// https://syzkaller.appspot.com/bug?id=912f70e859dfffd2533b7cfcd2c71e0dd6f71e9d
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <arpa/inet.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <net/if_arp.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/uio.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}
#include <stdint.h>
#include <string.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

static void vsnprintf_check(char* str, size_t size, const char* format,
                            va_list args)
{
  int rv;

  rv = vsnprintf(str, size, format, args);
  if (rv < 0)
    fail("tun: snprintf failed");
  if ((size_t)rv >= size)
    fail("tun: string '%s...' doesn't fit into buffer", str);
}

static void snprintf_check(char* str, size_t size, const char* format, ...)
{
  va_list args;

  va_start(args, format);
  vsnprintf_check(str, size, format, args);
  va_end(args);
}

#define COMMAND_MAX_LEN 128
#define PATH_PREFIX                                                            \
  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin "
#define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1)

static void execute_command(bool panic, const char* format, ...)
{
  va_list args;
  char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN];
  int rv;

  va_start(args, format);
  memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN);
  vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args);
  rv = system(command);
  if (panic && rv != 0)
    fail("tun: command \"%s\" failed with code %d", &command[0], rv);

  va_end(args);
}

static int tunfd = -1;
static int tun_frags_enabled;

#define SYZ_TUN_MAX_PACKET_SIZE 1000

#define MAX_PIDS 32
#define ADDR_MAX_LEN 32

#define LOCAL_MAC "aa:aa:aa:aa:%02hx:aa"
#define REMOTE_MAC "aa:aa:aa:aa:%02hx:bb"

#define LOCAL_IPV4 "172.20.%d.170"
#define REMOTE_IPV4 "172.20.%d.187"

#define LOCAL_IPV6 "fe80::%02hx:aa"
#define REMOTE_IPV6 "fe80::%02hx:bb"

#define IFF_NAPI 0x0010
#define IFF_NAPI_FRAGS 0x0020

static void initialize_tun(int id)
{
  if (id >= MAX_PIDS)
    fail("tun: no more than %d executors", MAX_PIDS);

  tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
  if (tunfd == -1) {
    printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
    printf("otherwise fuzzing or reproducing might not work as intended\n");
    return;
  }

  char iface[IFNAMSIZ];
  snprintf_check(iface, sizeof(iface), "syz%d", id);

  struct ifreq ifr;
  memset(&ifr, 0, sizeof(ifr));
  strncpy(ifr.ifr_name, iface, IFNAMSIZ);
  ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS;
  if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
    if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0)
      fail("tun: ioctl(TUNSETIFF) failed");
  }
  if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0)
    fail("tun: ioctl(TUNGETIFF) failed");
  tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0;

  char local_mac[ADDR_MAX_LEN];
  snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC, id);
  char remote_mac[ADDR_MAX_LEN];
  snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC, id);

  char local_ipv4[ADDR_MAX_LEN];
  snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, id);
  char remote_ipv4[ADDR_MAX_LEN];
  snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, id);

  char local_ipv6[ADDR_MAX_LEN];
  snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, id);
  char remote_ipv6[ADDR_MAX_LEN];
  snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, id);

  execute_command(1, "sysctl -w net.ipv6.conf.%s.accept_dad=0", iface);

  execute_command(1, "sysctl -w net.ipv6.conf.%s.router_solicitations=0",
                  iface);

  execute_command(1, "ip link set dev %s address %s", iface, local_mac);
  execute_command(1, "ip addr add %s/24 dev %s", local_ipv4, iface);
  execute_command(1, "ip -6 addr add %s/120 dev %s", local_ipv6, iface);
  execute_command(1, "ip neigh add %s lladdr %s dev %s nud permanent",
                  remote_ipv4, remote_mac, iface);
  execute_command(1, "ip -6 neigh add %s lladdr %s dev %s nud permanent",
                  remote_ipv6, remote_mac, iface);
  execute_command(1, "ip link set dev %s up", iface);
}

#define DEV_IPV4 "172.20.%d.%d"
#define DEV_IPV6 "fe80::%02hx:%02hx"
#define DEV_MAC "aa:aa:aa:aa:%02hx:%02hx"

static void initialize_netdevices(int id)
{
  unsigned i;
  const char* devtypes[] = {"ip6gretap", "bridge", "vcan"};
  const char* devnames[] = {"lo",       "sit0",    "bridge0", "vcan0",
                            "tunl0",    "gre0",    "gretap0", "ip_vti0",
                            "ip6_vti0", "ip6tnl0", "ip6gre0", "ip6gretap0",
                            "erspan0"};

  for (i = 0; i < sizeof(devtypes) / (sizeof(devtypes[0])); i++)
    execute_command(0, "ip link add dev %s0 type %s", devtypes[i], devtypes[i]);
  for (i = 0; i < sizeof(devnames) / (sizeof(devnames[0])); i++) {
    char addr[ADDR_MAX_LEN];
    snprintf_check(addr, sizeof(addr), DEV_IPV4, id, id + 10);
    execute_command(0, "ip -4 addr add %s/24 dev %s", addr, devnames[i]);
    snprintf_check(addr, sizeof(addr), DEV_IPV6, id, id + 10);
    execute_command(0, "ip -6 addr add %s/120 dev %s", addr, devnames[i]);
    snprintf_check(addr, sizeof(addr), DEV_MAC, id, id + 10);
    execute_command(0, "ip link set dev %s address %s", devnames[i], addr);
    execute_command(0, "ip link set dev %s up", devnames[i]);
  }
}

static void setup_tun(uint64_t pid, bool enable_tun)
{
  if (enable_tun) {
    initialize_tun(pid);
    initialize_netdevices(pid);
  }
}

long r[2];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  r[0] = syscall(__NR_socket, 2, 1, 0);
  *(uint32_t*)0x20a5b000 = 0xc;
  syscall(__NR_getsockopt, r[0], 0, 0x29, 0x20296000, 0x20a5b000);
  r[1] = syscall(__NR_socket, 2, 0x806, 0);
  memcpy((void*)0x20004000, "\x66\x69\x6c\x74\x65\x72\x00\x00\x00\x52\x03\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00",
         32);
  *(uint32_t*)0x20004020 = 0xe;
  *(uint32_t*)0x20004024 = 4;
  *(uint32_t*)0x20004028 = 0x298;
  *(uint32_t*)0x2000402c = -1;
  *(uint32_t*)0x20004030 = 0;
  *(uint32_t*)0x20004034 = 0;
  *(uint32_t*)0x20004038 = 0;
  *(uint32_t*)0x2000403c = -1;
  *(uint32_t*)0x20004040 = -1;
  *(uint32_t*)0x20004044 = 0;
  *(uint32_t*)0x20004048 = 0;
  *(uint32_t*)0x2000404c = 0;
  *(uint32_t*)0x20004050 = -1;
  *(uint32_t*)0x20004054 = 4;
  *(uint64_t*)0x20004058 = 0x20001000;
  *(uint8_t*)0x20004060 = 0;
  *(uint8_t*)0x20004061 = 0;
  *(uint8_t*)0x20004062 = 0;
  *(uint8_t*)0x20004063 = 0;
  *(uint8_t*)0x20004064 = 0;
  *(uint8_t*)0x20004065 = 0;
  *(uint8_t*)0x20004066 = 0;
  *(uint8_t*)0x20004067 = 0;
  *(uint8_t*)0x20004068 = 0;
  *(uint8_t*)0x20004069 = 0;
  *(uint8_t*)0x2000406a = 0;
  *(uint8_t*)0x2000406b = 0;
  *(uint8_t*)0x2000406c = 0;
  *(uint8_t*)0x2000406d = 0;
  *(uint8_t*)0x2000406e = 0;
  *(uint8_t*)0x2000406f = 0;
  *(uint8_t*)0x20004070 = 0;
  *(uint8_t*)0x20004071 = 0;
  *(uint8_t*)0x20004072 = 0;
  *(uint8_t*)0x20004073 = 0;
  *(uint8_t*)0x20004074 = 0;
  *(uint8_t*)0x20004075 = 0;
  *(uint8_t*)0x20004076 = 0;
  *(uint8_t*)0x20004077 = 0;
  *(uint8_t*)0x20004078 = 0;
  *(uint8_t*)0x20004079 = 0;
  *(uint8_t*)0x2000407a = 0;
  *(uint8_t*)0x2000407b = 0;
  *(uint8_t*)0x2000407c = 0;
  *(uint8_t*)0x2000407d = 0;
  *(uint8_t*)0x2000407e = 0;
  *(uint8_t*)0x2000407f = 0;
  *(uint8_t*)0x20004080 = 0;
  *(uint8_t*)0x20004081 = 0;
  *(uint8_t*)0x20004082 = 0;
  *(uint8_t*)0x20004083 = 0;
  *(uint8_t*)0x20004084 = 0;
  *(uint8_t*)0x20004085 = 0;
  *(uint8_t*)0x20004086 = 0;
  *(uint8_t*)0x20004087 = 0;
  *(uint8_t*)0x20004088 = 0;
  *(uint8_t*)0x20004089 = 0;
  *(uint8_t*)0x2000408a = 0;
  *(uint8_t*)0x2000408b = 0;
  *(uint8_t*)0x2000408c = 0;
  *(uint8_t*)0x2000408d = 0;
  *(uint8_t*)0x2000408e = 0;
  *(uint8_t*)0x2000408f = 0;
  *(uint8_t*)0x20004090 = 0;
  *(uint8_t*)0x20004091 = 0;
  *(uint8_t*)0x20004092 = 0;
  *(uint8_t*)0x20004093 = 0;
  *(uint8_t*)0x20004094 = 0;
  *(uint8_t*)0x20004095 = 0;
  *(uint8_t*)0x20004096 = 0;
  *(uint8_t*)0x20004097 = 0;
  *(uint8_t*)0x20004098 = 0;
  *(uint8_t*)0x20004099 = 0;
  *(uint8_t*)0x2000409a = 0;
  *(uint8_t*)0x2000409b = 0;
  *(uint8_t*)0x2000409c = 0;
  *(uint8_t*)0x2000409d = 0;
  *(uint8_t*)0x2000409e = 0;
  *(uint8_t*)0x2000409f = 0;
  *(uint8_t*)0x200040a0 = 0;
  *(uint8_t*)0x200040a1 = 0;
  *(uint8_t*)0x200040a2 = 0;
  *(uint8_t*)0x200040a3 = 0;
  *(uint8_t*)0x200040a4 = 0;
  *(uint8_t*)0x200040a5 = 0;
  *(uint8_t*)0x200040a6 = 0;
  *(uint8_t*)0x200040a7 = 0;
  *(uint8_t*)0x200040a8 = 0;
  *(uint8_t*)0x200040a9 = 0;
  *(uint8_t*)0x200040aa = 0;
  *(uint8_t*)0x200040ab = 0;
  *(uint8_t*)0x200040ac = 0;
  *(uint8_t*)0x200040ad = 0;
  *(uint8_t*)0x200040ae = 0;
  *(uint8_t*)0x200040af = 0;
  *(uint8_t*)0x200040b0 = 0;
  *(uint8_t*)0x200040b1 = 0;
  *(uint8_t*)0x200040b2 = 0;
  *(uint8_t*)0x200040b3 = 0;
  *(uint32_t*)0x200040b4 = 0;
  *(uint16_t*)0x200040b8 = 0x70;
  *(uint16_t*)0x200040ba = 0x98;
  *(uint32_t*)0x200040bc = 0;
  *(uint64_t*)0x200040c0 = 0;
  *(uint64_t*)0x200040c8 = 0;
  *(uint16_t*)0x200040d0 = 0x28;
  memcpy((void*)0x200040d2, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x200040ef = 0;
  *(uint32_t*)0x200040f0 = 0xfffffffe;
  *(uint8_t*)0x200040f8 = 0xac;
  *(uint8_t*)0x200040f9 = 0x14;
  *(uint8_t*)0x200040fa = 0;
  *(uint8_t*)0x200040fb = 0xbb;
  *(uint8_t*)0x200040fc = 0xac;
  *(uint8_t*)0x200040fd = 0x14;
  *(uint8_t*)0x200040fe = 0;
  *(uint8_t*)0x200040ff = 0xaa;
  *(uint32_t*)0x20004100 = htobe32(0);
  *(uint32_t*)0x20004104 = htobe32(0);
  memcpy((void*)0x20004108,
         "\x24\xfe\x55\xd8\xac\x70\x75\xe0\x23\xe0\x82\x4d\x7a\xd3\x9d\x7e",
         16);
  memcpy((void*)0x20004118,
         "\x6e\x72\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         16);
  *(uint8_t*)0x20004128 = 0;
  *(uint8_t*)0x20004129 = 0;
  *(uint8_t*)0x2000412a = 0;
  *(uint8_t*)0x2000412b = 0;
  *(uint8_t*)0x2000412c = 0;
  *(uint8_t*)0x2000412d = 0;
  *(uint8_t*)0x2000412e = 0;
  *(uint8_t*)0x2000412f = 0;
  *(uint8_t*)0x20004130 = 0;
  *(uint8_t*)0x20004131 = 0;
  *(uint8_t*)0x20004132 = 0;
  *(uint8_t*)0x20004133 = 0;
  *(uint8_t*)0x20004134 = 0;
  *(uint8_t*)0x20004135 = 0;
  *(uint8_t*)0x20004136 = 0;
  *(uint8_t*)0x20004137 = 0;
  *(uint8_t*)0x20004138 = 0;
  *(uint8_t*)0x20004139 = 0;
  *(uint8_t*)0x2000413a = 0;
  *(uint8_t*)0x2000413b = 0;
  *(uint8_t*)0x2000413c = 0;
  *(uint8_t*)0x2000413d = 0;
  *(uint8_t*)0x2000413e = 0;
  *(uint8_t*)0x2000413f = 0;
  *(uint8_t*)0x20004140 = 0;
  *(uint8_t*)0x20004141 = 0;
  *(uint8_t*)0x20004142 = 0;
  *(uint8_t*)0x20004143 = 0;
  *(uint8_t*)0x20004144 = 0;
  *(uint8_t*)0x20004145 = 0;
  *(uint8_t*)0x20004146 = 0;
  *(uint8_t*)0x20004147 = 0;
  *(uint16_t*)0x20004148 = 0;
  *(uint8_t*)0x2000414a = 0;
  *(uint8_t*)0x2000414b = 0;
  *(uint32_t*)0x2000414c = 0;
  *(uint16_t*)0x20004150 = 0x70;
  *(uint16_t*)0x20004152 = 0xb8;
  *(uint32_t*)0x20004154 = 0;
  *(uint64_t*)0x20004158 = 0;
  *(uint64_t*)0x20004160 = 0;
  *(uint16_t*)0x20004168 = 0x48;
  memcpy((void*)0x2000416a, "\x54\x45\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x20004187 = 1;
  *(uint64_t*)0x20004188 = htobe64(0);
  *(uint64_t*)0x20004190 = htobe64(1);
  *(uint8_t*)0x20004198 = 0x73;
  *(uint8_t*)0x20004199 = 0x79;
  *(uint8_t*)0x2000419a = 0x7a;
  *(uint8_t*)0x2000419b = 0;
  *(uint8_t*)0x2000419c = 0;
  *(uint64_t*)0x200041a8 = 0;
  *(uint32_t*)0x200041b0 = htobe32(0);
  *(uint32_t*)0x200041b4 = htobe32(0);
  *(uint32_t*)0x200041b8 = htobe32(0);
  *(uint32_t*)0x200041bc = htobe32(0);
  memcpy((void*)0x200041c0,
         "\x62\x70\x71\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         16);
  memcpy((void*)0x200041d0,
         "\x69\x72\x6c\x61\x6e\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         16);
  *(uint8_t*)0x200041e0 = 0;
  *(uint8_t*)0x200041e1 = 0;
  *(uint8_t*)0x200041e2 = 0;
  *(uint8_t*)0x200041e3 = 0;
  *(uint8_t*)0x200041e4 = 0;
  *(uint8_t*)0x200041e5 = 0;
  *(uint8_t*)0x200041e6 = 0;
  *(uint8_t*)0x200041e7 = 0;
  *(uint8_t*)0x200041e8 = 0;
  *(uint8_t*)0x200041e9 = 0;
  *(uint8_t*)0x200041ea = 0;
  *(uint8_t*)0x200041eb = 0;
  *(uint8_t*)0x200041ec = 0;
  *(uint8_t*)0x200041ed = 0;
  *(uint8_t*)0x200041ee = 0;
  *(uint8_t*)0x200041ef = 0;
  *(uint8_t*)0x200041f0 = 0;
  *(uint8_t*)0x200041f1 = 0;
  *(uint8_t*)0x200041f2 = 0;
  *(uint8_t*)0x200041f3 = 0;
  *(uint8_t*)0x200041f4 = 0;
  *(uint8_t*)0x200041f5 = 0;
  *(uint8_t*)0x200041f6 = 0;
  *(uint8_t*)0x200041f7 = 0;
  *(uint8_t*)0x200041f8 = 0;
  *(uint8_t*)0x200041f9 = 0;
  *(uint8_t*)0x200041fa = 0;
  *(uint8_t*)0x200041fb = 0;
  *(uint8_t*)0x200041fc = 0;
  *(uint8_t*)0x200041fd = 0;
  *(uint8_t*)0x200041fe = 0;
  *(uint8_t*)0x200041ff = 0;
  *(uint16_t*)0x20004200 = 0;
  *(uint8_t*)0x20004202 = 0;
  *(uint8_t*)0x20004203 = 0;
  *(uint32_t*)0x20004204 = 0;
  *(uint16_t*)0x20004208 = 0x70;
  *(uint16_t*)0x2000420a = 0x98;
  *(uint32_t*)0x2000420c = 0;
  *(uint64_t*)0x20004210 = 0;
  *(uint64_t*)0x20004218 = 0;
  *(uint16_t*)0x20004220 = 0x28;
  memcpy((void*)0x20004222, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x2000423f = 0;
  *(uint32_t*)0x20004240 = 0;
  *(uint32_t*)0x20004248 = htobe32(-1);
  *(uint8_t*)0x2000424c = 0xac;
  *(uint8_t*)0x2000424d = 0x14;
  *(uint8_t*)0x2000424e = 0;
  *(uint8_t*)0x2000424f = 0xbb;
  *(uint32_t*)0x20004250 = htobe32(0);
  *(uint32_t*)0x20004254 = htobe32(0);
  *(uint8_t*)0x20004258 = 0x73;
  *(uint8_t*)0x20004259 = 0x79;
  *(uint8_t*)0x2000425a = 0x7a;
  *(uint8_t*)0x2000425b = 0;
  *(uint8_t*)0x2000425c = 0;
  *(uint8_t*)0x20004268 = 0x73;
  *(uint8_t*)0x20004269 = 0x79;
  *(uint8_t*)0x2000426a = 0x7a;
  *(uint8_t*)0x2000426b = 0;
  *(uint8_t*)0x2000426c = 0;
  *(uint8_t*)0x20004278 = 0;
  *(uint8_t*)0x20004279 = 0;
  *(uint8_t*)0x2000427a = 0;
  *(uint8_t*)0x2000427b = 0;
  *(uint8_t*)0x2000427c = 0;
  *(uint8_t*)0x2000427d = 0;
  *(uint8_t*)0x2000427e = 0;
  *(uint8_t*)0x2000427f = 0;
  *(uint8_t*)0x20004280 = 0;
  *(uint8_t*)0x20004281 = 0;
  *(uint8_t*)0x20004282 = 0;
  *(uint8_t*)0x20004283 = 0;
  *(uint8_t*)0x20004284 = 0;
  *(uint8_t*)0x20004285 = 0;
  *(uint8_t*)0x20004286 = 0;
  *(uint8_t*)0x20004287 = 0;
  *(uint8_t*)0x20004288 = 0;
  *(uint8_t*)0x20004289 = 0;
  *(uint8_t*)0x2000428a = 0;
  *(uint8_t*)0x2000428b = 0;
  *(uint8_t*)0x2000428c = 0;
  *(uint8_t*)0x2000428d = 0;
  *(uint8_t*)0x2000428e = 0;
  *(uint8_t*)0x2000428f = 0;
  *(uint8_t*)0x20004290 = 0;
  *(uint8_t*)0x20004291 = 0;
  *(uint8_t*)0x20004292 = 0;
  *(uint8_t*)0x20004293 = 0;
  *(uint8_t*)0x20004294 = 0;
  *(uint8_t*)0x20004295 = 0;
  *(uint8_t*)0x20004296 = 0;
  *(uint8_t*)0x20004297 = 0;
  *(uint16_t*)0x20004298 = 0;
  *(uint8_t*)0x2000429a = 0;
  *(uint8_t*)0x2000429b = 0;
  *(uint32_t*)0x2000429c = 0;
  *(uint16_t*)0x200042a0 = 0x70;
  *(uint16_t*)0x200042a2 = 0xb0;
  *(uint32_t*)0x200042a4 = 0;
  *(uint64_t*)0x200042a8 = 0;
  *(uint64_t*)0x200042b0 = 0;
  *(uint16_t*)0x200042b8 = 0x40;
  memcpy((void*)0x200042ba, "\x45\x52\x52\x4f\x52\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                            "\x00\x00\x00\x00\x00",
         29);
  *(uint8_t*)0x200042d7 = 0;
  memcpy((void*)0x200042d8, "\x64\x2e\x7b\xaf\x24\x1b\x9d\x10\xd6\xf6\xa3\xe4"
                            "\xbe\xb5\x29\x42\xa8\xf8\xcf\xc4\x0b\x26\xe1\xc8"
                            "\x8c\x67\x92\x8b\x73\x3a",
         30);
  *(uint64_t*)0x20001000 = 0;
  *(uint64_t*)0x20001008 = 0;
  *(uint64_t*)0x20001010 = 0;
  *(uint64_t*)0x20001018 = 0;
  *(uint64_t*)0x20001020 = 0;
  *(uint64_t*)0x20001028 = 0;
  *(uint64_t*)0x20001030 = 0;
  *(uint64_t*)0x20001038 = 0;
  syscall(__NR_setsockopt, r[1], 0, 0x40, 0x20004000, 0x2f8);
}

int main()
{
  setup_tun(0, true);
  loop();
  return 0;
}