// https://syzkaller.appspot.com/bug?id=90cd06695bd4650a5228385b4b02f370ef9c219f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; *(uint32_t*)0x20000240 = 2; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = 0; *(uint32_t*)0x2000024c = 0; *(uint32_t*)0x20000250 = 0; *(uint8_t*)0x20000254 = 0; *(uint8_t*)0x20000255 = 0; *(uint8_t*)0x20000256 = 0; *(uint8_t*)0x20000257 = 0; *(uint8_t*)0x20000258 = 0; *(uint8_t*)0x20000259 = 0; *(uint8_t*)0x2000025a = 0; *(uint8_t*)0x2000025b = 0; *(uint8_t*)0x2000025c = 0; *(uint8_t*)0x2000025d = 0; *(uint8_t*)0x2000025e = 0; *(uint8_t*)0x2000025f = 0; *(uint8_t*)0x20000260 = 0; *(uint8_t*)0x20000261 = 0; *(uint8_t*)0x20000262 = 0; *(uint8_t*)0x20000263 = 0; *(uint8_t*)0x20000264 = 0; *(uint8_t*)0x20000265 = 0; *(uint8_t*)0x20000266 = 0; *(uint8_t*)0x20000267 = 0; *(uint8_t*)0x20000268 = 0; *(uint8_t*)0x20000269 = 0; *(uint8_t*)0x2000026a = 0; *(uint8_t*)0x2000026b = 0; *(uint8_t*)0x2000026c = 0; *(uint8_t*)0x2000026d = 0; *(uint8_t*)0x2000026e = 0; *(uint8_t*)0x2000026f = 0; *(uint8_t*)0x20000270 = 0; *(uint8_t*)0x20000271 = 0; *(uint8_t*)0x20000272 = 0; *(uint8_t*)0x20000273 = 0; *(uint8_t*)0x20000274 = 0; *(uint8_t*)0x20000275 = 0; *(uint8_t*)0x20000276 = 0; *(uint8_t*)0x20000277 = 0; *(uint8_t*)0x20000278 = 0; *(uint8_t*)0x20000279 = 0; *(uint8_t*)0x2000027a = 0; *(uint8_t*)0x2000027b = 0; *(uint8_t*)0x2000027c = 0; *(uint8_t*)0x2000027d = 0; *(uint8_t*)0x2000027e = 0; *(uint8_t*)0x2000027f = 0; *(uint8_t*)0x20000280 = 0; *(uint8_t*)0x20000281 = 0; *(uint8_t*)0x20000282 = 0; *(uint8_t*)0x20000283 = 0; *(uint8_t*)0x20000284 = 0; *(uint8_t*)0x20000285 = 0; *(uint8_t*)0x20000286 = 0; *(uint8_t*)0x20000287 = 0; *(uint8_t*)0x20000288 = 0; *(uint8_t*)0x20000289 = 0; *(uint8_t*)0x2000028a = 0; *(uint8_t*)0x2000028b = 0; *(uint8_t*)0x2000028c = 0; *(uint8_t*)0x2000028d = 0; *(uint8_t*)0x2000028e = 0; *(uint8_t*)0x2000028f = 0; *(uint8_t*)0x20000290 = 0; *(uint8_t*)0x20000291 = 0; *(uint8_t*)0x20000292 = 0; *(uint8_t*)0x20000293 = 0; *(uint8_t*)0x20000294 = 0; *(uint8_t*)0x20000295 = 0; *(uint8_t*)0x20000296 = 0; *(uint8_t*)0x20000297 = 0; *(uint8_t*)0x20000298 = 0; *(uint8_t*)0x20000299 = 0; *(uint8_t*)0x2000029a = 0; *(uint8_t*)0x2000029b = 0; *(uint8_t*)0x2000029c = 0; *(uint8_t*)0x2000029d = 0; *(uint8_t*)0x2000029e = 0; *(uint8_t*)0x2000029f = 0; *(uint8_t*)0x200002a0 = 0; *(uint8_t*)0x200002a1 = 0; *(uint8_t*)0x200002a2 = 0; *(uint8_t*)0x200002a3 = 0; *(uint8_t*)0x200002a4 = 0; *(uint8_t*)0x200002a5 = 0; *(uint8_t*)0x200002a6 = 0; *(uint8_t*)0x200002a7 = 0; *(uint8_t*)0x200002a8 = 0; *(uint8_t*)0x200002a9 = 0; *(uint8_t*)0x200002aa = 0; *(uint8_t*)0x200002ab = 0; *(uint8_t*)0x200002ac = 0; *(uint8_t*)0x200002ad = 0; *(uint8_t*)0x200002ae = 0; *(uint8_t*)0x200002af = 0; *(uint8_t*)0x200002b0 = 0; *(uint8_t*)0x200002b1 = 0; *(uint8_t*)0x200002b2 = 0; *(uint8_t*)0x200002b3 = 0; *(uint8_t*)0x200002b4 = 0; *(uint8_t*)0x200002b5 = 0; *(uint8_t*)0x200002b6 = 0; *(uint8_t*)0x200002b7 = 0; *(uint8_t*)0x200002b8 = 0; *(uint8_t*)0x200002b9 = 0; *(uint8_t*)0x200002ba = 0; *(uint8_t*)0x200002bb = 0; *(uint8_t*)0x200002bc = 0; *(uint8_t*)0x200002bd = 0; *(uint8_t*)0x200002be = 0; *(uint8_t*)0x200002bf = 0; *(uint8_t*)0x200002c0 = 0; *(uint8_t*)0x200002c1 = 0; *(uint8_t*)0x200002c2 = 0; *(uint8_t*)0x200002c3 = 0; *(uint8_t*)0x200002c4 = 0; *(uint8_t*)0x200002c5 = 0; *(uint8_t*)0x200002c6 = 0; *(uint8_t*)0x200002c7 = 0; *(uint8_t*)0x200002c8 = 0; *(uint8_t*)0x200002c9 = 0; *(uint8_t*)0x200002ca = 0; *(uint8_t*)0x200002cb = 0; *(uint8_t*)0x200002cc = 0; *(uint8_t*)0x200002cd = 0; *(uint8_t*)0x200002ce = 0; *(uint8_t*)0x200002cf = 0; *(uint8_t*)0x200002d0 = 0; *(uint8_t*)0x200002d1 = 0; *(uint8_t*)0x200002d2 = 0; *(uint8_t*)0x200002d3 = 0; *(uint8_t*)0x200002d4 = 0; *(uint8_t*)0x200002d5 = 0; *(uint8_t*)0x200002d6 = 0; *(uint8_t*)0x200002d7 = 0; *(uint8_t*)0x200002d8 = 0; *(uint8_t*)0x200002d9 = 0; *(uint8_t*)0x200002da = 0; *(uint8_t*)0x200002db = 0; *(uint8_t*)0x200002dc = 0; *(uint8_t*)0x200002dd = 0; *(uint8_t*)0x200002de = 0; *(uint8_t*)0x200002df = 0; *(uint8_t*)0x200002e0 = 0; *(uint8_t*)0x200002e1 = 0; *(uint8_t*)0x200002e2 = 0; *(uint8_t*)0x200002e3 = 0; *(uint8_t*)0x200002e4 = 0; *(uint8_t*)0x200002e5 = 0; *(uint8_t*)0x200002e6 = 0; *(uint8_t*)0x200002e7 = 0; *(uint8_t*)0x200002e8 = 0; *(uint8_t*)0x200002e9 = 0; *(uint8_t*)0x200002ea = 0; *(uint8_t*)0x200002eb = 0; *(uint8_t*)0x200002ec = 0; *(uint8_t*)0x200002ed = 0; *(uint8_t*)0x200002ee = 0; *(uint8_t*)0x200002ef = 0; *(uint8_t*)0x200002f0 = 0; *(uint8_t*)0x200002f1 = 0; *(uint8_t*)0x200002f2 = 0; *(uint8_t*)0x200002f3 = 0; *(uint8_t*)0x200002f4 = 0; *(uint8_t*)0x200002f5 = 0; *(uint8_t*)0x200002f6 = 0; *(uint8_t*)0x200002f7 = 0; *(uint8_t*)0x200002f8 = 0; *(uint8_t*)0x200002f9 = 0; *(uint8_t*)0x200002fa = 0; *(uint8_t*)0x200002fb = 0; *(uint8_t*)0x200002fc = 0; *(uint8_t*)0x200002fd = 0; *(uint8_t*)0x200002fe = 0; *(uint8_t*)0x200002ff = 0; *(uint8_t*)0x20000300 = 0; *(uint8_t*)0x20000301 = 0; *(uint8_t*)0x20000302 = 0; *(uint8_t*)0x20000303 = 0; *(uint32_t*)0x20000304 = 0; *(uint32_t*)0x20000308 = 0; *(uint8_t*)0x2000030c = 0; *(uint8_t*)0x2000030d = 0; *(uint8_t*)0x2000030e = 0; *(uint8_t*)0x2000030f = 0; *(uint8_t*)0x20000310 = 0; *(uint8_t*)0x20000311 = 0; *(uint8_t*)0x20000312 = 0; *(uint8_t*)0x20000313 = 0; *(uint8_t*)0x20000314 = 0; *(uint8_t*)0x20000315 = 0; *(uint8_t*)0x20000316 = 0; *(uint8_t*)0x20000317 = 0; *(uint8_t*)0x20000318 = 0; *(uint8_t*)0x20000319 = 0; *(uint8_t*)0x2000031a = 0; *(uint8_t*)0x2000031b = 0; *(uint8_t*)0x2000031c = 0; *(uint8_t*)0x2000031d = 0; *(uint8_t*)0x2000031e = 0; *(uint8_t*)0x2000031f = 0; *(uint8_t*)0x20000320 = 0; *(uint8_t*)0x20000321 = 0; *(uint8_t*)0x20000322 = 0; *(uint8_t*)0x20000323 = 0; *(uint8_t*)0x20000324 = 0; *(uint8_t*)0x20000325 = 0; *(uint8_t*)0x20000326 = 0; *(uint8_t*)0x20000327 = 0; *(uint8_t*)0x20000328 = 0; *(uint8_t*)0x20000329 = 0; *(uint8_t*)0x2000032a = 0; *(uint8_t*)0x2000032b = 0; *(uint8_t*)0x2000032c = 0; *(uint8_t*)0x2000032d = 0; *(uint8_t*)0x2000032e = 0; *(uint8_t*)0x2000032f = 0; *(uint8_t*)0x20000330 = 0; *(uint8_t*)0x20000331 = 0; *(uint8_t*)0x20000332 = 0; *(uint8_t*)0x20000333 = 0; *(uint8_t*)0x20000334 = 0; *(uint8_t*)0x20000335 = 0; *(uint8_t*)0x20000336 = 0; *(uint8_t*)0x20000337 = 0; *(uint8_t*)0x20000338 = 0; *(uint8_t*)0x20000339 = 0; *(uint8_t*)0x2000033a = 0; *(uint8_t*)0x2000033b = 0; *(uint8_t*)0x2000033c = 0; *(uint8_t*)0x2000033d = 0; *(uint8_t*)0x2000033e = 0; *(uint8_t*)0x2000033f = 0; *(uint8_t*)0x20000340 = 0; *(uint8_t*)0x20000341 = 0; *(uint8_t*)0x20000342 = 0; *(uint8_t*)0x20000343 = 0; *(uint8_t*)0x20000344 = 0; *(uint8_t*)0x20000345 = 0; *(uint8_t*)0x20000346 = 0; *(uint8_t*)0x20000347 = 0; *(uint8_t*)0x20000348 = 0; *(uint8_t*)0x20000349 = 0; *(uint8_t*)0x2000034a = 0; *(uint8_t*)0x2000034b = 0; syscall(__NR_ioctl, -1, 0xc10c5541, 0x20000240); memcpy((void*)0x20000480, "/dev/kvm", 9); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000480, 0, 0); if (res != -1) r[0] = res; res = syscall(__NR_ioctl, r[0], 0xae01, 0); if (res != -1) r[1] = res; res = syscall(__NR_ioctl, r[1], 0xae41, 0); if (res != -1) r[2] = res; *(uint32_t*)0x200001c0 = 2; *(uint32_t*)0x200001c4 = 0; *(uint64_t*)0x200001c8 = 0x40000071; *(uint64_t*)0x200001d0 = 0; *(uint64_t*)0x200001d8 = 0; *(uint64_t*)0x200001e0 = 0; *(uint8_t*)0x200001e8 = 0; *(uint8_t*)0x200001e9 = 0; *(uint8_t*)0x200001ea = 0; *(uint8_t*)0x200001eb = 0; *(uint8_t*)0x200001ec = 0; *(uint8_t*)0x200001ed = 0; *(uint8_t*)0x200001ee = 0; *(uint8_t*)0x200001ef = 0; *(uint8_t*)0x200001f0 = 0; *(uint8_t*)0x200001f1 = 0; *(uint8_t*)0x200001f2 = 0; *(uint8_t*)0x200001f3 = 0; *(uint8_t*)0x200001f4 = 0; *(uint8_t*)0x200001f5 = 0; *(uint8_t*)0x200001f6 = 0; *(uint8_t*)0x200001f7 = 0; *(uint8_t*)0x200001f8 = 0; *(uint8_t*)0x200001f9 = 0; *(uint8_t*)0x200001fa = 0; *(uint8_t*)0x200001fb = 0; *(uint8_t*)0x200001fc = 0; *(uint8_t*)0x200001fd = 0; *(uint8_t*)0x200001fe = 0; *(uint8_t*)0x200001ff = 0; *(uint8_t*)0x20000200 = 0; *(uint8_t*)0x20000201 = 0; *(uint8_t*)0x20000202 = 0; *(uint8_t*)0x20000203 = 0; *(uint8_t*)0x20000204 = 0; *(uint8_t*)0x20000205 = 0; *(uint8_t*)0x20000206 = 0; *(uint8_t*)0x20000207 = 0; *(uint8_t*)0x20000208 = 0; *(uint8_t*)0x20000209 = 0; *(uint8_t*)0x2000020a = 0; *(uint8_t*)0x2000020b = 0; *(uint8_t*)0x2000020c = 0; *(uint8_t*)0x2000020d = 0; *(uint8_t*)0x2000020e = 0; *(uint8_t*)0x2000020f = 0; *(uint8_t*)0x20000210 = 0; *(uint8_t*)0x20000211 = 0; *(uint8_t*)0x20000212 = 0; *(uint8_t*)0x20000213 = 0; *(uint8_t*)0x20000214 = 0; *(uint8_t*)0x20000215 = 0; *(uint8_t*)0x20000216 = 0; *(uint8_t*)0x20000217 = 0; *(uint8_t*)0x20000218 = 0; *(uint8_t*)0x20000219 = 0; *(uint8_t*)0x2000021a = 0; *(uint8_t*)0x2000021b = 0; *(uint8_t*)0x2000021c = 0; *(uint8_t*)0x2000021d = 0; *(uint8_t*)0x2000021e = 0; *(uint8_t*)0x2000021f = 0; *(uint8_t*)0x20000220 = 0; *(uint8_t*)0x20000221 = 0; *(uint8_t*)0x20000222 = 0; *(uint8_t*)0x20000223 = 0; *(uint8_t*)0x20000224 = 0; *(uint8_t*)0x20000225 = 0; *(uint8_t*)0x20000226 = 0; *(uint8_t*)0x20000227 = 0; syscall(__NR_ioctl, r[2], 0x4080aebf, 0x200001c0); syscall(__NR_setsockopt, -1, 0x117, 1, 0x20000080, 0); syscall(__NR_write, -1, 0x20000240, 0); *(uint32_t*)0x20000100 = 1; *(uint32_t*)0x20000104 = 3; *(uint64_t*)0x20000108 = 0x20001fd8; *(uint8_t*)0x20001fd8 = 0xb4; STORE_BY_BITMASK(uint8_t, 0x20001fd9, 0, 0, 4); STORE_BY_BITMASK(uint8_t, 0x20001fd9, 0, 4, 4); *(uint16_t*)0x20001fda = 0; *(uint32_t*)0x20001fdc = 0; *(uint8_t*)0x20001fe0 = 0x72; *(uint8_t*)0x20001fe1 = 0xa; *(uint16_t*)0x20001fe2 = 0xffe5; *(uint32_t*)0x20001fe4 = 0; *(uint8_t*)0x20001fe8 = 0x95; *(uint8_t*)0x20001fe9 = 0; *(uint16_t*)0x20001fea = 0; *(uint32_t*)0x20001fec = 0; *(uint64_t*)0x20000110 = 0x20000180; memcpy((void*)0x20000180, "\x45\x50\xd4\x00\x1f\x91\xeb\x2f\x57\xb7\x32\x24\x43\x30\x25\x03\x9c" "\x30\x96\xb2\x0c\x6b\x43\x93\x48\xbf\x68\x9c\x08\x60\x85\x37\xd6\x22" "\x3e\x63\xad\xc0\x62\x4f\xba\xe2\xe1\x09\x35\x9d\xce\x69\x22\x32\x4c" "\xcc\x13\x16\x0b\x68\xca\xe6\x43\x06\x97\x25\x9d\xd5\x2d\x1f\x73\xe1" "\x6a\xdc\x35\x92\xd0\x29\x25\xdf\xfa\xe8\x5e\x9c\xd2\x39\x8c\x6c\x67" "\xc8\x7f\xb5\xb1\x26\x02\xf1\x45\xb4\x84\xbe\x45\x91\x29\x66\xe8\xb7" "\xe2\xf6\x60\x69\xc5\x6d\xd7\x6c\x1d\xc1\x12\x01\x3c\x3a\x6b\x4d\xe9" "\x99\xcd\xcd\xc8\x85\x5a\xee\x34\x37\xdc\xc8\x75\x80\xcf\xbe\x54\x6f" "\xbb\xfb\xc0\xeb\x56\xd8\xbb\xbe\xa2\x90\x4a\x7c\x73\xc2", 150); *(uint32_t*)0x20000118 = 0; *(uint32_t*)0x2000011c = 0x60; *(uint64_t*)0x20000120 = 0x20000000; *(uint32_t*)0x20000128 = 0; *(uint32_t*)0x2000012c = 0; *(uint8_t*)0x20000130 = 0; *(uint8_t*)0x20000131 = 0; *(uint8_t*)0x20000132 = 0; *(uint8_t*)0x20000133 = 0; *(uint8_t*)0x20000134 = 0; *(uint8_t*)0x20000135 = 0; *(uint8_t*)0x20000136 = 0; *(uint8_t*)0x20000137 = 0; *(uint8_t*)0x20000138 = 0; *(uint8_t*)0x20000139 = 0; *(uint8_t*)0x2000013a = 0; *(uint8_t*)0x2000013b = 0; *(uint8_t*)0x2000013c = 0; *(uint8_t*)0x2000013d = 0; *(uint8_t*)0x2000013e = 0; *(uint8_t*)0x2000013f = 0; *(uint32_t*)0x20000140 = 0; *(uint32_t*)0x20000144 = 0; syscall(__NR_bpf, 5, 0x20000100, 0x16); syscall(__NR_ioctl, -1, 0xae41, 0); *(uint64_t*)0x20000a00 = 0x200009c0; *(uint64_t*)0x200009c0 = 0x20000900; *(uint64_t*)0x20000900 = 0; *(uint64_t*)0x200009d0 = 0x20000980; *(uint64_t*)0x20000980 = 0x20000940; *(uint64_t*)0x20000940 = 0; *(uint64_t*)0x20000a40 = 0xc; syscall(__NR_get_robust_list, 0, 0x20000a00, 0x20000a40); *(uint32_t*)0x20000000 = 0x79; *(uint32_t*)0x20000004 = 0; *(uint64_t*)0x20000008 = 0; *(uint64_t*)0x20000010 = 0; *(uint64_t*)0x20000018 = 0; *(uint64_t*)0x20000020 = 0; *(uint8_t*)0x20000028 = 0; *(uint8_t*)0x20000029 = 0; *(uint8_t*)0x2000002a = 0; *(uint8_t*)0x2000002b = 0; *(uint8_t*)0x2000002c = 0; *(uint8_t*)0x2000002d = 0; *(uint8_t*)0x2000002e = 0; *(uint8_t*)0x2000002f = 0; *(uint8_t*)0x20000030 = 0; *(uint8_t*)0x20000031 = 0; *(uint8_t*)0x20000032 = 0; *(uint8_t*)0x20000033 = 0; *(uint8_t*)0x20000034 = 0; *(uint8_t*)0x20000035 = 0; *(uint8_t*)0x20000036 = 0; *(uint8_t*)0x20000037 = 0; *(uint8_t*)0x20000038 = 0; *(uint8_t*)0x20000039 = 0; *(uint8_t*)0x2000003a = 0; *(uint8_t*)0x2000003b = 0; *(uint8_t*)0x2000003c = 0; *(uint8_t*)0x2000003d = 0; *(uint8_t*)0x2000003e = 0; *(uint8_t*)0x2000003f = 0; *(uint8_t*)0x20000040 = 0; *(uint8_t*)0x20000041 = 0; *(uint8_t*)0x20000042 = 0; *(uint8_t*)0x20000043 = 0; *(uint8_t*)0x20000044 = 0; *(uint8_t*)0x20000045 = 0; *(uint8_t*)0x20000046 = 0; *(uint8_t*)0x20000047 = 0; *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; *(uint8_t*)0x20000050 = 0; *(uint8_t*)0x20000051 = 0; *(uint8_t*)0x20000052 = 0; *(uint8_t*)0x20000053 = 0; *(uint8_t*)0x20000054 = 0; *(uint8_t*)0x20000055 = 0; *(uint8_t*)0x20000056 = 0; *(uint8_t*)0x20000057 = 0; *(uint8_t*)0x20000058 = 0; *(uint8_t*)0x20000059 = 0; *(uint8_t*)0x2000005a = 0; *(uint8_t*)0x2000005b = 0; *(uint8_t*)0x2000005c = 0; *(uint8_t*)0x2000005d = 0; *(uint8_t*)0x2000005e = 0; *(uint8_t*)0x2000005f = 0; *(uint8_t*)0x20000060 = 0; *(uint8_t*)0x20000061 = 0; *(uint8_t*)0x20000062 = 0; *(uint8_t*)0x20000063 = 0; *(uint8_t*)0x20000064 = 0; *(uint8_t*)0x20000065 = 0; *(uint8_t*)0x20000066 = 0; *(uint8_t*)0x20000067 = 0; syscall(__NR_ioctl, -1, 0x4068aea3, 0x20000000); syscall(__NR_socketpair, 0x1e, 0, 0, 0x20000140); *(uint64_t*)0x20b6dfc8 = 0; *(uint32_t*)0x20b6dfd0 = 0; *(uint64_t*)0x20b6dfd8 = 0x208feff0; *(uint64_t*)0x208feff0 = 0x20327f68; *(uint64_t*)0x208feff8 = 0; *(uint64_t*)0x20b6dfe0 = 1; *(uint64_t*)0x20b6dfe8 = 0; *(uint64_t*)0x20b6dff0 = 0; *(uint32_t*)0x20b6dff8 = 0; syscall(__NR_sendmsg, -1, 0x20b6dfc8, 0); memcpy((void*)0x200000c0, "/dev/nullb0", 12); syscall(__NR_openat, 0xffffffffffffff9c, 0x200000c0, 0, 0); *(uint32_t*)0x20000040 = 0; syscall(__NR_setsockopt, -1, 0x29, 0x4b, 0x20000040, 4); syscall(__NR_ioctl, -1, 0xae80, 0); return 0; }