// https://syzkaller.appspot.com/bug?id=416d4bba05317b98e3dfe795bb7eb89873464bf7
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_ioctl
#define __NR_ioctl 29
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_openat
#define __NR_openat 56
#endif
#ifndef __NR_socket
#define __NR_socket 198
#endif
#ifndef __NR_write
#define __NR_write 64
#endif

#define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len)               \
  *(type*)(addr) =                                                             \
      htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) |           \
            (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  intptr_t res = 0;
  memcpy((void*)0x20000000, "/dev/net/tun\000", 13);
  res =
      syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000000ul, 0x40241ul, 0ul);
  if (res != -1)
    r[0] = res;
  memcpy((void*)0x20000200, "syzkaller1\000\000\000\000\000\000", 16);
  *(uint16_t*)0x20000210 = 0xc201;
  syscall(__NR_ioctl, r[0], 0x400454ca, 0x20000200ul);
  syscall(__NR_ioctl, r[0], 0x400454cd, 0x118ul);
  res = syscall(__NR_socket, 2ul, 0xaul, 2);
  if (res != -1)
    r[1] = res;
  memcpy((void*)0x20000180, "syzkaller1\000\000\000\000\000\000", 16);
  *(uint8_t*)0x20000190 = 1;
  *(uint8_t*)0x20000191 = 0x80;
  *(uint8_t*)0x20000192 = 0xc2;
  *(uint8_t*)0x20000193 = 0;
  *(uint8_t*)0x20000194 = 0;
  *(uint8_t*)0x20000195 = 0;
  syscall(__NR_ioctl, r[1], 0x8914, 0x20000180ul);
  *(uint16_t*)0x20000040 = 0;
  *(uint16_t*)0x20000042 = htobe16(0xd);
  *(uint8_t*)0x20000044 = 0;
  *(uint8_t*)0x20000045 = 0;
  *(uint16_t*)0x20000046 = 0;
  *(uint16_t*)0x20000048 = 0;
  *(uint16_t*)0x2000004a = 0;
  *(uint16_t*)0x2000004c = 0;
  STORE_BY_BITMASK(uint8_t, , 0x2000004e, 0, 0, 4);
  STORE_BY_BITMASK(uint8_t, , 0x2000004e, 6, 4, 4);
  memcpy((void*)0x2000004f, "\x00\x80\x00", 3);
  *(uint16_t*)0x20000052 = htobe16(0x20);
  *(uint8_t*)0x20000054 = 6;
  *(uint8_t*)0x20000055 = 0;
  *(uint8_t*)0x20000056 = -1;
  *(uint8_t*)0x20000057 = 2;
  memset((void*)0x20000058, 0, 13);
  *(uint8_t*)0x20000065 = 1;
  memset((void*)0x20000066, 0, 10);
  memset((void*)0x20000070, 255, 2);
  *(uint8_t*)0x20000072 = 0xac;
  *(uint8_t*)0x20000073 = 0x14;
  *(uint8_t*)0x20000074 = 0x14;
  *(uint8_t*)0x20000075 = 0xbb;
  *(uint8_t*)0x20000076 = 0x62;
  *(uint8_t*)0x20000077 = 0;
  memset((void*)0x20000078, 0, 6);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 0x18, 0, 17);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 0, 17, 1);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 0, 18, 1);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 0, 19, 1);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 0, 20, 1);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 6, 21, 4);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 0, 25, 4);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x2000007e, 2, 29, 3);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000082, 0, 0, 16);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000082, 0, 16, 3);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000082, 0, 19, 2);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000082, 0, 21, 4);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000082, 0, 25, 4);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000082, 0, 29, 3);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000086, 0, 0, 16);
  STORE_BY_BITMASK(uint32_t, htobe32, 0x20000086, 0, 16, 16);
  *(uint32_t*)0x2000008a = htobe32(0);
  *(uint32_t*)0x2000008e = htobe32(0);
  *(uint32_t*)0x20000092 = htobe32(0);
  syscall(__NR_write, r[0], 0x20000040ul, 0x56ul);
  return 0;
}