NULL;
  __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
  return &usb_devices[i].index;
}

static struct usb_device_index* lookup_usb_index(int fd)
{
  for (int i = 0; i < USB_MAX_FDS; i++) {
    if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
      return &usb_devices[i].index;
    }
  }
  return NULL;
}

struct vusb_connect_string_descriptor {
  uint32_t len;
  char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
  uint32_t qual_len;
  char* qual;
  uint32_t bos_len;
  char* bos;
  uint32_t strs_len;
  struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0};

static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04};

static bool
lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
                           const struct usb_ctrlrequest* ctrl,
                           char** response_data, uint32_t* response_length)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  uint8_t str_idx;
  if (!index)
    return false;
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_GET_DESCRIPTOR:
      switch (ctrl->wValue >> 8) {
      case USB_DT_DEVICE:
        *response_data = (char*)index->dev;
        *response_length = sizeof(*index->dev);
        return true;
      case USB_DT_CONFIG:
        *response_data = (char*)index->config;
        *response_length = index->config_length;
        return true;
      case USB_DT_STRING:
        str_idx = (uint8_t)ctrl->wValue;
        if (descs && str_idx < descs->strs_len) {
          *response_data = descs->strs[str_idx].str;
          *response_length = descs->strs[str_idx].len;
          return true;
        }
        if (str_idx == 0) {
          *response_data = (char*)&default_lang_id[0];
          *response_length = default_lang_id[0];
          return true;
        }
        *response_data = (char*)&default_string[0];
        *response_length = default_string[0];
        return true;
      case USB_DT_BOS:
        *response_data = descs->bos;
        *response_length = descs->bos_len;
        return true;
      case USB_DT_DEVICE_QUALIFIER:
        if (!descs->qual) {
          struct usb_qualifier_descriptor* qual =
              (struct usb_qualifier_descriptor*)response_data;
          qual->bLength = sizeof(*qual);
          qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
          qual->bcdUSB = index->dev->bcdUSB;
          qual->bDeviceClass = index->dev->bDeviceClass;
          qual->bDeviceSubClass = index->dev->bDeviceSubClass;
          qual->bDeviceProtocol = index->dev->bDeviceProtocol;
          qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
          qual->bNumConfigurations = index->dev->bNumConfigurations;
          qual->bRESERVED = 0;
          *response_length = sizeof(*qual);
          return true;
        }
        *response_data = descs->qual;
        *response_length = descs->qual_len;
        return true;
      default:
        break;
      }
      break;
    default:
      break;
    }
    break;
  default:
    break;
  }
  return false;
}

typedef bool (*lookup_connect_out_response_t)(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done);

#define ATH9K_FIRMWARE_DOWNLOAD 0x30
#define ATH9K_FIRMWARE_DOWNLOAD_COMP 0x31

static bool lookup_connect_response_out_ath9k(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done)
{
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_SET_CONFIGURATION:
      return true;
    default:
      break;
    }
    break;
  case USB_TYPE_VENDOR:
    switch (ctrl->bRequest) {
    case ATH9K_FIRMWARE_DOWNLOAD:
      return true;
    case ATH9K_FIRMWARE_DOWNLOAD_COMP:
      *done = true;
      return true;
    default:
      break;
    }
    break;
  }
  return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
  __u8 driver_name[UDC_NAME_LENGTH_MAX];
  __u8 device_name[UDC_NAME_LENGTH_MAX];
  __u8 speed;
};

enum usb_raw_event_type {
  USB_RAW_EVENT_INVALID = 0,
  USB_RAW_EVENT_CONNECT = 1,
  USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
  __u32 type;
  __u32 length;
  __u8 data[0];
};

struct usb_raw_ep_io {
  __u16 ep;
  __u16 flags;
  __u32 length;
  __u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
  __u32 type_control : 1;
  __u32 type_iso : 1;
  __u32 type_bulk : 1;
  __u32 type_int : 1;
  __u32 dir_in : 1;
  __u32 dir_out : 1;
};

struct usb_raw_ep_limits {
  __u16 maxpacket_limit;
  __u16 max_streams;
  __u32 reserved;
};

struct usb_raw_ep_info {
  __u8 name[USB_RAW_EP_NAME_MAX];
  __u32 addr;
  struct usb_raw_ep_caps caps;
  struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
  struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
  return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver,
                        const char* device)
{
  struct usb_raw_init arg;
  strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
  strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
  arg.speed = speed;
  return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
  return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_configure(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
  return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_stall(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

static int lookup_endpoint(int fd, uint8_t bEndpointAddress)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  if (!index)
    return -1;
  if (index->iface_cur < 0)
    return -1;
  for (int ep = 0; index->ifaces[index->iface_cur].eps_num; ep++)
    if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress ==
        bEndpointAddress)
      return index->ifaces[index->iface_cur].eps[ep].handle;
  return -1;
}

static void set_interface(int fd, int n)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  if (!index)
    return;
  if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
    for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
      int rv = usb_raw_ep_disable(
          fd, index->ifaces[index->iface_cur].eps[ep].handle);
      if (rv < 0) {
      } else {
      }
    }
  }
  if (n >= 0 && n < index->ifaces_num) {
    for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
      int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
      if (rv < 0) {
      } else {
        index->ifaces[n].eps[ep].handle = rv;
      }
    }
    index->iface_cur = n;
  }
}

static int configure_device(int fd)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  if (!index)
    return -1;
  int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
  if (rv < 0) {
    return rv;
  }
  rv = usb_raw_configure(fd);
  if (rv < 0) {
    return rv;
  }
  set_interface(fd, 0);
  return 0;
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
  struct usb_raw_event inner;
  struct usb_ctrlrequest ctrl;
  char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
  struct usb_raw_ep_io inner;
  char data[USB_MAX_PACKET_SIZE];
};

static volatile long
syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
                     const struct vusb_connect_descriptors* descs,
                     lookup_connect_out_response_t lookup_connect_response_out)
{
  if (!dev) {
    return -1;
  }
  int fd = usb_raw_open();
  if (fd < 0) {
    return fd;
  }
  if (fd >= MAX_FDS) {
    close(fd);
    return -1;
  }
  struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
  if (!index) {
    return -1;
  }
  char device[32];
  sprintf(&device[0], "dummy_udc.%llu", procid);
  int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
  if (rv < 0) {
    return rv;
  }
  rv = usb_raw_run(fd);
  if (rv < 0) {
    return rv;
  }
  bool done = false;
  while (!done) {
    struct usb_raw_control_event event;
    event.inner.type = 0;
    event.inner.length = sizeof(event.ctrl);
    rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
    if (rv < 0) {
      return rv;
    }
    if (event.inner.type != USB_RAW_EVENT_CONTROL)
      continue;
    char* response_data = NULL;
    uint32_t response_length = 0;
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      if (!lookup_connect_response_in(fd, descs, &event.ctrl, &response_data,
                                      &response_length)) {
        usb_raw_ep0_stall(fd);
        continue;
      }
    } else {
      if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
        usb_raw_ep0_stall(fd);
        continue;
      }
      response_data = NULL;
      response_length = event.ctrl.wLength;
    }
    if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
        event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
      rv = configure_device(fd);
      if (rv < 0) {
        return rv;
      }
    }
    struct usb_raw_ep_io_data response;
    response.inner.ep = 0;
    response.inner.flags = 0;
    if (response_length > sizeof(response.data))
      response_length = 0;
    if (event.ctrl.wLength < response_length)
      response_length = event.ctrl.wLength;
    response.inner.length = response_length;
    if (response_data)
      memcpy(&response.data[0], response_data, response_length);
    else
      memset(&response.data[0], 0, response_length);
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
    } else {
      rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
    }
    if (rv < 0) {
      return rv;
    }
  }
  sleep_ms(200);
  return fd;
}

static volatile long syz_usb_connect_ath9k(volatile long a0, volatile long a1,
                                           volatile long a2, volatile long a3)
{
  uint64_t speed = a0;
  uint64_t dev_len = a1;
  const char* dev = (const char*)a2;
  const struct vusb_connect_descriptors* descs =
      (const struct vusb_connect_descriptors*)a3;
  return syz_usb_connect_impl(speed, dev_len, dev, descs,
                              &lookup_connect_response_out_ath9k);
}

static volatile long syz_usb_ep_write(volatile long a0, volatile long a1,
                                      volatile long a2, volatile long a3)
{
  int fd = a0;
  uint8_t ep = a1;
  uint32_t len = a2;
  char* data = (char*)a3;
  int ep_handle = lookup_endpoint(fd, ep);
  if (ep_handle < 0) {
    return -1;
  }
  struct usb_raw_ep_io_data io_data;
  io_data.inner.ep = ep_handle;
  io_data.inner.flags = 0;
  if (len > sizeof(io_data.data))
    len = sizeof(io_data.data);
  io_data.inner.length = len;
  memcpy(&io_data.data[0], data, len);
  int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data);
  if (rv < 0) {
    return rv;
  }
  sleep_ms(200);
  return 0;
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  intptr_t res = 0;
  *(uint8_t*)0x20000740 = 0x12;
  *(uint8_t*)0x20000741 = 1;
  *(uint16_t*)0x20000742 = 0x200;
  *(uint8_t*)0x20000744 = -1;
  *(uint8_t*)0x20000745 = -1;
  *(uint8_t*)0x20000746 = -1;
  *(uint8_t*)0x20000747 = 0x40;
  *(uint16_t*)0x20000748 = 0xcf3;
  *(uint16_t*)0x2000074a = 0x9271;
  *(uint16_t*)0x2000074c = 0x108;
  *(uint8_t*)0x2000074e = 1;
  *(uint8_t*)0x2000074f = 2;
  *(uint8_t*)0x20000750 = 3;
  *(uint8_t*)0x20000751 = 0x60;
  *(uint8_t*)0x20000752 = 9;
  *(uint8_t*)0x20000753 = 2;
  *(uint16_t*)0x20000754 = 0x48;
  *(uint8_t*)0x20000756 = 1;
  *(uint8_t*)0x20000757 = 1;
  *(uint8_t*)0x20000758 = 0;
  *(uint8_t*)0x20000759 = 0x80;
  *(uint8_t*)0x2000075a = 0xfa;
  *(uint8_t*)0x2000075b = 9;
  *(uint8_t*)0x2000075c = 4;
  *(uint8_t*)0x2000075d = 0;
  *(uint8_t*)0x2000075e = 0;
  *(uint8_t*)0x2000075f = 6;
  *(uint8_t*)0x20000760 = -1;
  *(uint8_t*)0x20000761 = 0;
  *(uint8_t*)0x20000762 = 0;
  *(uint8_t*)0x20000763 = 0;
  *(uint8_t*)0x20000764 = 9;
  *(uint8_t*)0x20000765 = 5;
  *(uint8_t*)0x20000766 = 1;
  *(uint8_t*)0x20000767 = 2;
  *(uint16_t*)0x20000768 = 0x200;
  *(uint8_t*)0x2000076a = 0;
  *(uint8_t*)0x2000076b = 0;
  *(uint8_t*)0x2000076c = 0;
  *(uint8_t*)0x2000076d = 9;
  *(uint8_t*)0x2000076e = 5;
  *(uint8_t*)0x2000076f = 0x82;
  *(uint8_t*)0x20000770 = 2;
  *(uint16_t*)0x20000771 = 0x200;
  *(uint8_t*)0x20000773 = 0;
  *(uint8_t*)0x20000774 = 0;
  *(uint8_t*)0x20000775 = 0;
  *(uint8_t*)0x20000776 = 9;
  *(uint8_t*)0x20000777 = 5;
  *(uint8_t*)0x20000778 = 0x83;
  *(uint8_t*)0x20000779 = 3;
  *(uint16_t*)0x2000077a = 0x40;
  *(uint8_t*)0x2000077c = 1;
  *(uint8_t*)0x2000077d = 0;
  *(uint8_t*)0x2000077e = 0;
  *(uint8_t*)0x2000077f = 9;
  *(uint8_t*)0x20000780 = 5;
  *(uint8_t*)0x20000781 = 4;
  *(uint8_t*)0x20000782 = 3;
  *(uint16_t*)0x20000783 = 0x40;
  *(uint8_t*)0x20000785 = 1;
  *(uint8_t*)0x20000786 = 0;
  *(uint8_t*)0x20000787 = 0;
  *(uint8_t*)0x20000788 = 9;
  *(uint8_t*)0x20000789 = 5;
  *(uint8_t*)0x2000078a = 5;
  *(uint8_t*)0x2000078b = 2;
  *(uint16_t*)0x2000078c = 0x200;
  *(uint8_t*)0x2000078e = 0;
  *(uint8_t*)0x2000078f = 0;
  *(uint8_t*)0x20000790 = 0;
  *(uint8_t*)0x20000791 = 9;
  *(uint8_t*)0x20000792 = 5;
  *(uint8_t*)0x20000793 = 6;
  *(uint8_t*)0x20000794 = 2;
  *(uint16_t*)0x20000795 = 0x200;
  *(uint8_t*)0x20000797 = 0;
  *(uint8_t*)0x20000798 = 0;
  *(uint8_t*)0x20000799 = 0;
  res = -1;
  res = syz_usb_connect_ath9k(3, 0x5a, 0x20000740, 0);
  if (res != -1)
    r[0] = res;
  *(uint8_t*)0x200005c0 = 0;
  *(uint8_t*)0x200005c1 = 0;
  *(uint16_t*)0x200005c2 = htobe16(0xa);
  memcpy((void*)0x200005c4, "\x2f\x65\xcc\x19", 4);
  *(uint16_t*)0x200005c8 = htobe16(3);
  *(uint16_t*)0x200005ca = htobe16(0);
  *(uint8_t*)0x200005cc = 0;
  *(uint8_t*)0x200005cd = 8;
  *(uint16_t*)0x200005ce = htobe16(0);
  *(uint8_t*)0x200005d0 = 0;
  *(uint8_t*)0x200005d1 = 0;
  syz_usb_ep_write(r[0], 0x83, 0x12, 0x200005c0);
  *(uint8_t*)0x200001c0 = 0;
  *(uint8_t*)0x200001c1 = 0;
  *(uint16_t*)0x200001c2 = htobe16(8);
  memcpy((void*)0x200001c4, "\xd6\x0c\xe3\xb5", 4);
  *(uint16_t*)0x200001c8 = htobe16(1);
  *(uint16_t*)0x200001ca = htobe16(0);
  *(uint16_t*)0x200001cc = htobe16(0);
  *(uint8_t*)0x200001ce = 0;
  *(uint8_t*)0x200001cf = 9;
  syz_usb_ep_write(r[0], 0x83, 0x10, 0x200001c0);
  *(uint16_t*)0x200009c0 = 0x7c;
  *(uint16_t*)0x200009c2 = 0x4e00;
  memcpy(
      (void*)0x200009c4,
      "\xcd\xe0\x1d\xc1\x00\xdf\x66\x93\xa6\xb1\x76\x0f\x21\x95\xe9\x02\x0e\xa1"
      "\x71\xa1\x6d\x59\x5a\xbe\xe7\x57\x4e\x4b\xc0\x81\x69\xf9\x75\x43\x79\xbe"
      "\x45\x44\xc5\xed\x19\x98\x27\xe6\xd8\x76\x7d\xc8\xc6\xfe\xc4\xe2\x06\x70"
      "\xe7\x3d\x97\xd5\x36\x8f\xd4\xd3\xcd\x3f\xa8\x5f\xec\x2c\x4a\x56\x79\x29"
      "\x5a\x4b\x74\xc6\x88\xb4\xfd\xe2\x59\x4f\xe2\x95\x45\x93\xd2\xc4\x6f\x8f"
      "\x45\xa3\xc2\x1e\x07\x2b\xd8\x1d\xda\x2d\x36\x46\x2e\x0a\x34\x49\xf9\x40"
      "\xfc\xf5\x15\x11\xc1\xa1\x84\x13\x49\x48\x84\xea\xb4\x08\x53\x3c",
      124);
  *(uint16_t*)0x20000a40 = 0xc2;
  *(uint16_t*)0x20000a42 = 0x4e00;
  memcpy(
      (void*)0x20000a44,
      "\xf3\xa0\x39\xfa\xc3\xda\xa5\x43\x6d\x97\x0b\x20\x1d\x5f\xe7\xef\xb4\x30"
      "\x66\x49\xa1\x10\x66\x7a\x11\xb4\xd6\x60\x62\x6e\xb5\xf9\xe9\x32\x28\x0d"
      "\xb1\xcb\xea\x28\x4f\x1f\xcd\xe7\xe6\x56\x95\x02\x67\x5e\x57\x22\x86\x70"
      "\x2a\x8b\x24\x3b\xc4\xe1\x82\x9f\x37\xfa\xad\xa5\xd1\xaf\x17\x7c\x04\x22"
      "\x26\x99\xc2\x41\x07\xfb\xa5\x43\x5c\x60\x91\x52\x06\x59\x4d\x8b\xa7\x55"
      "\x90\xbb\x9a\xdb\xb9\xfe\x92\x6b\x3d\x28\xeb\xcf\x90\x5e\x4f\x7b\xc4\x00"
      "\x69\xfb\x79\x83\x3b\xfb\x4e\xed\x43\x98\xa0\x69\x97\xb1\x3c\x74\xb3\x43"
      "\x0e\x5b\xd4\x5f\x1c\x49\x9f\xb5\x62\x1a\x79\xcc\x1e\x29\x7d\x79\x45\x8d"
      "\x90\x88\x23\x7a\xb1\x27\xb0\xdf\xa0\x6c\xe2\xf8\x3a\x90\x87\xc5\x35\x8f"
      "\x9d\x1d\xa9\x05\x27\x6b\xc2\x17\x35\xe4\x5a\xa7\x60\xfb\x68\x19\xfa\xbd"
      "\xc7\x1d\xfb\x4b\xa5\x96\xcb\x66\x83\xe7\xce\x53\x57\xf2",
      194);
  *(uint16_t*)0x20000b08 = 0x8b;
  *(uint16_t*)0x20000b0a = 0x4e00;
  memcpy(
      (void*)0x20000b0c,
      "\x7d\x68\xb3\x69\x72\x98\xf0\x5d\x77\x79\xb0\xd1\xef\xb2\x50\x53\x40\x19"
      "\x39\xb3\x88\xaa\x7f\xf8\x1f\xfd\x66\x74\x3f\x80\x1d\xfa\xc0\xd5\xc5\x02"
      "\xae\x57\x2e\xab\xe6\xe5\x94\xe4\x10\x60\x15\xdb\x8a\x0e\x4d\xb2\x6d\x9e"
      "\xea\x1e\x13\xd1\x04\x69\x07\xe2\xa8\xff\xf3\x0a\x86\x9a\x9e\x17\x9e\xc1"
      "\x12\xe3\x84\xc0\x62\x85\x82\xaa\x23\x5b\x85\xae\xe4\x9a\xfd\xfb\xa4\x89"
      "\x3a\x2f\xb0\xb4\x69\x5d\xc7\xb5\x11\x3e\x85\xad\x9f\xa1\xdf\x40\xa1\x31"
      "\xd0\x14\xc9\x9c\x5c\x95\xfe\x45\x0b\x64\x66\xad\x62\xc2\xe4\xab\xa4\xd7"
      "\xab\x03\x8a\xe9\x3e\x3f\x37\xeb\x47\xc5\x42\xc9\x27",
      139);
  *(uint16_t*)0x20000b98 = 0x1000;
  *(uint16_t*)0x20000b9a = 0x4e00;
  memcpy(
      (void*)0x20000b9c,
      "\x6e\xaa\x73\x2d\x1a\xd9\xd9\xdb\x9a\x51\x4f\x5d\xc8\x64\xab\x93\x51\x00"
      "\xce\xab\x83\xaf\x87\x3a\x11\xb2\x13\x45\x89\xc7\x15\xf0\x69\xa7\xe3\x5a"
      "\xab\xbd\x21\xa6\x67\xe0\x1d\xd2\xdf\xe5\x03\x80\xd8\x8f\xb4\xbe\x2b\x59"
      "\x1e\x5c\x99\x7d\x9e\x11\xa1\x28\xa6\xb1\x96\x97\x1c\x7a\xd8\xe5\x2e\xa9"
      "\xb3\x8d\xa5\xcf\xef\x36\xbc\xda\xf0\xe6\x1b\xa3\x0f\xf4\x49\xae\xb5\x24"
      "\x6a\x43\x50\xc7\x8f\x33\x26\x4e\xab\xbb\x14\x7a\xe4\xd0\x2a\x70\x65\xa9"
      "\x6c\x54\x48\x95\x27\x86\x8d\xa0\xc2\xa7\x2b\x0a\xe6\x05\xb2\xdf\x46\x0a"
      "\x2a\xd8\xfa\xc9\x4c\xa8\xd6\xb6\x39\xf5\x2d\xb2\x1f\x4b\x0f\x71\xd6\x4e"
      "\xbc\x92\x6e\x14\x41\xf8\xa0\x46\x2e\x5b\xf5\x07\x41\x93\x50\x76\x4e\x22"
      "\x8f\x9b\x2d\x2e\x1f\xc0\x96\xae\x7c\xf7\xa6\x66\xfe\xdd\x85\xa3\x8e\x9a"
      "\xcf\x53\x12\xa0\x86\x36\x11\x04\xec\x47\x81\x32\xcd\xe1\x6d\xe1\xfa\x7b"
      "\x6e\xd8\x36\xed\xd5\x51\xe6\xb7\x51\xff\x0a\xe4\x6e\xd7\x6d\xb2\xff\xd7"
      "\x3e\xe6\x71\xc1\x2c\x3e\x37\x11\x0a\x03\x4b\xf2\x0d\x49\xe4\x03\xf5\x3c"
      "\xe4\x44\xa2\x5f\xa9\x5d\xa9\x31\xa4\xca\x92\xdc\x2c\x50\x3f\xae\x5f\xed"
      "\x5f\xb7\xf9\xbc\x65\x78\x30\x16\xd3\x32\xc2\x2a\xec\xf3\x9a\x01\x6b\x8b"
      "\x1a\x33\x9d\x68\x6e\x4e\xd2\x5e\x46\x71\xe6\xba\x6f\xaf\x45\xb8\x19\xdc"
      "\xf9\x9b\xa1\xdf\x12\xfe\xc0\x3c\x10\x72\x15\x82\xfb\x82\xb1\x47\x18\x77"
      "\x58\xae\x44\xd3\x0c\x40\x73\x4e\xc6\x74\x68\xe2\x4c\x61\xd8\xfb\x15\x24"
      "\xe9\xb7\x7e\x5a\x21\x7b\xff\x3d\x49\x9b\xd6\x4c\x83\x45\xae\x98\x7f\xfb"
      "\x0c\xc7\x6b\xf4\x95\xa1\x75\x33\x93\x1c\x6b\x43\xed\x75\xf0\x9b\x9c\x9f"
      "\x3e\x70\xbf\x45\xfc\x4e\x59\xfb\x71\x4f\x39\x7a\x4c\x72\xc9\x5f\x94\x2b"
      "\xda\x60\x22\xef\x90\x43\xe3\x15\xca\x25\x41\x2c\x3e\xdd\x47\x5b\xb9\xf5"
      "\xed\xa1\xde\x8a\xf5\x44\x68\x02\x0b\xf1\x30\x05\x13\x57\x2f\x99\x91\x9d"
      "\x01\x5f\x71\x37\x44\x95\xc5\x20\x99\x0d\x28\x26\x96\x85\x8f\x07\xc8\xdf"
      "\x13\x6c\xcb\x95\xc3\x98\xf1\x37\xf6\x7a\x09\x24\x57\xa2\xcf\x18\xd8\x42"
      "\x6b\xab\x95\x1a\xf9\xa8\x6b\xed\xb9\xf9\xd3\x3f\x9f\x74\x9d\x58\x5e\xd5"
      "\x94\x63\xee\x07\xc8\x93\x64\x4f\x02\xb8\xa7\x04\x50\x5e\x25\x88\x11\x20"
      "\x3a\xaa\x57\x36\x06\x6f\x28\xa0\x7d\xb7\x2f\x04\xc3\x20\xb7\x0f\xf8\x3b"
      "\x32\xa0\x23\xca\xd9\x86\x6f\x09\x72\x85\xbb\xb3\x17\x45\x49\xca\x3a\x5d"
      "\xc1\x30\xf2\xc8\xbf\xdc\x65\x64\x6c\x3b\x9d\x6e\xd1\xda\xc9\xae\x05\x7e"
      "\x85\x2c\xed\xa0\xb5\x47\x8b\xc9\xd4\x81\x42\xe1\x6f\xe2\x5e\xf9\xe9\x74"
      "\x69\xcd\x45\x57\x62\x57\xf1\x50\x83\x6e\xdc\xb2\x52\x56\x23\x2d\x53\xc5"
      "\x10\xb5\xd3\xee\xad\x8a\xdf\x71\xa6\x21\xb1\x88\x58\x13\x86\x23\x0d\xdc"
      "\x85\xff\x63\x29\xee\x69\xa1\xe6\xbd\xc9\x65\xdc\xfe\x45\xf6\xf6\x73\xc9"
      "\x71\x59\xd6\xa6\x19\xbb\x52\x5e\x06\x21\xc6\xe5\x1c\x3a\xee\x70\x24\x78"
      "\xd5\xad\x52\x52\xb6\x49\x0d\x11\x3e\xc3\xa3\x54\xa9\xe5\x37\x6d\x18\x31"
      "\x40\xb2\xfe\xba\x46\x25\x70\x68\xd3\x97\xd3\xf5\x7f\x5f\x88\xd8\x5b\xe5"
      "\x6d\x5a\x1e\x93\x53\x75\x22\x11\xbe\x41\xe8\x39\x9a\xe4\x92\xb9\x27\x1e"
      "\xcf\x4d\x77\xf2\x46\x8d\xda\x53\x8a\x0e\xce\x4e\x32\x93\x6a\xe6\x4d\x1e"
      "\x3a\xef\x2d\xbe\x27\xe0\x0f\xa8\x68\x1c\xa8\x5b\x24\x75\x79\xa0\x38\xf6"
      "\x9e\x65\xe3\x2d\x53\xc1\x25\xdf\xae\x1e\xcc\x00\x04\xfd\x18\x9a\x3d\xea"
      "\x01\x35\x8c\xcd\x59\x1b\xb9\xe8\xdf\x74\xc0\xd8\x07\x64\x97\xbe\x72\x66"
      "\x81\xb1\x67\x68\x06\x4c\x3e\x47\x02\x78\x17\xcc\xda\xbe\xa0\xf1\x4f\xd7"
      "\xd0\x8e\xe9\xaf\x97\xca\x31\xd7\x64\xf4\xad\x01\x20\x8b\x06\x29\xe5\xcf"
      "\x00\x4c\x62\xae\x78\x74\xfa\x8c\xbd\xd2\x46\x66\xb6\x0c\x46\x07\xc7\x9e"
      "\xff\xec\x35\xd7\x2b\xf8\x85\x24\x1f\xf9\x7b\xd3\x59\x81\xc7\xe1\xa3\x8b"
      "\x37\x20\x85\x73\xd1\x91\x49\x6f\xa0\xd5\x54\x79\xab\xc1\xf7\xf4\xb5\xcc"
      "\x8a\xfc\xf7\xb5\x7f\x65\xca\xd9\xda\x1f\x1f\x06\x0f\x10\x40\x52\xcf\xec"
      "\x9c\x3d\xf3\x58\x31\x25\x53\xdb\x5d\x3b\xe7\x28\x55\x80\x0f\x9c\xae\x64"
      "\x45\x46\x27\xb8\xca\xbd\x60\x88\x6a\x97\x16\x1f\xfd\xc0\x80\xbe\x1a\x00"
      "\x6e\xe5\xb5\xe6\x20\x68\xd4\xb1\xcb\xbe\x59\x57\x3a\xfc\x03\xee\xb8\x44"
      "\xae\x8c\x7f\x07\x27\x66\x9d\x92\x87\x49\x63\xe9\xbc\xbd\xac\xfd\xba\xaa"
      "\x53\x5b\x23\xb7\xf6\xf5\xe0\xd6\xba\xd0\xaa\x3d\x3c\xf4\x01\x06\xd8\x28"
      "\x5a\x9c\x52\x63\x69\xe3\x36\x33\x02\xcb\xef\x26\xae\x0d\xbf\xf1\xd8\x66"
      "\x35\xa6\x1a\xac\x3e\x67\x39\x74\x53\xd8\x07\xfd\x47\x82\xbc\x46\x65\x09"
      "\xe4\x1c\x0b\x68\x8b\x25\x59\x92\x9f\x6c\x3b\x67\x14\xba\xa1\xe3\x88\x0e"
      "\xde\xa5\xec\x0c\x26\xbc\xd3\x6c\x73\xe9\x81\x70\x11\xc2\x38\x79\x9b\xdb"
      "\x53\x37\x87\x1a\xbf\x90\x8f\x9c\xd2\xcd\x4e\xcb\x57\x2b\x38\xa6\x53\x63"
      "\x89\x40\x0e\xc6\x09\xf2\xd4\xef\x6c\x00\xef\x3c\x37\x18\xad\xb5\xa5\xff"
      "\xd2\x51\xbd\xba\x46\x35\xee\x18\xe8\x98\xe5\x1b\xa8\xdb\xc9\xa4\x14\x0f"
      "\x9b\x2c\xee\x01\xa5\xdd\xdb\x7b\x56\xaa\xac\x30\x19\xb5\x7e\xb0\xb8\xce"
      "\x50\xcc\x2c\xb5\xd8\xb5\x78\x95\xb2\x00\x7f\x99\x10\x87\x19\xce\x8b\xd0"
      "\x7a\x25\xd6\xfd\x82\xb2\x68\x96\xaa\x14\xa4\x15\x7d\xe1\x36\x01\xd8\xff"
      "\x2f\x35\x50\x08\x78\x91\xc6\x02\x00\x1c\x89\x63\xb9\x6d\x54\x43\x20\xc5"
      "\xe4\x3a\x2e\x19\xc7\x6a\x9a\x3a\x9f\xbf\x81\x53\x0c\x7f\xed\x43\x17\xe2"
      "\x15\x0b\x51\xf2\x53\x91\x98\x72\xbf\xf8\xdf\x1e\x84\x6a\x0c\x0d\xea\xb0"
      "\x78\x97\xb5\x55\xae\x31\x90\x80\x79\x24\xb6\x94\x25\xe9\xe8\x20\xe6\x9b"
      "\x67\x5b\x90\x11\x24\x88\x93\xf4\x3a\xd6\xcd\x2e\x9a\x1c\x96\x12\x9a\x1a"
      "\xc1\x2b\x86\x60\xbd\x18\x48\x86\x1e\x24\xa4\x27\x43\xc4\xd4\x01\x60\x75"
      "\x3a\xe5\x78\x74\x69\xbe\x00\xe8\x4c\x71\xe2\x6c\x09\x48\xaf\x45\x3d\x02"
      "\x6c\xd6\x71\xb7\xb4\xdf\x5e\x0a\x85\xe2\x6a\xfa\x52\xa9\xc2\x33\x4d\xf5"
      "\x58\xaa\x1f\x9d\xe6\xd5\x45\xc0\xa0\x66\x25\x9a\x07\x51\xbd\x89\xb5\x7e"
      "\x06\x75\x2f\xde\x46\x56\x68\xf1\x23\xf9\x83\x20\xec\x89\xbb\x85\xe9\x60"
      "\x86\x62\x0b\xf1\x5c\xb6\x21\x2d\x68\x4d\x8f\xa4\xf7\x8d\xa2\x1b\x46\x01"
      "\x77\xcb\xdf\x80\x6f\x89\xba\x4a\x33\x06\xb2\x25\x82\xe6\x51\x34\xa9\x22"
      "\xc0\xce\xf8\x7a\xa0\xaf\xda\xac\x41\x72\x3a\xc9\x11\x2d\xe2\x81\x1e\x84"
      "\xfd\xf7\x16\x53\x44\x43\x81\xb2\x73\x19\x86\x01\xd8\x4f\x28\xf9\x36\xb1"
      "\x98\xbd\xa7\xde\x19\x84\xfe\xa2\x3d\x6e\xc0\x90\xe4\xa4\x61\xdf\x8f\xaf"
      "\x75\xd3\x8c\xec\x07\x97\x6e\x2f\x9e\x0d\x09\xc8\xbb\x88\x50\xef\x44\x80"
      "\x3b\xa5\xe9\x03\x33\xaa\xed\x20\xec\x61\x1b\x43\x4b\xb9\x74\x92\xf3\xbf"
      "\xd4\x60\x52\xb6\xe0\xa5\x6b\xfe\x52\x8f\x67\x75\xc4\x69\x1b\x7b\x1f\x8c"
      "\x73\xb5\x8a\x53\xb7\xd5\x5b\xbd\x41\xd1\xd2\x49\x10\x53\xd1\x19\x42\x19"
      "\x46\x39\x77\xc4\x97\x78\x3a\x79\x09\xa2\x90\xe8\x3b\x12\x74\xc2\xd4\x61"
      "\xd0\xfb\xa3\x2b\xc3\x9c\x80\xbb\xd9\xc8\x44\x38\x24\x12\x0c\xf8\xaa\xf4"
      "\x69\x34\x27\x06\xa4\xd1\xcb\xa3\xba\x04\xd6\x04\xb5\x90\xf8\x89\x50\xd6"
      "\xab\xda\x95\xf3\x1f\xd5\xa0\x71\x9c\x0b\x08\x3f\x8c\xbe\x55\x76\x60\xb8"
      "\x28\x2e\xcc\x13\x7b\xca\xda\x22\xca\x46\xc6\x79\x8e\x80\x36\x5a\xb4\x27"
      "\x6d\xeb\xb2\x09\x40\x1e\x04\xf5\x64\x28\xe3\xfb\x60\xb8\xc6\x07\x35\xfa"
      "\xec\x23\xd4\xd9\x3b\x13\xef\xa4\x39\xde\x74\xce\x56\x73\xc1\x03\xf6\x2d"
      "\x40\xa0\x93\x17\x38\x1b\xe7\x84\x43\x5c\x2d\xbc\x14\x90\xcb\x6f\xf2\x77"
      "\xf1\x7c\x8f\x33\xb7\x79\xea\xb2\x72\x12\x26\xdc\x4e\x8d\x01\x99\x48\xa1"
      "\x11\xae\x21\xcf\xc4\x65\x1f\x9c\x6e\xb9\x58\xc6\x7c\x0f\x41\xe6\x16\x31"
      "\xec\x0a\xa1\x05\xbe\x96\x1b\x51\x9c\xac\x58\xe3\x6e\x92\xe1\xa1\x5f\xa7"
      "\x15\x7e\xc7\x5e\x6b\x71\x08\xb0\x72\x38\xd3\xb2\x1c\xa4\xf5\xaa\x8a\xf5"
      "\xcd\x20\xfc\x92\x50\x96\x34\x4d\x5f\x6b\xd0\xa5\x30\x6c\x0f\x77\x6e\x4d"
      "\x47\x6c\x54\x86\x61\xd1\x4f\xf1\x2c\x85\xcd\xdd\x5f\xe1\x9a\x9b\x66\x9e"
      "\x2e\x87\x22\x1e\xc9\x2e\x68\x34\xb6\x92\xbe\x1a\xd1\x02\x7e\x61\x5b\x4a"
      "\xaa\x08\x1c\x46\x56\x00\x28\x51\xe5\x8f\xbc\x29\x67\x75\x22\x69\x2c\x3b"
      "\x2d\x6f\x9c\x6f\xbb\x24\x7f\xcf\x1c\x6d\xfe\xf0\xaa\x5a\x44\x75\x04\x60"
      "\x89\x43\x67\x28\x2c\x06\x25\x28\x3b\xd8\xb1\xa4\xb5\x4f\x9c\x6b\xe5\xa6"
      "\xba\xe1\x57\x25\xfe\x4c\x87\x45\xbe\x88\x91\x82\xa6\x6f\x9a\x1d\xcf\x7a"
      "\xff\xf3\xad\x63\x04\x9a\x41\x16\xe6\x71\x35\x64\x61\x87\xa5\x14\xe0\xf4"
      "\x72\xfc\xad\x8b\x10\x56\x31\x84\xe3\xd9\xf6\xc4\x9d\x1d\xe1\xd9\x2c\x30"
      "\xc5\x36\xe2\x38\x94\xb6\x45\x44\x5c\x9f\xe9\x76\xe0\xe0\xa4\xc8\x2b\x75"
      "\xe2\x54\x38\xc6\x83\xfe\x11\x8a\xc4\xaa\xb7\x91\x51\x86\x66\x34\x2d\xb2"
      "\x45\x37\x38\x92\xe2\xb5\xcd\xbf\xcb\xa8\x3c\x27\x91\x2c\x52\x7e\x6c\x48"
      "\xef\xb0\x92\x34\xa8\xa4\xf0\xb1\xef\xda\x22\x58\x19\xdf\x29\x88\x01\x9e"
      "\x9d\x38\x5f\x54\x58\x30\xaa\xb5\x24\xbd\x6c\xe3\xad\xd0\xaf\x4e\x12\x50"
      "\x2b\x19\xf2\x49\x85\x79\x83\xee\x58\x59\xe4\x1b\x5b\x93\x80\x14\x1f\x95"
      "\x59\x64\xa2\x0e\x92\x36\x5b\x61\xc3\x17\xce\x7e\xef\xce\x9c\x46\xbf\x54"
      "\xba\xef\x00\xba\x85\xda\x88\x39\x21\x77\xeb\x63\x37\x65\x9b\x07\xc0\xb4"
      "\x1f\x65\x40\x6b\xf6\xe2\xae\xad\xd3\xca\x13\x46\x42\x34\xed\x5e\xee\x86"
      "\xf8\xca\x79\x48\x16\x25\x0f\x12\x89\x78\x40\x2a\x0f\xf8\xcf\x51\x78\x56"
      "\x13\x19\x5b\x1a\xd0\xb7\xb2\x06\xde\xf4\x61\x10\x2c\xd3\x51\xfd\x11\x25"
      "\x1b\x70\x5f\xdc\xd2\xce\x9d\xf1\x6f\x41\xa3\x5a\x64\x24\x5a\x3f\xa2\x53"
      "\x40\x41\x64\xfb\xb2\x29\x6e\x0e\x9f\x59\x5e\x00\xa2\xd7\xbc\x1d\x34\x32"
      "\x96\x0a\xf4\x08\x96\x3e\x4b\x40\xac\xb5\xd8\xbb\xd3\x05\x60\x04\xb3\x68"
      "\xb1\x61\xaf\x4b\xc5\xf2\xc4\x34\x69\x3e\x7d\x8d\xce\x5f\xf9\xc5\x24\x85"
      "\xaa\xf8\xd4\x7f\x3b\xb9\x3d\x4a\x47\x3e\xce\xac\x75\x95\x51\x76\xd4\xc4"
      "\x9d\xcb\xe6\x7e\x5f\x40\x05\x0f\xbc\x67\x01\x25\x62\xe0\xbf\x1d\x99\xe2"
      "\xff\x08\xd5\x0f\x7e\xfe\x0b\x71\x35\x04\x19\x80\xd0\xa9\x13\x44\x36\x93"
      "\x9c\x71\x3d\x54\xd8\x76\x30\x08\x5d\xb6\xb8\x25\xd4\x0e\x7b\xee\xb9\x64"
      "\x9c\xf0\x42\xd7\x16\xd4\x23\xaf\xa4\x6b\xb8\x1a\xeb\xad\x83\x41\xe7\xe7"
      "\x6a\xfa\xd5\x6e\x75\x20\x05\x9a\x0a\x4f\x5e\x4a\xd1\xd5\x98\xeb\xc7\x37"
      "\x8e\x09\x48\xcc\x77\xc8\xeb\xe1\xc4\x5c\xfa\x0b\xb9\xe0\x2c\x11\x9d\x60"
      "\xac\xde\xf1\x29\xa9\x59\x80\x02\xea\xc9\x20\x37\xa9\xd7\x6e\xd8\x6b\x59"
      "\x9d\xdc\x05\xbc\x11\x98\x4f\x65\x74\x8f\x4f\x32\x72\x29\xc4\x09\x92\x59"
      "\xcf\xf7\x36\x6a\x03\x4d\xfa\x33\xca\x04\xbc\x13\x6d\x0e\x4a\x0c\x8a\x1f"
      "\xe7\xad\xa3\x73\x84\x2c\xbf\x01\x23\xc2\x7d\x4c\x41\xa8\x7d\x81\x5a\xb3"
      "\xcf\x60\x16\x48\xf5\x2c\xba\x32\xb0\x38\x8d\xd6\xdf\xd1\xe2\x86\x43\x23"
      "\x6d\x0b\x87\xf6\xd4\x23\x16\x84\x2b\xed\x6f\xfa\xa4\x09\x09\xbe\x1e\x13"
      "\x1e\x5c\x83\x7b\x99\xb1\x32\xfe\xb3\x6e\xa9\xd8\xf0\x06\x2a\x6f\x75\x1b"
      "\x29\x33\x38\xce\xce\xae\x3c\x6f\x4c\x09\xaa\x6d\x9e\x07\xd0\x35\x88\x26"
      "\xcc\x49\xae\xe6\xd0\x85\x24\xf0\x09\xda\xb5\x2d\xe5\x89\x8d\xcd\xba\x4f"
      "\xc2\x5c\x0a\x5c\x54\x77\x01\x06\xb0\xa0\x2d\x8c\xe2\x00\x18\x0f\x43\xc4"
      "\xb7\xda\xf8\xe5\x7a\x0a\x74\xdf\x86\xb1\x86\x16\xf9\x8b\x7d\x7d\x34\x23"
      "\x9a\x67\x18\x7f\x4a\x33\x18\x76\x93\x12\xe1\x89\xe7\x7d\x5b\xb7\x47\x10"
      "\xa5\xff\xa9\xf8\x8f\x2c\x4e\xf7\xb5\xc7\x77\xd0\xe0\x9b\x6f\x23\x73\x06"
      "\x3f\xf9\x72\x2e\xa4\x8c\x00\xc7\xa6\x6b\xce\x37\x01\xa3\x82\x09\x67\x7b"
      "\xa0\x94\xf7\x5a\xb2\x84\xf3\x08\xf5\x3d\x5f\x30\xa5\xea\xbc\x4c\x14\xd4"
      "\xb6\x8e\x12\x9b\xb9\x13\x82\xc3\x38\xa9\x8b\xeb\x68\xbe\x70\x09\x2c\xc6"
      "\x09\x15\x0e\xc2\x99\x72\xa0\xbf\x69\xfe\xb3\x87\xe0\x7a\x4c\x64\x72\x49"
      "\x83\x16\x48\x28\x50\x1b\x86\x5f\xe1\x7b\x48\xea\x9a\x16\x77\x10\x1c\xdd"
      "\x42\xe6\x80\xab\xc4\x72\xf2\x74\xfa\x5b\x47\xe3\x16\x38\x3c\x42\x63\x02"
      "\x5b\xe2\xed\xf0\xd8\x02\xab\x2c\x92\x55\x39\x70\xec\xac\x3b\x1f\x3d\xd8"
      "\x69\xf1\xd1\x41\xd5\x9b\x3d\x16\x57\x03\xe2\x1a\x74\x67\xc5\x1d\x51\x20"
      "\xe4\x2d\x26\xa7\xd4\xc4\xa6\xa8\xa9\x01\x4f\x2b\xc4\xbd\xf1\x4c\x20\xfb"
      "\x27\x27\x22\x07\x27\x99\xdf\xfb\x81\x8d\x6d\x5d\x2e\xc6\xde\xfe\xe3\xa3"
      "\x04\x26\x17\x3c\x8b\x51\x40\x34\xaa\x7e\x2f\xac\x2e\xf5\x6f\x4a\x85\x40"
      "\xf6\x29\x5d\x61\xb5\x68\x5d\xf6\x4e\xbe\x24\xe5\xd2\xc3\x96\xd6\x09\xaf"
      "\x4d\x8f\x04\x64\x90\xd1\xa1\x4d\x10\xd4\xe3\x3a\x19\x37\x77\xa8\xd7\x42"
      "\x6f\xf8\x58\x03\xa6\x95\x0d\x19\x93\x12\x3c\xb8\x98\x8c\x82\xbc\xfd\x97"
      "\x71\x84\x5a\xec\x3d\x77\xa5\x05\xc1\x9f\x6d\x89\x8c\x15\x9b\xc6\x19\xcf"
      "\x64\x79\x16\xfb\x61\x73\x54\x06\x6d\xc0\xe5\x3f\x4d\xce\x40\xd7\xb2\x00"
      "\x08\x73\xec\xd6\x98\x10\xda\x82\x2d\x07\x4d\x2c\xd1\xfb\xa1\xe2\x3f\x95"
      "\xc2\x45\xdd\x13\x44\xca\xc0\x8d\x22\xfe\xb1\xf2\x0e\x27\xdc\xaa\x95\x86"
      "\xdd\x4f\x76\xad\x80\xc7\xdd\x85\x1f\x23\x00\x50\xe5\x1d\x81\xb5\xe9\xc2"
      "\x84\x77\xe3\x8d\x65\xa6\x72\x22\xf1\x1f\x4a\xa8\xb3\xd6\xf4\xe2\xe2\xee"
      "\xd8\x07\xbe\x07\x43\x7b\xb6\x7d\x52\x1e\x85\x98\xbc\xf4\xc1\x08\x61\xe6"
      "\x9b\xe3\x05\x45\xac\x0d\x28\x82\xd9\x19\x04\xfd\xae\xd7\x4d\xf1\x69\x4c"
      "\xb8\x8c\x3d\xde\x81\x20\x73\x47\xc5\x01\x20\xe9\x5d\xb2\x11\xab\xd2\xc8"
      "\x6b\x4c\x53\xaf\x31\xe2\xba\x42\xd2\xf0\xb5\x34\x20\x36\xd9\x67\x31\x76"
      "\x79\xdf\xfc\x4a\xea\x9f\x53\x69\x42\x5c\x7c\xdb\x40\x3c\xbe\x45\x0e\xd3"
      "\x2a\x9d\xd6\xb4\x5e\xa5\x12\x6a\x23\x22\xba\xee\xa2\x9d\xb7\xb6\xec\x43"
      "\x6d\x9b\xc4\x22\x17\xcd\x5c\x59\x71\x66\xb5\x6d\xd1\x42\x42\x56\x3f\x2f"
      "\x88\x3b\xad\x01\xfd\xae\x3d\x81\xd7\xcc\xbd\x85\xf0\x0d\x6d\x51\x06\x46"
      "\x56\x13\xb2\xbc\x01\x02\x71\x44\x9c\xde\x4f\x1c\x38\x08\x02\x46\x72\x52"
      "\x42\x21\x87\x7a\x5f\x0f\x1a\x23\x00\x33\xd2\x7c\xee\x2f\xe5\x96\x72\xf0"
      "\x3e\x1b\xd5\x15\x1a\x44\x88\x43\x74\x6d\x16\xb0\x85\x9d\x1a\x46\xb4\xba"
      "\xe1\x26\xe0\x8e\x24\x72\xed\x91\x9c\x57\x00\x62\x2b\xe7\x94\xe9\x7b\xec"
      "\x16\x58\x0c\x56\x57\xbf\x9d\x2c\x48\x1b\x45\x69\x0e\x56\xf1\xb7\x1f\x6c"
      "\xd6\xe4\x7d\x93\x17\xee\x7d\x60\x62\x4c\xa8\x93\x2a\x3f\x49\x58\x4c\x25"
      "\x42\xe9\x89\x2a\xe3\xb2\xc5\x67\x49\xf5\x2b\x59\x9b\xeb\x3c\xaa\x31\xa6"
      "\x67\xd6\xf7\xce\x45\x1d\x37\xe8\x66\x73\xc9\x66\xf3\x3b\x26\xce\x8f\x7b"
      "\x1b\xe4\xa9\xd4\x8d\x90\x31\x14\xcc\x98\x8c\x06\xe0\x0e\x12\xbd\x9a\xe7"
      "\x64\x09\x0c\x21\x8b\xf0\x65\x62\x9b\xc0\xac\x38\x4b\xa3\x00\xa5\xda\x62"
      "\xc6\x59\x28\x4c\xc7\x9b\x99\xcc\xf9\x32\x53\xee\xcd\xf8\x1a\xa1\xe1\x9d"
      "\xd9\x23\xea\x74\x3a\x44\x2d\x01\xd7\x90\xab\xa5\x5e\xd8\xbd\x2d\x2d\x97"
      "\x47\xb9\x00\xbd\xf2\x10\x25\x4a\x51\x4d\x8a\x60\xfb\x24\xdf\x74\xde\x8d"
      "\x51\x29\x5a\xc4\x9e\xa6\x3d\x8b\x35\x21\x77\xc3\x86\x99\x9a\xf7\xe9\x16"
      "\x1a\xe6\xd8\x31\x3c\xfd\x2c\xc1\x6b\x2f\xce\xf7\xc7\xe4\xad\x12\x14\x95"
      "\xeb\xe5\x42\xd8\xa1\x1f\x19\x30\xc8\x4f\x43\x7f\x81\x53\x42\x50\x44\x8d"
      "\x97\xb3\x86\xec\xa0\xb6\x26\x8d\x05\x89\x6d\x86\x73\xc9\xa5\x4c\x90\x9b"
      "\xff\xcf\xe7\x8d\xd9\xf9\xfa\xed\x08\x1e\x1a\x7e\x1c\x64\x3f\x8a\x01\xab"
      "\x17\x55\x07\xf1\xfb\xc4\xc9\x3e\xaa\x65\x3a\x74\x99\x70\x5b\x83\xeb\x3a"
      "\x7f\x88\x05\xaa\x6a\x48\x0e\xef\x4c\x1f\xe8\x46\xb3\xb6\xee\x69\x43\x2f"
      "\x2e\xc5\x72\x98\x83\xea\x1c\xa3\x04\x19\x27\x7c\x1c\x0d\x0d\x41\x3b\xaa"
      "\xcc\xa0\x2c\xb0\xaa\x6f\x6a\x31\x80\x05\x3e\xfc\xf5\x33\xcc\x87\xc2\xd5"
      "\xba\x0b\x29\x95\xde\x44\xfa\x16\x19\xd9\xca\xa6\x09\x8b\xac\xd1\x4e\x6b"
      "\x99\x4f\x08\x3d\xe2\x5b\xc6\x9c\xb7\x0d\xbf\x61\x1f\x6a\x55\x56\xbc\x93"
      "\x84\x77\x6c\x83\x2d\x0c\x72\x71\x0e\xe7\x18\x84\x83\x30\xaf\x2f\x31\x66"
      "\x4b\x4c\x84\xb7\x79\x72\xf4\x7a\x72\x8d\xaf\xdc\x21\x2b\xf6\x8c\xff\x5d"
      "\x1d\x98\x1b\x2b\x42\x6f\x0d\xf7\x38\xef\x09\x39\x76\x47\x89\x64\x1d\x69"
      "\x3b\x56\x19\x21\xd3\x05\xba\xa0\xe7\x72\x3c\xbb\x9a\x42\xed\x38\x02\x61"
      "\x95\x52\xd4\x17\x2b\x7a\xae\xfc\x58\x4f\x37\x08\xea\xe2\x0f\xda\x48\xcc"
      "\xda\xa4\x59\xec\xd6\x8d\x65\x5c\x33\x05\x29\x9c\xa5\x47\xd6\xc4\x2f\x97"
      "\xb1\x68\xfe\x2d\x41\xbe\xb3\xe1\x5c\xd8\x76\xd7\x23\x6d\x1c\x58\x08\xa0"
      "\xf5\x56\xf7\xbb\xd6\x41\xda\x42\x53\xdd\x43\xf1\xcc\xda\x21\x38\xec\xbc"
      "\x19\xec\xf5\x71\x36\x9c\xfa\xab\x3b\x3c\x43\x48\x4e\xa2\xb9\xca\x65\x3d"
      "\x38\x3f\x2c\xee\x22\xc4\x77\xeb\xd1\x37\x8f\xb0\xac\x91\x87\x4c\x2c\x5d"
      "\x86\x5d\x7e\x1b\x66\x54\xc6\xa2\x50\x10\x35\xbe\x71\x2a\x67\x3a\x30\x4d"
      "\x79\x5d\x52\x2f\xf8\x44\x14\x71\x1a\x02\x39\x76\x0a\x66\x97\xf1\x22\x27"
      "\x85\xc3\xee\x41\x0d\x43\x60\x2f\x0c\x85\x77\x35\xbf\x20\x22\xd6\xc2\xf1"
      "\xfa\xaf\x67\x57\x63\x29\xf7\x09\x2c\x8e\x00\x94\xc5\xe1\xfe\x16\xe1\x03"
      "\x91\xec\x98\xe2\x6b\x4e\xa7\xf1\xb2\xb8\x53\xd7\x7a\x95\x45\x9d\xfd\x6d"
      "\x45\x39\xf4\xe7\xc4\x14\x17\x57\x4c\xbb\xc9\x5b\x0d\x5a\x6d\x0c\x5b\x93"
      "\xe1\xf7\xce\x95\x41\xb0\x11\x14\x5e\x31\x24\xa3\x33\x16\xb2\x19\xfa\x3b"
      "\xa9\x37\x45\x83\x0c\xe4\x92\x36\xab\x34\xc5\xc8\x6a\x25\x1e\x20\x1b\x17"
      "\xf4\x4f\x7e\x07\xef\xa5\x27\xb4\x13\xcd\x5d\x82\x59\xa0\xc5\xa6\x64\x78"
      "\x29\x68\xc3\x30\x12\x80\x4f\x76\x1e\xaf\xa1\x32\xb2\xfd\x61\x12\x2f\xd6"
      "\x75\xe2\x98\xd4\xd7\xac\xdb\xa4\x86\x80\xfe\x15\xa3\x02\xc0\x90\xbc\x11"
      "\x09\x5d\x98\x89\xf8\xaa\xd2\xa0\x96\x71\x0f\x89\x6f\xbd\x90\x23\x2b\x0e"
      "\x68\x2d\xea\x47\xa4\x82\x1c\xd1\x65\xba\xb6\x32\x6a\x95\x1a\x26\x9f\xc0"
      "\xde\x29\x48\x4e\x0e\x6c\x34\xbd\x36\x94\xa2\x25\x53\x5e\x2e\x27\xd4\xf6"
      "\xc7\x92\xfe\xa4\x6f\xfa\xe5\xea\xa9\x24\xfd\xe5\xcc\x7b\x96\xee\x6a\x29"
      "\x6b\x46\x8d\x4f\xad\xc2\x9a\xe8\xa8\x08\xf2\x95\x9e\xcd\x72\xf8\x17\x08"
      "\xf1\x57\xda\x7e\xe6\xc0\xb5\x6c\x0e\xb9\xbe\xaa\x9e\x39\x46\xf1\xf3\x70"
      "\xea\x1d\x15\x8d\xe2\x09\xbf\x2a\xa7\xa0\xb9\x0e\x30\x8f\x8b\xc7\x12\x1d"
      "\x9a\x8b\x2f\xa5\x15\xa2\xcb\xfc\x9a\x52\x8c\x18\xc8\x7f\x1d\xca\x8b\x68"
      "\x5e\xf0\xf3\xdd\x0b\x80\x28\x1e\x04\x95\x5a\xf5\xe7\x81\x9c\xec\x2d\xc9"
      "\x88\x1a\x10\x49\x53\x1c\x63\xe0\x22\x24\x99\x87\x66\x95\xfb\x39\x0b\x18"
      "\x7b\xc5\xc5\x62\xfc\x0d\x91\x37\xe3\xdd\x9c\x20\x07\xdf\xae\x5d\xab\x90"
      "\x5d\xf4\x52\xc3\x10\x10\x29\x15\x70\x3e\x07\xf9\xa0\x5f\x17\x73\x62\x00"
      "\x7b\xe2\xb3\xab\x5c\x3d\x69\x0e\x0f\x7d\x0b\xcf\x60\xe2\xf9\xc5\x24\xf2"
      "\xb3\xd6\xe9\x37\x4f\xdb\xb4\x95\xb1\xff\xa5\x50\x15\xed\x7f\x37\xb5\xdb"
      "\x85\x23\x51\xe7\x6f\x48\xb0\xf8\xd8\xd1\x30\x85\xdd\x1b\xae\xbe\x2e\x02"
      "\x00\xc9\x08\x42\x4c\xa1\xc3\x6f\xf1\x5b\x04\xb4\xdb\x4a\xdf\x89\xdf\x64"
      "\x29\xe6\xaf\x50\xa0\x26\x02\x3e\xc5\x09",
      4096);
  *(uint16_t*)0x20001b9c = 0;
  *(uint16_t*)0x20001b9e = 0x4e00;
  syz_usb_ep_write(-1, 0x82, 0x11e0, 0x200009c0);
  *(uint8_t*)0x20000040 = 0;
  *(uint8_t*)0x20000041 = 0;
  *(uint16_t*)0x20000042 = htobe16(0xa);
  memcpy((void*)0x20000044, "\x07\x12\x70\x6e", 4);
  *(uint16_t*)0x20000048 = htobe16(3);
  *(uint16_t*)0x2000004a = htobe16(0x100);
  *(uint8_t*)0x2000004c = 0;
  *(uint8_t*)0x2000004d = 0;
  *(uint16_t*)0x2000004e = htobe16(0);
  *(uint8_t*)0x20000050 = 0;
  *(uint8_t*)0x20000051 = 0;
  syz_usb_ep_write(r[0], 0x83, 0xffffffffffffff9c, 0x20000040);
  return 0;
}