// https://syzkaller.appspot.com/bug?id=61714127fcffd45b73cbd408ae695751952b87aa
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <arpa/inet.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <net/if_arp.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/uio.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}
#include <stdint.h>
#include <string.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type, bf_off, bf_len)                                  \
  (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len)                      \
  if ((bf_off) == 0 && (bf_len) == 0) {                                        \
    *(type*)(addr) = (type)(val);                                              \
  } else {                                                                     \
    type new_val = *(type*)(addr);                                             \
    new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len));                     \
    new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off);          \
    *(type*)(addr) = new_val;                                                  \
  }

struct csum_inet {
  uint32_t acc;
};

static void csum_inet_init(struct csum_inet* csum)
{
  csum->acc = 0;
}

static void csum_inet_update(struct csum_inet* csum, const uint8_t* data,
                             size_t length)
{
  if (length == 0)
    return;

  size_t i;
  for (i = 0; i < length - 1; i += 2)
    csum->acc += *(uint16_t*)&data[i];

  if (length & 1)
    csum->acc += (uint16_t)data[length - 1];

  while (csum->acc > 0xffff)
    csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
}

static uint16_t csum_inet_digest(struct csum_inet* csum)
{
  return ~csum->acc;
}

static void vsnprintf_check(char* str, size_t size, const char* format,
                            va_list args)
{
  int rv;

  rv = vsnprintf(str, size, format, args);
  if (rv < 0)
    fail("tun: snprintf failed");
  if ((size_t)rv >= size)
    fail("tun: string '%s...' doesn't fit into buffer", str);
}

static void snprintf_check(char* str, size_t size, const char* format, ...)
{
  va_list args;

  va_start(args, format);
  vsnprintf_check(str, size, format, args);
  va_end(args);
}

#define COMMAND_MAX_LEN 128
#define PATH_PREFIX                                                            \
  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin "
#define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1)

static void execute_command(bool panic, const char* format, ...)
{
  va_list args;
  char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN];
  int rv;

  va_start(args, format);
  memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN);
  vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args);
  rv = system(command);
  if (panic && rv != 0)
    fail("tun: command \"%s\" failed with code %d", &command[0], rv);

  va_end(args);
}

static int tunfd = -1;
static int tun_frags_enabled;

#define SYZ_TUN_MAX_PACKET_SIZE 1000

#define MAX_PIDS 32
#define ADDR_MAX_LEN 32

#define LOCAL_MAC "aa:aa:aa:aa:%02hx:aa"
#define REMOTE_MAC "aa:aa:aa:aa:%02hx:bb"

#define LOCAL_IPV4 "172.20.%d.170"
#define REMOTE_IPV4 "172.20.%d.187"

#define LOCAL_IPV6 "fe80::%02hx:aa"
#define REMOTE_IPV6 "fe80::%02hx:bb"

#define IFF_NAPI 0x0010
#define IFF_NAPI_FRAGS 0x0020

static void initialize_tun(int id)
{
  if (id >= MAX_PIDS)
    fail("tun: no more than %d executors", MAX_PIDS);

  tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
  if (tunfd == -1) {
    printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
    printf("otherwise fuzzing or reproducing might not work as intended\n");
    return;
  }

  char iface[IFNAMSIZ];
  snprintf_check(iface, sizeof(iface), "syz%d", id);

  struct ifreq ifr;
  memset(&ifr, 0, sizeof(ifr));
  strncpy(ifr.ifr_name, iface, IFNAMSIZ);
  ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS;
  if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
    if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0)
      fail("tun: ioctl(TUNSETIFF) failed");
  }
  if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0)
    fail("tun: ioctl(TUNGETIFF) failed");
  tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0;

  char local_mac[ADDR_MAX_LEN];
  snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC, id);
  char remote_mac[ADDR_MAX_LEN];
  snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC, id);

  char local_ipv4[ADDR_MAX_LEN];
  snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, id);
  char remote_ipv4[ADDR_MAX_LEN];
  snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, id);

  char local_ipv6[ADDR_MAX_LEN];
  snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, id);
  char remote_ipv6[ADDR_MAX_LEN];
  snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, id);

  execute_command(1, "sysctl -w net.ipv6.conf.%s.accept_dad=0", iface);

  execute_command(1, "sysctl -w net.ipv6.conf.%s.router_solicitations=0",
                  iface);

  execute_command(1, "ip link set dev %s address %s", iface, local_mac);
  execute_command(1, "ip addr add %s/24 dev %s", local_ipv4, iface);
  execute_command(1, "ip -6 addr add %s/120 dev %s", local_ipv6, iface);
  execute_command(1, "ip neigh add %s lladdr %s dev %s nud permanent",
                  remote_ipv4, remote_mac, iface);
  execute_command(1, "ip -6 neigh add %s lladdr %s dev %s nud permanent",
                  remote_ipv6, remote_mac, iface);
  execute_command(1, "ip link set dev %s up", iface);
}

#define DEV_IPV4 "172.20.%d.%d"
#define DEV_IPV6 "fe80::%02hx:%02hx"
#define DEV_MAC "aa:aa:aa:aa:%02hx:%02hx"

static void initialize_netdevices(int id)
{
  unsigned i;
  const char* devtypes[] = {"ip6gretap", "bridge", "vcan"};
  const char* devnames[] = {"lo",       "sit0",    "bridge0", "vcan0",
                            "tunl0",    "gre0",    "gretap0", "ip_vti0",
                            "ip6_vti0", "ip6tnl0", "ip6gre0", "ip6gretap0",
                            "erspan0"};

  for (i = 0; i < sizeof(devtypes) / (sizeof(devtypes[0])); i++)
    execute_command(0, "ip link add dev %s0 type %s", devtypes[i], devtypes[i]);
  for (i = 0; i < sizeof(devnames) / (sizeof(devnames[0])); i++) {
    char addr[ADDR_MAX_LEN];
    snprintf_check(addr, sizeof(addr), DEV_IPV4, id, id + 10);
    execute_command(0, "ip -4 addr add %s/24 dev %s", addr, devnames[i]);
    snprintf_check(addr, sizeof(addr), DEV_IPV6, id, id + 10);
    execute_command(0, "ip -6 addr add %s/120 dev %s", addr, devnames[i]);
    snprintf_check(addr, sizeof(addr), DEV_MAC, id, id + 10);
    execute_command(0, "ip link set dev %s address %s", devnames[i], addr);
    execute_command(0, "ip link set dev %s up", devnames[i]);
  }
}

static void setup_tun(uint64_t pid, bool enable_tun)
{
  if (enable_tun) {
    initialize_tun(pid);
    initialize_netdevices(pid);
  }
}

#define MAX_FRAGS 4
struct vnet_fragmentation {
  uint32_t full;
  uint32_t count;
  uint32_t frags[MAX_FRAGS];
};

static uintptr_t syz_emit_ethernet(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (tunfd < 0)
    return (uintptr_t)-1;

  uint32_t length = a0;
  char* data = (char*)a1;

  struct vnet_fragmentation* frags = (struct vnet_fragmentation*)a2;
  struct iovec vecs[MAX_FRAGS + 1];
  uint32_t nfrags = 0;
  if (!tun_frags_enabled || frags == NULL) {
    vecs[nfrags].iov_base = data;
    vecs[nfrags].iov_len = length;
    nfrags++;
  } else {
    bool full = true;
    uint32_t i, count = 0;
    full = frags->full;
    count = frags->count;
    if (count > MAX_FRAGS)
      count = MAX_FRAGS;
    for (i = 0; i < count && length != 0; i++) {
      uint32_t size = 0;
      size = frags->frags[i];
      if (size > length)
        size = length;
      vecs[nfrags].iov_base = data;
      vecs[nfrags].iov_len = size;
      nfrags++;
      data += size;
      length -= size;
    }
    if (length != 0 && (full || nfrags == 0)) {
      vecs[nfrags].iov_base = data;
      vecs[nfrags].iov_len = length;
      nfrags++;
    }
  }
  return writev(tunfd, vecs, nfrags);
}

#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_socket
#define __NR_socket 359
#endif
#ifndef __NR_setsockopt
#define __NR_setsockopt 366
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

long r[1];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  r[0] = syscall(__NR_socket, 2, 3, 0xbf);
  memcpy((void*)0x20cf4c2c, "\x6d\x61\x6e\x67\x6c\x65\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00",
         32);
  *(uint32_t*)0x20cf4c4c = 0x1f;
  *(uint32_t*)0x20cf4c50 = 6;
  *(uint32_t*)0x20cf4c54 = 0x378;
  *(uint32_t*)0x20cf4c58 = 0;
  *(uint32_t*)0x20cf4c5c = 0x1bc;
  *(uint32_t*)0x20cf4c60 = 0x94;
  *(uint32_t*)0x20cf4c64 = 0x250;
  *(uint32_t*)0x20cf4c68 = 0x94;
  *(uint32_t*)0x20cf4c6c = 0x2e4;
  *(uint32_t*)0x20cf4c70 = 0x2e4;
  *(uint32_t*)0x20cf4c74 = 0x2e4;
  *(uint32_t*)0x20cf4c78 = 0x2e4;
  *(uint32_t*)0x20cf4c7c = 0x2e4;
  *(uint32_t*)0x20cf4c80 = 6;
  *(uint32_t*)0x20cf4c84 = 0x2000cfa0;
  *(uint8_t*)0x20cf4c88 = 0;
  *(uint8_t*)0x20cf4c89 = 0;
  *(uint8_t*)0x20cf4c8a = 0;
  *(uint8_t*)0x20cf4c8b = 0;
  *(uint8_t*)0x20cf4c8c = 0;
  *(uint8_t*)0x20cf4c8d = 0;
  *(uint8_t*)0x20cf4c8e = 0;
  *(uint8_t*)0x20cf4c8f = 0;
  *(uint8_t*)0x20cf4c90 = 0;
  *(uint8_t*)0x20cf4c91 = 0;
  *(uint8_t*)0x20cf4c92 = 0;
  *(uint8_t*)0x20cf4c93 = 0;
  *(uint8_t*)0x20cf4c94 = 0;
  *(uint8_t*)0x20cf4c95 = 0;
  *(uint8_t*)0x20cf4c96 = 0;
  *(uint8_t*)0x20cf4c97 = 0;
  *(uint8_t*)0x20cf4c98 = 0;
  *(uint8_t*)0x20cf4c99 = 0;
  *(uint8_t*)0x20cf4c9a = 0;
  *(uint8_t*)0x20cf4c9b = 0;
  *(uint8_t*)0x20cf4c9c = 0;
  *(uint8_t*)0x20cf4c9d = 0;
  *(uint8_t*)0x20cf4c9e = 0;
  *(uint8_t*)0x20cf4c9f = 0;
  *(uint8_t*)0x20cf4ca0 = 0;
  *(uint8_t*)0x20cf4ca1 = 0;
  *(uint8_t*)0x20cf4ca2 = 0;
  *(uint8_t*)0x20cf4ca3 = 0;
  *(uint8_t*)0x20cf4ca4 = 0;
  *(uint8_t*)0x20cf4ca5 = 0;
  *(uint8_t*)0x20cf4ca6 = 0;
  *(uint8_t*)0x20cf4ca7 = 0;
  *(uint8_t*)0x20cf4ca8 = 0;
  *(uint8_t*)0x20cf4ca9 = 0;
  *(uint8_t*)0x20cf4caa = 0;
  *(uint8_t*)0x20cf4cab = 0;
  *(uint8_t*)0x20cf4cac = 0;
  *(uint8_t*)0x20cf4cad = 0;
  *(uint8_t*)0x20cf4cae = 0;
  *(uint8_t*)0x20cf4caf = 0;
  *(uint8_t*)0x20cf4cb0 = 0;
  *(uint8_t*)0x20cf4cb1 = 0;
  *(uint8_t*)0x20cf4cb2 = 0;
  *(uint8_t*)0x20cf4cb3 = 0;
  *(uint8_t*)0x20cf4cb4 = 0;
  *(uint8_t*)0x20cf4cb5 = 0;
  *(uint8_t*)0x20cf4cb6 = 0;
  *(uint8_t*)0x20cf4cb7 = 0;
  *(uint8_t*)0x20cf4cb8 = 0;
  *(uint8_t*)0x20cf4cb9 = 0;
  *(uint8_t*)0x20cf4cba = 0;
  *(uint8_t*)0x20cf4cbb = 0;
  *(uint8_t*)0x20cf4cbc = 0;
  *(uint8_t*)0x20cf4cbd = 0;
  *(uint8_t*)0x20cf4cbe = 0;
  *(uint8_t*)0x20cf4cbf = 0;
  *(uint8_t*)0x20cf4cc0 = 0;
  *(uint8_t*)0x20cf4cc1 = 0;
  *(uint8_t*)0x20cf4cc2 = 0;
  *(uint8_t*)0x20cf4cc3 = 0;
  *(uint8_t*)0x20cf4cc4 = 0;
  *(uint8_t*)0x20cf4cc5 = 0;
  *(uint8_t*)0x20cf4cc6 = 0;
  *(uint8_t*)0x20cf4cc7 = 0;
  *(uint8_t*)0x20cf4cc8 = 0;
  *(uint8_t*)0x20cf4cc9 = 0;
  *(uint8_t*)0x20cf4cca = 0;
  *(uint8_t*)0x20cf4ccb = 0;
  *(uint8_t*)0x20cf4ccc = 0;
  *(uint8_t*)0x20cf4ccd = 0;
  *(uint8_t*)0x20cf4cce = 0;
  *(uint8_t*)0x20cf4ccf = 0;
  *(uint8_t*)0x20cf4cd0 = 0;
  *(uint8_t*)0x20cf4cd1 = 0;
  *(uint8_t*)0x20cf4cd2 = 0;
  *(uint8_t*)0x20cf4cd3 = 0;
  *(uint8_t*)0x20cf4cd4 = 0;
  *(uint8_t*)0x20cf4cd5 = 0;
  *(uint8_t*)0x20cf4cd6 = 0;
  *(uint8_t*)0x20cf4cd7 = 0;
  *(uint8_t*)0x20cf4cd8 = 0;
  *(uint8_t*)0x20cf4cd9 = 0;
  *(uint8_t*)0x20cf4cda = 0;
  *(uint8_t*)0x20cf4cdb = 0;
  *(uint32_t*)0x20cf4cdc = 0;
  *(uint16_t*)0x20cf4ce0 = 0x70;
  *(uint16_t*)0x20cf4ce2 = 0x94;
  *(uint32_t*)0x20cf4ce4 = 0;
  *(uint64_t*)0x20cf4ce8 = 0;
  *(uint64_t*)0x20cf4cf0 = 0;
  *(uint16_t*)0x20cf4cf8 = 0x24;
  memcpy((void*)0x20cf4cfa, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20cf4d17 = 0;
  *(uint32_t*)0x20cf4d18 = 0x1bc;
  *(uint8_t*)0x20cf4d1c = 0xac;
  *(uint8_t*)0x20cf4d1d = 0x14;
  *(uint8_t*)0x20cf4d1e = 0;
  *(uint8_t*)0x20cf4d1f = 0xaa;
  *(uint32_t*)0x20cf4d20 = htobe32(0);
  *(uint32_t*)0x20cf4d24 = htobe32(0);
  *(uint32_t*)0x20cf4d28 = htobe32(0);
  memcpy((void*)0x20cf4d2c,
         "\x6d\x75\x3f\xd9\x3f\x0e\xd4\xc8\x6a\x85\x37\x12\xd9\xa3\xc1\x10",
         16);
  memcpy((void*)0x20cf4d3c,
         "\x74\x65\x71\x6c\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         16);
  *(uint8_t*)0x20cf4d4c = 0;
  *(uint8_t*)0x20cf4d4d = 0;
  *(uint8_t*)0x20cf4d4e = 0;
  *(uint8_t*)0x20cf4d4f = 0;
  *(uint8_t*)0x20cf4d50 = 0;
  *(uint8_t*)0x20cf4d51 = 0;
  *(uint8_t*)0x20cf4d52 = 0;
  *(uint8_t*)0x20cf4d53 = 0;
  *(uint8_t*)0x20cf4d54 = 0;
  *(uint8_t*)0x20cf4d55 = 0;
  *(uint8_t*)0x20cf4d56 = 0;
  *(uint8_t*)0x20cf4d57 = 0;
  *(uint8_t*)0x20cf4d58 = 0;
  *(uint8_t*)0x20cf4d59 = 0;
  *(uint8_t*)0x20cf4d5a = 0;
  *(uint8_t*)0x20cf4d5b = 0;
  *(uint8_t*)0x20cf4d5c = 0;
  *(uint8_t*)0x20cf4d5d = 0;
  *(uint8_t*)0x20cf4d5e = 0;
  *(uint8_t*)0x20cf4d5f = 0;
  *(uint8_t*)0x20cf4d60 = 0;
  *(uint8_t*)0x20cf4d61 = 0;
  *(uint8_t*)0x20cf4d62 = 0;
  *(uint8_t*)0x20cf4d63 = 0;
  *(uint8_t*)0x20cf4d64 = 0;
  *(uint8_t*)0x20cf4d65 = 0;
  *(uint8_t*)0x20cf4d66 = 0;
  *(uint8_t*)0x20cf4d67 = 0;
  *(uint8_t*)0x20cf4d68 = 0;
  *(uint8_t*)0x20cf4d69 = 0;
  *(uint8_t*)0x20cf4d6a = 0;
  *(uint8_t*)0x20cf4d6b = 0;
  *(uint16_t*)0x20cf4d6c = 0;
  *(uint8_t*)0x20cf4d6e = 0;
  *(uint8_t*)0x20cf4d6f = 0;
  *(uint32_t*)0x20cf4d70 = 0;
  *(uint16_t*)0x20cf4d74 = 0x70;
  *(uint16_t*)0x20cf4d76 = 0x94;
  *(uint32_t*)0x20cf4d78 = 0;
  *(uint64_t*)0x20cf4d7c = 0;
  *(uint64_t*)0x20cf4d84 = 0;
  *(uint16_t*)0x20cf4d8c = 0x24;
  memcpy((void*)0x20cf4d8e, "\x54\x54\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20cf4dab = 0;
  *(uint8_t*)0x20cf4dac = 0;
  *(uint8_t*)0x20cf4dad = 0;
  *(uint8_t*)0x20cf4db0 = 0xac;
  *(uint8_t*)0x20cf4db1 = 0x14;
  *(uint8_t*)0x20cf4db2 = 0;
  *(uint8_t*)0x20cf4db3 = 0xaa;
  *(uint32_t*)0x20cf4db4 = htobe32(0);
  *(uint32_t*)0x20cf4db8 = htobe32(0);
  *(uint32_t*)0x20cf4dbc = htobe32(0);
  *(uint8_t*)0x20cf4dc0 = 0x73;
  *(uint8_t*)0x20cf4dc1 = 0x79;
  *(uint8_t*)0x20cf4dc2 = 0x7a;
  *(uint8_t*)0x20cf4dc3 = 0;
  *(uint8_t*)0x20cf4dc4 = 0;
  *(uint8_t*)0x20cf4dd0 = 0x73;
  *(uint8_t*)0x20cf4dd1 = 0x79;
  *(uint8_t*)0x20cf4dd2 = 0x7a;
  *(uint8_t*)0x20cf4dd3 = 0;
  *(uint8_t*)0x20cf4dd4 = 0;
  *(uint8_t*)0x20cf4de0 = 0;
  *(uint8_t*)0x20cf4de1 = 0;
  *(uint8_t*)0x20cf4de2 = 0;
  *(uint8_t*)0x20cf4de3 = 0;
  *(uint8_t*)0x20cf4de4 = 0;
  *(uint8_t*)0x20cf4de5 = 0;
  *(uint8_t*)0x20cf4de6 = 0;
  *(uint8_t*)0x20cf4de7 = 0;
  *(uint8_t*)0x20cf4de8 = 0;
  *(uint8_t*)0x20cf4de9 = 0;
  *(uint8_t*)0x20cf4dea = 0;
  *(uint8_t*)0x20cf4deb = 0;
  *(uint8_t*)0x20cf4dec = 0;
  *(uint8_t*)0x20cf4ded = 0;
  *(uint8_t*)0x20cf4dee = 0;
  *(uint8_t*)0x20cf4def = 0;
  *(uint8_t*)0x20cf4df0 = 0;
  *(uint8_t*)0x20cf4df1 = 0;
  *(uint8_t*)0x20cf4df2 = 0;
  *(uint8_t*)0x20cf4df3 = 0;
  *(uint8_t*)0x20cf4df4 = 0;
  *(uint8_t*)0x20cf4df5 = 0;
  *(uint8_t*)0x20cf4df6 = 0;
  *(uint8_t*)0x20cf4df7 = 0;
  *(uint8_t*)0x20cf4df8 = 0;
  *(uint8_t*)0x20cf4df9 = 0;
  *(uint8_t*)0x20cf4dfa = 0;
  *(uint8_t*)0x20cf4dfb = 0;
  *(uint8_t*)0x20cf4dfc = 0;
  *(uint8_t*)0x20cf4dfd = 0;
  *(uint8_t*)0x20cf4dfe = 0;
  *(uint8_t*)0x20cf4dff = 0;
  *(uint16_t*)0x20cf4e00 = 0;
  *(uint8_t*)0x20cf4e02 = 0;
  *(uint8_t*)0x20cf4e03 = 0;
  *(uint32_t*)0x20cf4e04 = 0;
  *(uint16_t*)0x20cf4e08 = 0x70;
  *(uint16_t*)0x20cf4e0a = 0x94;
  *(uint32_t*)0x20cf4e0c = 0;
  *(uint64_t*)0x20cf4e10 = 0;
  *(uint64_t*)0x20cf4e18 = 0;
  *(uint16_t*)0x20cf4e20 = 0x24;
  memcpy((void*)0x20cf4e22, "\x45\x43\x4e\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20cf4e3f = 0;
  *(uint8_t*)0x20cf4e40 = 0;
  *(uint8_t*)0x20cf4e41 = 0;
  *(uint8_t*)0x20cf4e42 = 0;
  *(uint32_t*)0x20cf4e44 = htobe32(-1);
  *(uint32_t*)0x20cf4e48 = htobe32(0);
  *(uint32_t*)0x20cf4e4c = htobe32(0);
  *(uint32_t*)0x20cf4e50 = htobe32(0);
  *(uint8_t*)0x20cf4e54 = 0x73;
  *(uint8_t*)0x20cf4e55 = 0x79;
  *(uint8_t*)0x20cf4e56 = 0x7a;
  *(uint8_t*)0x20cf4e57 = 0;
  *(uint8_t*)0x20cf4e58 = 0;
  memcpy((void*)0x20cf4e64,
         "\xac\x4c\x0d\x98\x2a\x5c\x1f\xf5\xd1\x6b\x08\xc1\x61\x72\x2a\xa9",
         16);
  *(uint8_t*)0x20cf4e74 = 0;
  *(uint8_t*)0x20cf4e75 = 0;
  *(uint8_t*)0x20cf4e76 = 0;
  *(uint8_t*)0x20cf4e77 = 0;
  *(uint8_t*)0x20cf4e78 = 0;
  *(uint8_t*)0x20cf4e79 = 0;
  *(uint8_t*)0x20cf4e7a = 0;
  *(uint8_t*)0x20cf4e7b = 0;
  *(uint8_t*)0x20cf4e7c = 0;
  *(uint8_t*)0x20cf4e7d = 0;
  *(uint8_t*)0x20cf4e7e = 0;
  *(uint8_t*)0x20cf4e7f = 0;
  *(uint8_t*)0x20cf4e80 = 0;
  *(uint8_t*)0x20cf4e81 = 0;
  *(uint8_t*)0x20cf4e82 = 0;
  *(uint8_t*)0x20cf4e83 = 0;
  *(uint8_t*)0x20cf4e84 = 0;
  *(uint8_t*)0x20cf4e85 = 0;
  *(uint8_t*)0x20cf4e86 = 0;
  *(uint8_t*)0x20cf4e87 = 0;
  *(uint8_t*)0x20cf4e88 = 0;
  *(uint8_t*)0x20cf4e89 = 0;
  *(uint8_t*)0x20cf4e8a = 0;
  *(uint8_t*)0x20cf4e8b = 0;
  *(uint8_t*)0x20cf4e8c = 0;
  *(uint8_t*)0x20cf4e8d = 0;
  *(uint8_t*)0x20cf4e8e = 0;
  *(uint8_t*)0x20cf4e8f = 0;
  *(uint8_t*)0x20cf4e90 = 0;
  *(uint8_t*)0x20cf4e91 = 0;
  *(uint8_t*)0x20cf4e92 = 0;
  *(uint8_t*)0x20cf4e93 = 0;
  *(uint16_t*)0x20cf4e94 = 0;
  *(uint8_t*)0x20cf4e96 = 0;
  *(uint8_t*)0x20cf4e97 = 0;
  *(uint32_t*)0x20cf4e98 = 0;
  *(uint16_t*)0x20cf4e9c = 0x70;
  *(uint16_t*)0x20cf4e9e = 0x94;
  *(uint32_t*)0x20cf4ea0 = 0;
  *(uint64_t*)0x20cf4ea4 = 0;
  *(uint64_t*)0x20cf4eac = 0;
  *(uint16_t*)0x20cf4eb4 = 0x24;
  memcpy((void*)0x20cf4eb6, "\x54\x54\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20cf4ed3 = 0;
  *(uint8_t*)0x20cf4ed4 = 0;
  *(uint8_t*)0x20cf4ed5 = 0;
  *(uint8_t*)0x20cf4ed8 = 0;
  *(uint8_t*)0x20cf4ed9 = 0;
  *(uint8_t*)0x20cf4eda = 0;
  *(uint8_t*)0x20cf4edb = 0;
  *(uint8_t*)0x20cf4edc = 0;
  *(uint8_t*)0x20cf4edd = 0;
  *(uint8_t*)0x20cf4ede = 0;
  *(uint8_t*)0x20cf4edf = 0;
  *(uint8_t*)0x20cf4ee0 = 0;
  *(uint8_t*)0x20cf4ee1 = 0;
  *(uint8_t*)0x20cf4ee2 = 0;
  *(uint8_t*)0x20cf4ee3 = 0;
  *(uint8_t*)0x20cf4ee4 = 0;
  *(uint8_t*)0x20cf4ee5 = 0;
  *(uint8_t*)0x20cf4ee6 = 0;
  *(uint8_t*)0x20cf4ee7 = 0;
  *(uint8_t*)0x20cf4ee8 = 0;
  *(uint8_t*)0x20cf4ee9 = 0;
  *(uint8_t*)0x20cf4eea = 0;
  *(uint8_t*)0x20cf4eeb = 0;
  *(uint8_t*)0x20cf4eec = 0;
  *(uint8_t*)0x20cf4eed = 0;
  *(uint8_t*)0x20cf4eee = 0;
  *(uint8_t*)0x20cf4eef = 0;
  *(uint8_t*)0x20cf4ef0 = 0;
  *(uint8_t*)0x20cf4ef1 = 0;
  *(uint8_t*)0x20cf4ef2 = 0;
  *(uint8_t*)0x20cf4ef3 = 0;
  *(uint8_t*)0x20cf4ef4 = 0;
  *(uint8_t*)0x20cf4ef5 = 0;
  *(uint8_t*)0x20cf4ef6 = 0;
  *(uint8_t*)0x20cf4ef7 = 0;
  *(uint8_t*)0x20cf4ef8 = 0;
  *(uint8_t*)0x20cf4ef9 = 0;
  *(uint8_t*)0x20cf4efa = 0;
  *(uint8_t*)0x20cf4efb = 0;
  *(uint8_t*)0x20cf4efc = 0;
  *(uint8_t*)0x20cf4efd = 0;
  *(uint8_t*)0x20cf4efe = 0;
  *(uint8_t*)0x20cf4eff = 0;
  *(uint8_t*)0x20cf4f00 = 0;
  *(uint8_t*)0x20cf4f01 = 0;
  *(uint8_t*)0x20cf4f02 = 0;
  *(uint8_t*)0x20cf4f03 = 0;
  *(uint8_t*)0x20cf4f04 = 0;
  *(uint8_t*)0x20cf4f05 = 0;
  *(uint8_t*)0x20cf4f06 = 0;
  *(uint8_t*)0x20cf4f07 = 0;
  *(uint8_t*)0x20cf4f08 = 0;
  *(uint8_t*)0x20cf4f09 = 0;
  *(uint8_t*)0x20cf4f0a = 0;
  *(uint8_t*)0x20cf4f0b = 0;
  *(uint8_t*)0x20cf4f0c = 0;
  *(uint8_t*)0x20cf4f0d = 0;
  *(uint8_t*)0x20cf4f0e = 0;
  *(uint8_t*)0x20cf4f0f = 0;
  *(uint8_t*)0x20cf4f10 = 0;
  *(uint8_t*)0x20cf4f11 = 0;
  *(uint8_t*)0x20cf4f12 = 0;
  *(uint8_t*)0x20cf4f13 = 0;
  *(uint8_t*)0x20cf4f14 = 0;
  *(uint8_t*)0x20cf4f15 = 0;
  *(uint8_t*)0x20cf4f16 = 0;
  *(uint8_t*)0x20cf4f17 = 0;
  *(uint8_t*)0x20cf4f18 = 0;
  *(uint8_t*)0x20cf4f19 = 0;
  *(uint8_t*)0x20cf4f1a = 0;
  *(uint8_t*)0x20cf4f1b = 0;
  *(uint8_t*)0x20cf4f1c = 0;
  *(uint8_t*)0x20cf4f1d = 0;
  *(uint8_t*)0x20cf4f1e = 0;
  *(uint8_t*)0x20cf4f1f = 0;
  *(uint8_t*)0x20cf4f20 = 0;
  *(uint8_t*)0x20cf4f21 = 0;
  *(uint8_t*)0x20cf4f22 = 0;
  *(uint8_t*)0x20cf4f23 = 0;
  *(uint8_t*)0x20cf4f24 = 0;
  *(uint8_t*)0x20cf4f25 = 0;
  *(uint8_t*)0x20cf4f26 = 0;
  *(uint8_t*)0x20cf4f27 = 0;
  *(uint8_t*)0x20cf4f28 = 0;
  *(uint8_t*)0x20cf4f29 = 0;
  *(uint8_t*)0x20cf4f2a = 0;
  *(uint8_t*)0x20cf4f2b = 0;
  *(uint32_t*)0x20cf4f2c = 0;
  *(uint16_t*)0x20cf4f30 = 0x70;
  *(uint16_t*)0x20cf4f32 = 0x94;
  *(uint32_t*)0x20cf4f34 = 0;
  *(uint64_t*)0x20cf4f38 = 0;
  *(uint64_t*)0x20cf4f40 = 0;
  *(uint16_t*)0x20cf4f48 = 0x24;
  memcpy((void*)0x20cf4f4a, "\x45\x43\x4e\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20cf4f67 = 0;
  *(uint8_t*)0x20cf4f68 = 0;
  *(uint8_t*)0x20cf4f69 = 0;
  *(uint8_t*)0x20cf4f6a = 0;
  *(uint8_t*)0x20cf4f6c = 0;
  *(uint8_t*)0x20cf4f6d = 0;
  *(uint8_t*)0x20cf4f6e = 0;
  *(uint8_t*)0x20cf4f6f = 0;
  *(uint8_t*)0x20cf4f70 = 0;
  *(uint8_t*)0x20cf4f71 = 0;
  *(uint8_t*)0x20cf4f72 = 0;
  *(uint8_t*)0x20cf4f73 = 0;
  *(uint8_t*)0x20cf4f74 = 0;
  *(uint8_t*)0x20cf4f75 = 0;
  *(uint8_t*)0x20cf4f76 = 0;
  *(uint8_t*)0x20cf4f77 = 0;
  *(uint8_t*)0x20cf4f78 = 0;
  *(uint8_t*)0x20cf4f79 = 0;
  *(uint8_t*)0x20cf4f7a = 0;
  *(uint8_t*)0x20cf4f7b = 0;
  *(uint8_t*)0x20cf4f7c = 0;
  *(uint8_t*)0x20cf4f7d = 0;
  *(uint8_t*)0x20cf4f7e = 0;
  *(uint8_t*)0x20cf4f7f = 0;
  *(uint8_t*)0x20cf4f80 = 0;
  *(uint8_t*)0x20cf4f81 = 0;
  *(uint8_t*)0x20cf4f82 = 0;
  *(uint8_t*)0x20cf4f83 = 0;
  *(uint8_t*)0x20cf4f84 = 0;
  *(uint8_t*)0x20cf4f85 = 0;
  *(uint8_t*)0x20cf4f86 = 0;
  *(uint8_t*)0x20cf4f87 = 0;
  *(uint8_t*)0x20cf4f88 = 0;
  *(uint8_t*)0x20cf4f89 = 0;
  *(uint8_t*)0x20cf4f8a = 0;
  *(uint8_t*)0x20cf4f8b = 0;
  *(uint8_t*)0x20cf4f8c = 0;
  *(uint8_t*)0x20cf4f8d = 0;
  *(uint8_t*)0x20cf4f8e = 0;
  *(uint8_t*)0x20cf4f8f = 0;
  *(uint8_t*)0x20cf4f90 = 0;
  *(uint8_t*)0x20cf4f91 = 0;
  *(uint8_t*)0x20cf4f92 = 0;
  *(uint8_t*)0x20cf4f93 = 0;
  *(uint8_t*)0x20cf4f94 = 0;
  *(uint8_t*)0x20cf4f95 = 0;
  *(uint8_t*)0x20cf4f96 = 0;
  *(uint8_t*)0x20cf4f97 = 0;
  *(uint8_t*)0x20cf4f98 = 0;
  *(uint8_t*)0x20cf4f99 = 0;
  *(uint8_t*)0x20cf4f9a = 0;
  *(uint8_t*)0x20cf4f9b = 0;
  *(uint8_t*)0x20cf4f9c = 0;
  *(uint8_t*)0x20cf4f9d = 0;
  *(uint8_t*)0x20cf4f9e = 0;
  *(uint8_t*)0x20cf4f9f = 0;
  *(uint8_t*)0x20cf4fa0 = 0;
  *(uint8_t*)0x20cf4fa1 = 0;
  *(uint8_t*)0x20cf4fa2 = 0;
  *(uint8_t*)0x20cf4fa3 = 0;
  *(uint8_t*)0x20cf4fa4 = 0;
  *(uint8_t*)0x20cf4fa5 = 0;
  *(uint8_t*)0x20cf4fa6 = 0;
  *(uint8_t*)0x20cf4fa7 = 0;
  *(uint8_t*)0x20cf4fa8 = 0;
  *(uint8_t*)0x20cf4fa9 = 0;
  *(uint8_t*)0x20cf4faa = 0;
  *(uint8_t*)0x20cf4fab = 0;
  *(uint8_t*)0x20cf4fac = 0;
  *(uint8_t*)0x20cf4fad = 0;
  *(uint8_t*)0x20cf4fae = 0;
  *(uint8_t*)0x20cf4faf = 0;
  *(uint8_t*)0x20cf4fb0 = 0;
  *(uint8_t*)0x20cf4fb1 = 0;
  *(uint8_t*)0x20cf4fb2 = 0;
  *(uint8_t*)0x20cf4fb3 = 0;
  *(uint8_t*)0x20cf4fb4 = 0;
  *(uint8_t*)0x20cf4fb5 = 0;
  *(uint8_t*)0x20cf4fb6 = 0;
  *(uint8_t*)0x20cf4fb7 = 0;
  *(uint8_t*)0x20cf4fb8 = 0;
  *(uint8_t*)0x20cf4fb9 = 0;
  *(uint8_t*)0x20cf4fba = 0;
  *(uint8_t*)0x20cf4fbb = 0;
  *(uint8_t*)0x20cf4fbc = 0;
  *(uint8_t*)0x20cf4fbd = 0;
  *(uint8_t*)0x20cf4fbe = 0;
  *(uint8_t*)0x20cf4fbf = 0;
  *(uint32_t*)0x20cf4fc0 = 0;
  *(uint16_t*)0x20cf4fc4 = 0x70;
  *(uint16_t*)0x20cf4fc6 = 0x94;
  *(uint32_t*)0x20cf4fc8 = 0;
  *(uint64_t*)0x20cf4fcc = 0;
  *(uint64_t*)0x20cf4fd4 = 0;
  *(uint16_t*)0x20cf4fdc = 0x24;
  memcpy((void*)0x20cf4fde, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20cf4ffb = 0;
  *(uint32_t*)0x20cf4ffc = 0xfffffffe;
  syscall(__NR_setsockopt, r[0], 0, 0x40, 0x20cf4c2c, 0x3d4);
  *(uint8_t*)0x2002af8f = -1;
  *(uint8_t*)0x2002af90 = -1;
  *(uint8_t*)0x2002af91 = -1;
  *(uint8_t*)0x2002af92 = -1;
  *(uint8_t*)0x2002af93 = -1;
  *(uint8_t*)0x2002af94 = -1;
  *(uint8_t*)0x2002af95 = 0;
  *(uint8_t*)0x2002af96 = 0;
  *(uint8_t*)0x2002af97 = 0;
  *(uint8_t*)0x2002af98 = 0;
  *(uint8_t*)0x2002af99 = 0;
  *(uint8_t*)0x2002af9a = 0;
  *(uint16_t*)0x2002af9b = htobe16(0x800);
  STORE_BY_BITMASK(uint8_t, 0x2002af9d, 5, 0, 4);
  STORE_BY_BITMASK(uint8_t, 0x2002af9d, 4, 4, 4);
  STORE_BY_BITMASK(uint8_t, 0x2002af9e, 0, 0, 2);
  STORE_BY_BITMASK(uint8_t, 0x2002af9e, 0, 2, 6);
  *(uint16_t*)0x2002af9f = htobe16(0x28);
  *(uint16_t*)0x2002afa1 = 0;
  *(uint16_t*)0x2002afa3 = htobe16(0);
  *(uint8_t*)0x2002afa5 = 0;
  *(uint8_t*)0x2002afa6 = 6;
  *(uint16_t*)0x2002afa7 = 0;
  *(uint8_t*)0x2002afa9 = 0xac;
  *(uint8_t*)0x2002afaa = 0x14;
  *(uint8_t*)0x2002afab = 0;
  *(uint8_t*)0x2002afac = 0xaa;
  *(uint32_t*)0x2002afad = htobe32(0);
  *(uint16_t*)0x2002afb1 = 0;
  *(uint16_t*)0x2002afb3 = 0;
  *(uint32_t*)0x2002afb5 = 0x42424242;
  *(uint32_t*)0x2002afb9 = 0x42424242;
  STORE_BY_BITMASK(uint8_t, 0x2002afbd, 0, 0, 1);
  STORE_BY_BITMASK(uint8_t, 0x2002afbd, 0, 1, 3);
  STORE_BY_BITMASK(uint8_t, 0x2002afbd, 5, 4, 4);
  *(uint8_t*)0x2002afbe = 0x9a;
  *(uint16_t*)0x2002afbf = htobe16(0);
  *(uint16_t*)0x2002afc1 = 0;
  *(uint16_t*)0x2002afc3 = htobe16(0);
  struct csum_inet csum_1;
  csum_inet_init(&csum_1);
  csum_inet_update(&csum_1, (const uint8_t*)0x2002afa9, 4);
  csum_inet_update(&csum_1, (const uint8_t*)0x2002afad, 4);
  uint16_t csum_1_chunk_2 = 0x600;
  csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_2, 2);
  uint16_t csum_1_chunk_3 = 0x1400;
  csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_3, 2);
  csum_inet_update(&csum_1, (const uint8_t*)0x2002afb1, 20);
  *(uint16_t*)0x2002afc1 = csum_inet_digest(&csum_1);
  struct csum_inet csum_2;
  csum_inet_init(&csum_2);
  csum_inet_update(&csum_2, (const uint8_t*)0x2002af9d, 20);
  *(uint16_t*)0x2002afa7 = csum_inet_digest(&csum_2);
  syz_emit_ethernet(0x36, 0x2002af8f, 0x20000000);
}

int main()
{
  setup_tun(0, true);
  loop();
  return 0;
}