// https://syzkaller.appspot.com/bug?id=a7c9e01fab4f69bab0433f2a8aca2217e33139c2
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  socket$inet_udp arguments: [
  //    domain: const = 0x2 (8 bytes)
  //    type: const = 0x2 (8 bytes)
  //    proto: const = 0x0 (4 bytes)
  //  ]
  //  returns sock_udp
  res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0);
  if (res != -1)
    r[0] = res;
  //  bind$inet arguments: [
  //    fd: sock_in (resource)
  //    addr: ptr[in, sockaddr_in] {
  //      sockaddr_in {
  //        family: const = 0x2 (2 bytes)
  //        port: int16be = 0x4321 (2 bytes)
  //        addr: union ipv4_addr {
  //          loopback: const = 0x7f000001 (4 bytes)
  //        }
  //        pad = 0x0 (8 bytes)
  //      }
  //    }
  //    addrlen: len = 0x10 (8 bytes)
  //  ]
  *(uint16_t*)0x200000000000 = 2;
  *(uint16_t*)0x200000000002 = htobe16(0x4321);
  *(uint32_t*)0x200000000004 = htobe32(0x7f000001);
  syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x200000000000ul,
          /*addrlen=*/0x10ul);
  //  socket$rxrpc arguments: [
  //    fam: const = 0x21 (8 bytes)
  //    type: const = 0x2 (8 bytes)
  //    proto: rxrpc_protos = 0x2 (4 bytes)
  //  ]
  //  returns sock_rxrpc
  res = syscall(__NR_socket, /*fam=*/0x21ul, /*type=*/2ul, /*proto=AF_INET*/ 2);
  if (res != -1)
    r[1] = res;
  //  bind$rxrpc arguments: [
  //    fd: sock_rxrpc (resource)
  //    addr: ptr[in, sockaddr_rxrpc] {
  //      union sockaddr_rxrpc {
  //        in4: sockaddr_rxrpc_t[sockaddr_in] {
  //          srx_family: const = 0x21 (2 bytes)
  //          srx_service: int16 = 0x0 (2 bytes)
  //          transport_type: const = 0x2 (2 bytes)
  //          transport_len: bytesize = 0x10 (2 bytes)
  //          transport: sockaddr_in {
  //            family: const = 0x2 (2 bytes)
  //            port: int16be = 0x1234 (2 bytes)
  //            addr: union ipv4_addr {
  //              loopback: const = 0x7f000001 (4 bytes)
  //            }
  //            pad = 0x0 (8 bytes)
  //          }
  //        }
  //      }
  //    }
  //    addrlen: len = 0x24 (8 bytes)
  //  ]
  *(uint16_t*)0x200000000040 = 0x21;
  *(uint16_t*)0x200000000042 = 0;
  *(uint16_t*)0x200000000044 = 2;
  *(uint16_t*)0x200000000046 = 0x10;
  *(uint16_t*)0x200000000048 = 2;
  *(uint16_t*)0x20000000004a = htobe16(0x1234);
  *(uint32_t*)0x20000000004c = htobe32(0x7f000001);
  syscall(__NR_bind, /*fd=*/r[1], /*addr=*/0x200000000040ul,
          /*addrlen=*/0x24ul);
  //  connect$rxrpc arguments: [
  //    fd: sock_rxrpc (resource)
  //    addr: ptr[in, sockaddr_rxrpc] {
  //      union sockaddr_rxrpc {
  //        in4: sockaddr_rxrpc_t[sockaddr_in] {
  //          srx_family: const = 0x21 (2 bytes)
  //          srx_service: int16 = 0x1 (2 bytes)
  //          transport_type: const = 0x2 (2 bytes)
  //          transport_len: bytesize = 0x10 (2 bytes)
  //          transport: sockaddr_in {
  //            family: const = 0x2 (2 bytes)
  //            port: int16be = 0x4321 (2 bytes)
  //            addr: union ipv4_addr {
  //              loopback: const = 0x7f000001 (4 bytes)
  //            }
  //            pad = 0x0 (8 bytes)
  //          }
  //        }
  //      }
  //    }
  //    addrlen: len = 0x24 (8 bytes)
  //  ]
  *(uint16_t*)0x200000000080 = 0x21;
  *(uint16_t*)0x200000000082 = 1;
  *(uint16_t*)0x200000000084 = 2;
  *(uint16_t*)0x200000000086 = 0x10;
  *(uint16_t*)0x200000000088 = 2;
  *(uint16_t*)0x20000000008a = htobe16(0x4321);
  *(uint32_t*)0x20000000008c = htobe32(0x7f000001);
  syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x200000000080ul,
          /*addrlen=*/0x24ul);
  //  sendmsg arguments: [
  //    fd: sock (resource)
  //    msg: ptr[in, send_msghdr] {
  //      send_msghdr {
  //        msg_name: nil
  //        msg_namelen: len = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //        msg_iov: nil
  //        msg_iovlen: len = 0x0 (8 bytes)
  //        msg_control: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {18 00 00 00 00 00 00 00 10 01 00 00 01 00 00
  //              00 01 00 00 00 00 00 00 00} (length 0x18)
  //            }
  //          }
  //        }
  //        msg_controllen: bytesize = 0x18 (8 bytes)
  //        msg_flags: const = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //      }
  //    }
  //    f: send_flags = 0x0 (8 bytes)
  //  ]
  *(uint64_t*)0x200000000100 = 0;
  *(uint32_t*)0x200000000108 = 0;
  *(uint64_t*)0x200000000110 = 0;
  *(uint64_t*)0x200000000118 = 0;
  *(uint64_t*)0x200000000120 = 0x200000000280;
  memcpy((void*)0x200000000280,
         "\x18\x00\x00\x00\x00\x00\x00\x00\x10\x01\x00\x00\x01\x00\x00\x00\x01"
         "\x00\x00\x00\x00\x00\x00\x00",
         24);
  *(uint64_t*)0x200000000128 = 0x18;
  *(uint32_t*)0x200000000130 = 0;
  syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000100ul, /*f=*/0ul);
  //  recvfrom arguments: [
  //    fd: sock (resource)
  //    buf: ptr[out, buffer] {
  //      buffer: (DirOut)
  //    }
  //    len: len = 0x100 (8 bytes)
  //    f: recv_flags = 0x0 (8 bytes)
  //    addr: nil
  //    addrlen: len = 0x0 (8 bytes)
  //  ]
  syscall(__NR_recvfrom, /*fd=*/r[0], /*buf=*/0x200000000300ul, /*len=*/0x100ul,
          /*f=*/0ul, /*addr=*/0ul, /*addrlen=*/0ul);
  //  pipe2 arguments: [
  //    pipefd: ptr[out, pipefd] {
  //      pipefd {
  //        rfd: fd (resource)
  //        wfd: fd (resource)
  //      }
  //    }
  //    flags: pipe_flags = 0x0 (8 bytes)
  //  ]
  res = syscall(__NR_pipe2, /*pipefd=*/0x200000000400ul, /*flags=*/0ul);
  if (res != -1) {
    r[2] = *(uint32_t*)0x200000000400;
    r[3] = *(uint32_t*)0x200000000404;
  }
  //  write arguments: [
  //    fd: fd (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {00 00 00 00 00 00 00 00 00 00 00 02 06 00 00 00 00 00 00 01
  //      83 e0 eb eb 91 b1 ac 93 bd cb 6f 03 60 ed 0c d8 cb e8 2c 5e 29 2e c4
  //      74 d4 43 25 fd f3 f5 03 e5 8f 68 e5 55 c9 8e a2 bf bc 4f 93 b7 70 eb
  //      c0 62 98 62 25 e4 2d 6d 8c ef 4f a6 3c 4a bf 58 b5 6b a9 0e 79 f9 b7
  //      f9 53 21 2c a9 4e 64 7e 1c 1b d5 d1 6f 05 1b ad e8 c4 29 1b 45 42 42
  //      14 25 91 ae 3a 0d a9 56 2e 84 52 41 f6 a1 2a 72 93 2a 13 78 c8 e4 68
  //      db a5 b1 d7 16 2c 75 f5 75 62 95 93 3b 7a c8 b6 d3 6b 15 0e 0f 64 9b}
  //      (length 0x9e)
  //    }
  //    count: len = 0x9e (8 bytes)
  //  ]
  memcpy(
      (void*)0x200000000140,
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x06\x00\x00\x00\x00\x00"
      "\x00\x01\x83\xe0\xeb\xeb\x91\xb1\xac\x93\xbd\xcb\x6f\x03\x60\xed\x0c\xd8"
      "\xcb\xe8\x2c\x5e\x29\x2e\xc4\x74\xd4\x43\x25\xfd\xf3\xf5\x03\xe5\x8f\x68"
      "\xe5\x55\xc9\x8e\xa2\xbf\xbc\x4f\x93\xb7\x70\xeb\xc0\x62\x98\x62\x25\xe4"
      "\x2d\x6d\x8c\xef\x4f\xa6\x3c\x4a\xbf\x58\xb5\x6b\xa9\x0e\x79\xf9\xb7\xf9"
      "\x53\x21\x2c\xa9\x4e\x64\x7e\x1c\x1b\xd5\xd1\x6f\x05\x1b\xad\xe8\xc4\x29"
      "\x1b\x45\x42\x42\x14\x25\x91\xae\x3a\x0d\xa9\x56\x2e\x84\x52\x41\xf6\xa1"
      "\x2a\x72\x93\x2a\x13\x78\xc8\xe4\x68\xdb\xa5\xb1\xd7\x16\x2c\x75\xf5\x75"
      "\x62\x95\x93\x3b\x7a\xc8\xb6\xd3\x6b\x15\x0e\x0f\x64\x9b",
      158);
  syscall(__NR_write, /*fd=*/r[3], /*buf=*/0x200000000140ul, /*count=*/0x9eul);
  //  read arguments: [
  //    fd: fd (resource)
  //    buf: ptr[out, buffer] {
  //      buffer: (DirOut)
  //    }
  //    count: len = 0x14 (8 bytes)
  //  ]
  syscall(__NR_read, /*fd=*/r[2], /*buf=*/0x200000000308ul, /*count=*/0x14ul);
  //  sendto$inet arguments: [
  //    fd: sock_in (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {} (length 0x0)
  //    }
  //    len: len = 0x1c (8 bytes)
  //    f: send_flags = 0x0 (8 bytes)
  //    addr: ptr[in, sockaddr_in] {
  //      sockaddr_in {
  //        family: const = 0x2 (2 bytes)
  //        port: int16be = 0x1234 (2 bytes)
  //        addr: union ipv4_addr {
  //          loopback: const = 0x7f000001 (4 bytes)
  //        }
  //        pad = 0x0 (8 bytes)
  //      }
  //    }
  //    addrlen: len = 0x10 (8 bytes)
  //  ]
  *(uint16_t*)0x2000000000c0 = 2;
  *(uint16_t*)0x2000000000c2 = htobe16(0x1234);
  *(uint32_t*)0x2000000000c4 = htobe32(0x7f000001);
  syscall(__NR_sendto, /*fd=*/r[0], /*buf=*/0x200000000300ul, /*len=*/0x1cul,
          /*f=*/0ul, /*addr=*/0x2000000000c0ul, /*addrlen=*/0x10ul);
  //  recvmsg arguments: [
  //    fd: sock (resource)
  //    msg: ptr[inout, recv_msghdr] {
  //      recv_msghdr {
  //        msg_name: nil
  //        msg_namelen: len = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //        msg_iov: nil
  //        msg_iovlen: len = 0x0 (8 bytes)
  //        msg_control: nil
  //        msg_controllen: bytesize = 0x0 (8 bytes)
  //        msg_flags: const = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //      }
  //    }
  //    f: recv_flags = 0x0 (8 bytes)
  //  ]
  *(uint64_t*)0x200000000600 = 0;
  *(uint32_t*)0x200000000608 = 0;
  *(uint64_t*)0x200000000610 = 0;
  *(uint64_t*)0x200000000618 = 0;
  *(uint64_t*)0x200000000620 = 0;
  *(uint64_t*)0x200000000628 = 0;
  *(uint32_t*)0x200000000630 = 0;
  syscall(__NR_recvmsg, /*fd=*/r[1], /*msg=*/0x200000000600ul, /*f=*/0ul, 0);
  //  sendmsg arguments: [
  //    fd: sock (resource)
  //    msg: ptr[in, send_msghdr] {
  //      send_msghdr {
  //        msg_name: nil
  //        msg_namelen: len = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //        msg_iov: nil
  //        msg_iovlen: len = 0x0 (8 bytes)
  //        msg_control: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {18 00 00 00 00 00 00 00 10 01 00 00 01 00 00
  //              00 01 00 00 00 00 00 00 00} (length 0x18)
  //            }
  //          }
  //        }
  //        msg_controllen: bytesize = 0x18 (8 bytes)
  //        msg_flags: const = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //      }
  //    }
  //    f: send_flags = 0x0 (8 bytes)
  //  ]
  *(uint64_t*)0x200000000100 = 0;
  *(uint32_t*)0x200000000108 = 0;
  *(uint64_t*)0x200000000110 = 0;
  *(uint64_t*)0x200000000118 = 0;
  *(uint64_t*)0x200000000120 = 0x200000000280;
  memcpy((void*)0x200000000280,
         "\x18\x00\x00\x00\x00\x00\x00\x00\x10\x01\x00\x00\x01\x00\x00\x00\x01"
         "\x00\x00\x00\x00\x00\x00\x00",
         24);
  *(uint64_t*)0x200000000128 = 0x18;
  *(uint32_t*)0x200000000130 = 0;
  syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000100ul, /*f=*/0ul);
  return 0;
}