// https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

static unsigned long long procid;

static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
      (addr < prog_start || addr > prog_end)) {
    _longjmp(segv_env, 1);
  }
  exit(sig);
}

static void install_segv_handler(void)
{
  struct sigaction sa;
  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = SIG_IGN;
  syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                        \
  {                                                                            \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    if (_setjmp(segv_env) == 0) {                                              \
      __VA_ARGS__;                                                             \
    }                                                                          \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
  }

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
  struct usb_endpoint_descriptor desc;
  int handle;
};

struct usb_iface_index {
  struct usb_interface_descriptor* iface;
  uint8_t bInterfaceNumber;
  uint8_t bAlternateSetting;
  uint8_t bInterfaceClass;
  struct usb_endpoint_index eps[USB_MAX_EP_NUM];
  int eps_num;
};

struct usb_device_index {
  struct usb_device_descriptor* dev;
  struct usb_config_descriptor* config;
  uint8_t bDeviceClass;
  uint8_t bMaxPower;
  int config_length;
  struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
  int ifaces_num;
  int iface_cur;
};

struct usb_info {
  int fd;
  struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length,
                                 struct usb_device_index* index)
{
  if (length < sizeof(*index->dev) + sizeof(*index->config))
    return false;
  memset(index, 0, sizeof(*index));
  index->dev = (struct usb_device_descriptor*)buffer;
  index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
  index->bDeviceClass = index->dev->bDeviceClass;
  index->bMaxPower = index->config->bMaxPower;
  index->config_length = length - sizeof(*index->dev);
  index->iface_cur = -1;
  size_t offset = 0;
  while (true) {
    if (offset + 1 >= length)
      break;
    uint8_t desc_length = buffer[offset];
    uint8_t desc_type = buffer[offset + 1];
    if (desc_length <= 2)
      break;
    if (offset + desc_length > length)
      break;
    if (desc_type == USB_DT_INTERFACE &&
        index->ifaces_num < USB_MAX_IFACE_NUM) {
      struct usb_interface_descriptor* iface =
          (struct usb_interface_descriptor*)(buffer + offset);
      index->ifaces[index->ifaces_num].iface = iface;
      index->ifaces[index->ifaces_num].bInterfaceNumber =
          iface->bInterfaceNumber;
      index->ifaces[index->ifaces_num].bAlternateSetting =
          iface->bAlternateSetting;
      index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
      index->ifaces_num++;
    }
    if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
      struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
      if (iface->eps_num < USB_MAX_EP_NUM) {
        memcpy(&iface->eps[iface->eps_num].desc, buffer + offset,
               sizeof(iface->eps[iface->eps_num].desc));
        iface->eps_num++;
      }
    }
    offset += desc_length;
  }
  return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev,
                                              size_t dev_len)
{
  int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
  if (i >= USB_MAX_FDS)
    return NULL;
  int rv = 0;
  NONFAILING(rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index));
  if (!rv)
    return NULL;
  __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
  return &usb_devices[i].index;
}

static struct usb_device_index* lookup_usb_index(int fd)
{
  int i;
  for (i = 0; i < USB_MAX_FDS; i++) {
    if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
      return &usb_devices[i].index;
    }
  }
  return NULL;
}

struct vusb_connect_string_descriptor {
  uint32_t len;
  char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
  uint32_t qual_len;
  char* qual;
  uint32_t bos_len;
  char* bos;
  uint32_t strs_len;
  struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0};

static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04};

static bool
lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
                           const struct usb_ctrlrequest* ctrl,
                           char** response_data, uint32_t* response_length)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  uint8_t str_idx;
  if (!index)
    return false;
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_GET_DESCRIPTOR:
      switch (ctrl->wValue >> 8) {
      case USB_DT_DEVICE:
        *response_data = (char*)index->dev;
        *response_length = sizeof(*index->dev);
        return true;
      case USB_DT_CONFIG:
        *response_data = (char*)index->config;
        *response_length = index->config_length;
        return true;
      case USB_DT_STRING:
        str_idx = (uint8_t)ctrl->wValue;
        if (descs && str_idx < descs->strs_len) {
          *response_data = descs->strs[str_idx].str;
          *response_length = descs->strs[str_idx].len;
          return true;
        }
        if (str_idx == 0) {
          *response_data = (char*)&default_lang_id[0];
          *response_length = default_lang_id[0];
          return true;
        }
        *response_data = (char*)&default_string[0];
        *response_length = default_string[0];
        return true;
      case USB_DT_BOS:
        *response_data = descs->bos;
        *response_length = descs->bos_len;
        return true;
      case USB_DT_DEVICE_QUALIFIER:
        if (!descs->qual) {
          struct usb_qualifier_descriptor* qual =
              (struct usb_qualifier_descriptor*)response_data;
          qual->bLength = sizeof(*qual);
          qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
          qual->bcdUSB = index->dev->bcdUSB;
          qual->bDeviceClass = index->dev->bDeviceClass;
          qual->bDeviceSubClass = index->dev->bDeviceSubClass;
          qual->bDeviceProtocol = index->dev->bDeviceProtocol;
          qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
          qual->bNumConfigurations = index->dev->bNumConfigurations;
          qual->bRESERVED = 0;
          *response_length = sizeof(*qual);
          return true;
        }
        *response_data = descs->qual;
        *response_length = descs->qual_len;
        return true;
      default:
        break;
      }
      break;
    default:
      break;
    }
    break;
  default:
    break;
  }
  return false;
}

typedef bool (*lookup_connect_out_response_t)(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done);

#define ATH9K_FIRMWARE_DOWNLOAD 0x30
#define ATH9K_FIRMWARE_DOWNLOAD_COMP 0x31

static bool lookup_connect_response_out_ath9k(
    int fd, const struct vusb_connect_descriptors* descs,
    const struct usb_ctrlrequest* ctrl, bool* done)
{
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_SET_CONFIGURATION:
      return true;
    default:
      break;
    }
    break;
  case USB_TYPE_VENDOR:
    switch (ctrl->bRequest) {
    case ATH9K_FIRMWARE_DOWNLOAD:
      return true;
    case ATH9K_FIRMWARE_DOWNLOAD_COMP:
      *done = true;
      return true;
    default:
      break;
    }
    break;
  }
  return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
  __u8 driver_name[UDC_NAME_LENGTH_MAX];
  __u8 device_name[UDC_NAME_LENGTH_MAX];
  __u8 speed;
};

enum usb_raw_event_type {
  USB_RAW_EVENT_INVALID = 0,
  USB_RAW_EVENT_CONNECT = 1,
  USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
  __u32 type;
  __u32 length;
  __u8 data[0];
};

struct usb_raw_ep_io {
  __u16 ep;
  __u16 flags;
  __u32 length;
  __u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
  __u32 type_control : 1;
  __u32 type_iso : 1;
  __u32 type_bulk : 1;
  __u32 type_int : 1;
  __u32 dir_in : 1;
  __u32 dir_out : 1;
};

struct usb_raw_ep_limits {
  __u16 maxpacket_limit;
  __u16 max_streams;
  __u32 reserved;
};

struct usb_raw_ep_info {
  __u8 name[USB_RAW_EP_NAME_MAX];
  __u32 addr;
  struct usb_raw_ep_caps caps;
  struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
  struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
  return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver,
                        const char* device)
{
  struct usb_raw_init arg;
  strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
  strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
  arg.speed = speed;
  return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
  return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
  return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_configure(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
  return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_stall(int fd)
{
  return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

static int lookup_endpoint(int fd, uint8_t bEndpointAddress)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  int ep;
  if (!index)
    return -1;
  if (index->iface_cur < 0)
    return -1;
  for (ep = 0; index->ifaces[index->iface_cur].eps_num; ep++)
    if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress ==
        bEndpointAddress)
      return index->ifaces[index->iface_cur].eps[ep].handle;
  return -1;
}

static void set_interface(int fd, int n)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  int ep;
  if (!index)
    return;
  if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
    for (ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
      int rv = usb_raw_ep_disable(
          fd, index->ifaces[index->iface_cur].eps[ep].handle);
      if (rv < 0) {
      } else {
      }
    }
  }
  if (n >= 0 && n < index->ifaces_num) {
    for (ep = 0; ep < index->ifaces[n].eps_num; ep++) {
      int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
      if (rv < 0) {
      } else {
        index->ifaces[n].eps[ep].handle = rv;
      }
    }
    index->iface_cur = n;
  }
}

static int configure_device(int fd)
{
  struct usb_device_index* index = lookup_usb_index(fd);
  if (!index)
    return -1;
  int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
  if (rv < 0) {
    return rv;
  }
  rv = usb_raw_configure(fd);
  if (rv < 0) {
    return rv;
  }
  set_interface(fd, 0);
  return 0;
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
  struct usb_raw_event inner;
  struct usb_ctrlrequest ctrl;
  char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
  struct usb_raw_ep_io inner;
  char data[USB_MAX_PACKET_SIZE];
};

static volatile long
syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
                     const struct vusb_connect_descriptors* descs,
                     lookup_connect_out_response_t lookup_connect_response_out)
{
  if (!dev) {
    return -1;
  }
  int fd = usb_raw_open();
  if (fd < 0) {
    return fd;
  }
  if (fd >= MAX_FDS) {
    close(fd);
    return -1;
  }
  struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
  if (!index) {
    return -1;
  }
  char device[32];
  sprintf(&device[0], "dummy_udc.%llu", procid);
  int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
  if (rv < 0) {
    return rv;
  }
  rv = usb_raw_run(fd);
  if (rv < 0) {
    return rv;
  }
  bool done = false;
  while (!done) {
    struct usb_raw_control_event event;
    event.inner.type = 0;
    event.inner.length = sizeof(event.ctrl);
    rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
    if (rv < 0) {
      return rv;
    }
    if (event.inner.type != USB_RAW_EVENT_CONTROL)
      continue;
    char* response_data = NULL;
    uint32_t response_length = 0;
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      bool response_found = false;
      NONFAILING(response_found = lookup_connect_response_in(
                     fd, descs, &event.ctrl, &response_data, &response_length));
      if (!response_found) {
        usb_raw_ep0_stall(fd);
        continue;
      }
    } else {
      if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
        usb_raw_ep0_stall(fd);
        continue;
      }
      response_data = NULL;
      response_length = event.ctrl.wLength;
    }
    if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
        event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
      rv = configure_device(fd);
      if (rv < 0) {
        return rv;
      }
    }
    struct usb_raw_ep_io_data response;
    response.inner.ep = 0;
    response.inner.flags = 0;
    if (response_length > sizeof(response.data))
      response_length = 0;
    if (event.ctrl.wLength < response_length)
      response_length = event.ctrl.wLength;
    response.inner.length = response_length;
    if (response_data)
      memcpy(&response.data[0], response_data, response_length);
    else
      memset(&response.data[0], 0, response_length);
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
    } else {
      rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
    }
    if (rv < 0) {
      return rv;
    }
  }
  sleep_ms(200);
  return fd;
}

static volatile long syz_usb_connect_ath9k(volatile long a0, volatile long a1,
                                           volatile long a2, volatile long a3)
{
  uint64_t speed = a0;
  uint64_t dev_len = a1;
  const char* dev = (const char*)a2;
  const struct vusb_connect_descriptors* descs =
      (const struct vusb_connect_descriptors*)a3;
  return syz_usb_connect_impl(speed, dev_len, dev, descs,
                              &lookup_connect_response_out_ath9k);
}

static volatile long syz_usb_ep_write(volatile long a0, volatile long a1,
                                      volatile long a2, volatile long a3)
{
  int fd = a0;
  uint8_t ep = a1;
  uint32_t len = a2;
  char* data = (char*)a3;
  int ep_handle = lookup_endpoint(fd, ep);
  if (ep_handle < 0) {
    return -1;
  }
  struct usb_raw_ep_io_data io_data;
  io_data.inner.ep = ep_handle;
  io_data.inner.flags = 0;
  if (len > sizeof(io_data.data))
    len = sizeof(io_data.data);
  io_data.inner.length = len;
  NONFAILING(memcpy(&io_data.data[0], data, len));
  int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data);
  if (rv < 0) {
    return rv;
  }
  sleep_ms(200);
  return 0;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  int i;
  for (i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  NONFAILING(*(uint8_t*)0x20000000 = 0x12);
  NONFAILING(*(uint8_t*)0x20000001 = 1);
  NONFAILING(*(uint16_t*)0x20000002 = 0x200);
  NONFAILING(*(uint8_t*)0x20000004 = -1);
  NONFAILING(*(uint8_t*)0x20000005 = -1);
  NONFAILING(*(uint8_t*)0x20000006 = -1);
  NONFAILING(*(uint8_t*)0x20000007 = 0x40);
  NONFAILING(*(uint16_t*)0x20000008 = 0xcf3);
  NONFAILING(*(uint16_t*)0x2000000a = 0x9271);
  NONFAILING(*(uint16_t*)0x2000000c = 0x108);
  NONFAILING(*(uint8_t*)0x2000000e = 1);
  NONFAILING(*(uint8_t*)0x2000000f = 2);
  NONFAILING(*(uint8_t*)0x20000010 = 3);
  NONFAILING(*(uint8_t*)0x20000011 = 1);
  NONFAILING(*(uint8_t*)0x20000012 = 9);
  NONFAILING(*(uint8_t*)0x20000013 = 2);
  NONFAILING(*(uint16_t*)0x20000014 = 0x48);
  NONFAILING(*(uint8_t*)0x20000016 = 1);
  NONFAILING(*(uint8_t*)0x20000017 = 1);
  NONFAILING(*(uint8_t*)0x20000018 = 0);
  NONFAILING(*(uint8_t*)0x20000019 = 0x80);
  NONFAILING(*(uint8_t*)0x2000001a = 0xfa);
  NONFAILING(*(uint8_t*)0x2000001b = 9);
  NONFAILING(*(uint8_t*)0x2000001c = 4);
  NONFAILING(*(uint8_t*)0x2000001d = 0);
  NONFAILING(*(uint8_t*)0x2000001e = 0);
  NONFAILING(*(uint8_t*)0x2000001f = 6);
  NONFAILING(*(uint8_t*)0x20000020 = -1);
  NONFAILING(*(uint8_t*)0x20000021 = 0);
  NONFAILING(*(uint8_t*)0x20000022 = 0);
  NONFAILING(*(uint8_t*)0x20000023 = 0);
  NONFAILING(*(uint8_t*)0x20000024 = 9);
  NONFAILING(*(uint8_t*)0x20000025 = 5);
  NONFAILING(*(uint8_t*)0x20000026 = 1);
  NONFAILING(*(uint8_t*)0x20000027 = 2);
  NONFAILING(*(uint16_t*)0x20000028 = 0x200);
  NONFAILING(*(uint8_t*)0x2000002a = 0);
  NONFAILING(*(uint8_t*)0x2000002b = 0);
  NONFAILING(*(uint8_t*)0x2000002c = 0);
  NONFAILING(*(uint8_t*)0x2000002d = 9);
  NONFAILING(*(uint8_t*)0x2000002e = 5);
  NONFAILING(*(uint8_t*)0x2000002f = 0x82);
  NONFAILING(*(uint8_t*)0x20000030 = 2);
  NONFAILING(*(uint16_t*)0x20000031 = 0x200);
  NONFAILING(*(uint8_t*)0x20000033 = 0);
  NONFAILING(*(uint8_t*)0x20000034 = 0);
  NONFAILING(*(uint8_t*)0x20000035 = 0);
  NONFAILING(*(uint8_t*)0x20000036 = 9);
  NONFAILING(*(uint8_t*)0x20000037 = 5);
  NONFAILING(*(uint8_t*)0x20000038 = 0x83);
  NONFAILING(*(uint8_t*)0x20000039 = 3);
  NONFAILING(*(uint16_t*)0x2000003a = 0x40);
  NONFAILING(*(uint8_t*)0x2000003c = 1);
  NONFAILING(*(uint8_t*)0x2000003d = 0);
  NONFAILING(*(uint8_t*)0x2000003e = 0);
  NONFAILING(*(uint8_t*)0x2000003f = 9);
  NONFAILING(*(uint8_t*)0x20000040 = 5);
  NONFAILING(*(uint8_t*)0x20000041 = 4);
  NONFAILING(*(uint8_t*)0x20000042 = 3);
  NONFAILING(*(uint16_t*)0x20000043 = 0x40);
  NONFAILING(*(uint8_t*)0x20000045 = 1);
  NONFAILING(*(uint8_t*)0x20000046 = 0);
  NONFAILING(*(uint8_t*)0x20000047 = 0);
  NONFAILING(*(uint8_t*)0x20000048 = 9);
  NONFAILING(*(uint8_t*)0x20000049 = 5);
  NONFAILING(*(uint8_t*)0x2000004a = 5);
  NONFAILING(*(uint8_t*)0x2000004b = 2);
  NONFAILING(*(uint16_t*)0x2000004c = 0x200);
  NONFAILING(*(uint8_t*)0x2000004e = 0);
  NONFAILING(*(uint8_t*)0x2000004f = 0);
  NONFAILING(*(uint8_t*)0x20000050 = 0);
  NONFAILING(*(uint8_t*)0x20000051 = 9);
  NONFAILING(*(uint8_t*)0x20000052 = 5);
  NONFAILING(*(uint8_t*)0x20000053 = 6);
  NONFAILING(*(uint8_t*)0x20000054 = 2);
  NONFAILING(*(uint16_t*)0x20000055 = 0x200);
  NONFAILING(*(uint8_t*)0x20000057 = 0);
  NONFAILING(*(uint8_t*)0x20000058 = 0);
  NONFAILING(*(uint8_t*)0x20000059 = 0);
  res = syz_usb_connect_ath9k(3, 0x5a, 0x20000000, 0);
  if (res != -1)
    r[0] = res;
  syz_usb_ep_write(r[0], 0x82, 0, 0);
  syz_usb_ep_write(r[0], 0x82, 0, 0);
  syz_usb_ep_write(r[0], 0x82, 0, 0);
  NONFAILING(*(uint16_t*)0x20001240 = 0x1000);
  NONFAILING(*(uint16_t*)0x20001242 = 0x4e00);
  NONFAILING(memcpy(
      (void*)0x20001244,
      "\x3c\x66\x3a\x96\xe3\x51\x13\xfd\xeb\x7d\x12\x43\xdf\xcd\x71\x86\xc5\xa4"
      "\xec\x85\xe2\x67\x8c\x3f\xb7\xa1\x5f\xd6\x25\x01\xd1\xa0\x16\x79\x93\xfe"
      "\xa4\x26\xd6\x89\x40\x09\xb5\x00\x52\xfc\x9a\x64\x2e\x0d\x88\x54\x8e\xe7"
      "\xd5\x8e\x6e\x36\x7d\x86\x17\xf0\x86\x91\x24\x85\x0c\xe6\x16\x4e\x3e\x31"
      "\x1b\xd0\xd2\x67\x06\x06\xc3\xc0\x6f\xe5\x85\x4a\xf1\x88\xea\x54\x96\x6e"
      "\x0c\x28\xd4\x34\x34\x39\x64\xa3\x11\x16\xa3\xee\x81\x1d\x6b\x91\x23\xd8"
      "\x5d\xff\x57\xdf\x7f\x87\x7b\x93\x74\x78\x3c\x75\xa8\x8b\x2d\x5b\x6a\x66"
      "\xe9\x69\x83\xe3\x91\x36\x91\xcf\xdf\xdf\xc0\x86\x7c\xf5\x1f\x35\x9f\x81"
      "\xd0\x09\x37\x13\x6e\xd0\x94\x55\x78\xb2\x6f\xc7\x78\xb8\x44\xfa\x12\x0a"
      "\x39\x7b\x4a\x52\x9b\xcf\x81\x09\x23\xb1\xd3\x53\xfb\xb0\x87\x78\xd0\x5f"
      "\x97\x18\x53\xe0\x54\x96\xcd\xb3\x99\xeb\x27\x14\x90\xe3\x8b\xd7\xd7\x61"
      "\x74\x61\x18\xf3\x9c\x05\x07\x60\xfd\x86\x6b\x25\xaf\xa9\x98\x0a\x8e\xa0"
      "\xd0\xb3\xf4\xcf\x55\xc6\x09\x9f\x9e\x2c\xf7\xe8\x31\xb5\x4d\x9f\xb1\x3e"
      "\x16\x0a\xb3\x0f\x52\x4f\x77\xcc\x15\x74\x1b\x52\xf2\xa4\x82\x90\xfb\x6d"
      "\x9a\xef\x78\xc6\x2f\x77\x78\xd8\x5f\x97\x4d\x3a\x26\xa7\x22\xd5\x9b\xb2"
      "\x1d\xde\xcd\x35\x7a\xec\x75\x2b\x9f\xab\xd7\x60\x4a\x35\xd5\xd0\x4a\xdd"
      "\xcd\x35\x0e\x34\xd2\xf9\xa5\x35\x47\x19\x58\x4c\x49\x79\x57\x73\x2d\xcd"
      "\x50\x0d\x75\x08\x54\xa0\xdb\x84\x3d\xde\x5c\xf4\xb6\xb5\x6f\x61\x99\xbc"
      "\xd1\x42\xca\xb0\x30\x53\x63\x76\xe0\x56\x2f\xfc\x8e\xb1\x16\x6f\x48\x9c"
      "\x05\x5e\x66\x08\x5e\xd2\xdb\xee\x39\x23\x60\x5c\x4c\xa3\x4e\xf5\x4d\xc4"
      "\x32\x1a\xf7\x8d\x67\xdf\x70\x4f\x05\xc2\xac\x71\x84\xe3\x92\x14\x6e\xbd"
      "\x5a\xad\xc3\xb9\x80\x7c\x58\xdd\x0d\x56\xa1\x59\xb1\x08\x9f\x5e\x31\xcb"
      "\x54\x9a\x54\x1a\xfd\xcf\xb4\xa1\x82\x8b\xc2\x66\xd1\x14\x15\xd4\xd2\x16"
      "\xbc\x9e\x74\xb2\x65\x25\x76\x16\x5f\x42\x37\x5b\x23\x62\x61\xc2\x42\xee"
      "\x7c\xf0\x04\xe8\x1e\x08\x6f\x94\x95\xf3\x78\x97\x38\x8c\x37\xe4\x8b\xd0"
      "\xad\xaa\x28\xf1\x02\x19\x6c\xb4\x02\x2c\x90\x4f\x63\x52\x1e\xea\x73\x73"
      "\x93\x29\x5e\xe7\xd9\xd3\x57\x19\x7d\x14\xfa\x0f\x35\x54\xe4\x09\x65\x84"
      "\xa4\x7a\xad\xd4\xf3\xee\x87\x52\xbf\x92\x1f\xc3\xda\xb3\xe5\xb7\x72\x21"
      "\x71\xa7\x21\x93\x40\x6f\x10\x20\x21\x28\x3f\x91\x61\x93\x99\x7d\xed\x8e"
      "\xf7\xa3\xac\xae\x09\xf3\x4d\xfb\x52\xcf\x61\x6b\x44\xbf\x4c\xcc\xfa\xf8"
      "\x73\x5b\x4c\x77\x54\xa3\x89\x64\x4b\xc2\xe2\x22\x24\xa0\x6f\x2d\x7d\xa6"
      "\x6d\x60\x33\x14\x85\x97\x3b\x77\x14\x8d\x3f\x43\x7c\xf3\x1f\x49\xda\xde"
      "\xd7\x78\x03\x42\x49\xd9\x84\x32\x2a\xff\x79\x51\xc6\x44\x57\x06\xdb\x4c"
      "\x66\x8f\xa3\x49\xc4\x35\x21\x5a\x7f\xc2\x36\xb3\xec\x6c\x62\xc8\x47\xfa"
      "\xc1\x5c\x99\xf0\xdb\x79\x4c\x3d\x9f\x4c\x74\xfe\xc8\x4d\xe1\x2f\x0a\xdb"
      "\x35\x05\x66\x92\xf1\x1c\x8e\x39\x80\x87\xc8\x98\xc0\x51\x98\x5b\x6c\xd2"
      "\x1e\x23\xbe\xac\xa9\x5d\x1d\xae\x8a\xe1\x32\x9b\x3e\x77\xe7\x1f\x3f\x1c"
      "\xe4\x49\xbc\xdb\x2c\x79\xa0\x09\xb5\xcb\xf0\xc0\xbc\xdd\x36\xa4\x7b\x1b"
      "\xdb\x96\xd7\x2c\x83\xfa\xfc\x57\xad\x61\x6a\xf6\xb1\x43\x83\xf8\x97\x95"
      "\xfc\xa6\x91\x8e\x06\xa7\xd7\xa0\x25\xda\x25\xb9\xcb\xd5\x97\x90\x6b\xb6"
      "\x6c\x07\x64\x21\x23\x65\x67\xaa\xa4\x99\x0f\x6c\x92\x79\xb8\xe7\x36\xb0"
      "\x21\x05\x42\x72\x09\x1e\x6d\x55\xc8\x76\x4e\x1c\x96\xca\x18\x6c\x67\x53"
      "\xda\xf9\xd9\x1c\x2d\x1c\x9c\x6b\xa6\xcb\x4d\xd2\x9d\x58\x3e\x25\x06\x80"
      "\x86\xf4\x2a\x94\x58\xf5\xe7\x3c\x1f\x97\x99\xf1\x87\xd6\xaa\xb4\x74\xed"
      "\x13\xbb\x41\x90\x8f\xd3\xc2\x9a\xd7\xd9\xd2\x29\x31\xd6\xcc\x5d\xb3\xe8"
      "\xd1\x02\x59\x70\xe1\xb7\x9d\x04\x4d\x22\x6e\xda\x62\xb3\xd6\x18\x6f\xc4"
      "\xf3\x87\x46\x0b\x8d\x2b\xfc\xb7\x4c\x88\x17\xc5\xcc\x55\x4d\x30\x02\x71"
      "\x99\x52\xaa\xed\xec\x1f\x94\x3b\x7d\x06\xc3\x25\x6c\x14\x41\x3e\x0b\x86"
      "\x7e\x54\x25\xc6\x27\xf1\x84\xea\xdd\x43\x30\x1a\x75\x53\x91\xba\xa1\xdd"
      "\xb5\xbc\x26\x60\x07\x71\x50\x26\xaf\x21\x0e\xea\x29\x42\x34\xd7\x82\xb4"
      "\x29\xb0\x10\x7c\x1f\xbe\xde\x3a\x96\xe6\xac\xae\x54\x19\xa6\x35\x59\xec"
      "\xfb\x48\x57\x5b\x01\x1b\xa1\x60\x13\x8c\x10\x23\x9d\x03\xde\x08\x27\x18"
      "\x73\xa2\x93\xc4\x9f\xeb\xd8\xba\x2a\xb7\x79\xfe\x68\xf5\x1f\x23\xe6\x95"
      "\x76\x56\x0a\x14\xb9\x38\x88\xd0\x9e\x4b\x4c\xfa\x26\x9d\x10\xa8\xd1\xea"
      "\xd8\x08\xe4\x01\x68\x3d\x00\x8b\x8b\x69\xb5\x93\x98\x80\x66\x8f\x8e\x18"
      "\x0d\xc4\x93\x79\x5d\x05\x7a\xd4\x6d\x07\x09\xd5\x65\x64\x07\xe6\x94\xb6"
      "\xb6\xeb\x52\xa3\x90\x04\xd9\xda\x33\x82\x29\x9b\x8d\x0b\xbb\x0b\x7c\x7e"
      "\x91\xdd\x69\x3a\x3c\x11\x77\x50\x7f\xfd\x2e\xe9\xba\xc9\xc2\xa2\x41\x5d"
      "\x2d\x76\x14\x1b\xe7\xa2\x2c\x91\x81\x1e\x20\xab\x67\x46\x9b\xb0\xc8\xac"
      "\xcd\xe0\xa2\x16\xe7\xd1\xdf\xf3\x26\xe1\x84\x4b\x4c\x65\x53\x8f\xbd\xa5"
      "\x31\x0a\x01\x4f\x17\x53\x80\x17\x0b\x82\x0d\xb2\xa6\x12\x54\x10\x87\xc9"
      "\x06\xf6\x17\xb3\x1a\x65\xcf\x68\xdf\xe1\x6e\xbf\xa9\x88\x6c\xee\xe8\x8e"
      "\x9f\x12\x92\xba\x7a\xe9\x7f\x4d\xb2\x2e\xb9\x6b\x94\xba\xc9\x18\xc2\x4b"
      "\x32\x58\x81\xd0\x23\x87\x31\x6c\xb1\xd0\xb7\xd8\x3b\xa4\x75\xc1\xcb\xe6"
      "\x5d\x2b\x41\x00\x7f\x08\x82\x2b\x11\xc0\x53\x2c\xc7\x7b\x4a\x5d\x56\xb9"
      "\x6e\xbe\x2b\x3d\x3e\x50\xc0\x9b\xb1\xfd\x84\x71\xc4\x84\x26\x57\x5b\xef"
      "\x0e\xdd\x1f\x26\x47\xd0\xad\xc8\x5f\xf8\x67\xee\xd9\x77\xb3\x41\x4d\xa2"
      "\x3d\x48\x73\xf2\x65\xca\x78\x8b\x58\x3b\x83\x71\xb1\x3a\x5a\x01\xe5\xfa"
      "\x9d\x32\xd3\x16\xa3\x7f\x13\x81\x85\x6a\x00\xa9\x27\x81\x00\x8c\x2f\x02"
      "\xc5\x60\x23\x58\x8f\xad\x9a\x29\x8e\x98\xe6\xf7\x3c\xd3\xb7\x56\x2d\x10"
      "\xed\xac\xc7\x97\xa5\xc6\x15\x9c\x7c\x62\xf3\xad\x24\xee\x1f\x21\x3f\x34"
      "\x5f\x35\xc0\x6c\xb7\x42\x64\x4d\xe2\x10\x7f\xae\x9e\x05\x31\x64\x37\x3f"
      "\x05\x79\xd5\x3f\x3e\xd4\x30\xed\x55\xfa\x49\x16\x93\x2a\x8f\x4b\x58\xc9"
      "\x4a\x18\xfd\x53\x50\x3a\xd5\xb3\x78\xc3\x22\xed\xd4\x8c\xb2\xcb\x68\xbe"
      "\x15\x2f\x57\x72\x79\xb1\x83\x7a\x4b\x98\xda\x5c\x92\xa6\x51\x8f\xd7\x5c"
      "\xae\x2b\xfa\xf9\x81\x50\x6b\xae\x1d\x99\x84\x72\xd5\xe8\xab\x80\x2f\x81"
      "\x2d\x24\x35\xad\xc2\x64\x85\xb7\xbd\x0d\x8d\xe6\x62\xf4\xb3\xd4\x1c\xc5"
      "\xe3\xd0\xcb\xbf\xaa\x2c\xab\x01\xc0\x29\x02\x26\x1c\xcc\x27\xd6\x4a\x59"
      "\xec\x84\xe5\x0a\x32\x54\xfa\x55\x5d\xfe\xca\x64\xb8\x89\xda\x94\x15\x56"
      "\x79\x69\xea\xaa\x4e\xb0\xdb\xe2\xbb\x59\x44\x81\x84\x47\xb4\x0e\x87\xd7"
      "\x89\x52\x71\xbb\x46\x42\x03\x0b\xa5\x0e\xcb\xb3\x6f\x1d\xc3\x6f\x71\x12"
      "\x77\xf0\x2b\x8c\xe4\xe2\x4c\xb4\xe4\xee\x06\x6b\x7f\xe5\x42\xfe\x3e\xda"
      "\x33\xd1\x8c\x1b\x8c\xa4\x0c\xdb\x1e\x09\x46\xf9\x18\x39\x2e\xd7\x9b\x61"
      "\x73\x36\x21\x4c\x54\xe1\x00\xcc\xc1\x47\x58\x08\x1e\x29\x59\x38\xfe\x1f"
      "\x4a\x0e\x3c\x5c\x47\xd0\x06\xe3\xc6\x41\x5f\xe8\x85\xe2\x40\x93\x2f\xb8"
      "\x71\xce\x70\x00\x39\xd8\xbb\x43\xc9\xf3\xa5\xa4\x7b\x66\x50\xb7\xb3\xbe"
      "\x0d\x18\xef\x89\xec\x39\x6a\x1f\x37\x83\x70\xc9\xa5\xf5\x05\xa8\x1a\xea"
      "\x9c\xc0\x0f\xa3\xc5\x21\x3a\x64\x71\x41\x96\x26\xe5\x21\x1e\x78\x2c\xf8"
      "\x89\x58\x54\xd5\x81\xb2\xe6\xe8\xba\x3b\x42\x07\xdc\x2f\xb1\x68\x05\x10"
      "\xd1\xe3\x93\x83\x37\x60\x47\xde\x16\x8b\x60\xdf\x4e\x91\x48\xe4\x49\xe2"
      "\x94\xb1\x37\xe1\xad\x24\x95\x0e\x5b\x26\xb9\x9a\x17\x16\x50\x3f\x22\xe7"
      "\x91\xa7\xd2\xac\x21\x64\x96\x7c\x2e\x48\x5a\xfe\x6b\xbb\x5c\x76\x10\x9a"
      "\x77\x49\x57\x64\xee\xeb\x6a\x12\x73\x47\xb2\x89\xd6\xd0\x07\xbe\xe3\x0f"
      "\xa8\x2a\x4c\x12\x66\x6a\x55\x7e\xba\x4d\xe5\x1b\xa3\xfb\x6e\xba\xd8\xf2"
      "\xe7\x95\x6e\x84\xeb\xf8\x5d\xf4\xc2\x2f\xf2\x43\x23\x4a\x78\x9c\xfb\xce"
      "\x73\x57\x3f\x68\x34\xe0\x7a\xf0\xca\x70\xf9\x8e\x9d\x6b\xc6\x01\xd8\x3d"
      "\x58\xf1\x60\x29\x1e\xe4\xf8\x78\x9d\x16\xcd\xa6\x39\x38\xc3\x01\xb5\x66"
      "\x85\x70\x47\xe4\xa2\x43\xf3\xc7\x48\x81\x9c\xe9\xf0\xa3\x25\x59\x3a\xae"
      "\xe0\x1e\x8d\x85\xf6\x74\x79\x1b\x5d\x4b\x2a\x18\x01\xc7\xc7\x4a\x67\x98"
      "\x88\xbe\xba\xfb\x0b\xc0\xcd\x0c\x54\x2d\x3b\x21\x30\x6e\xc6\xa5\x08\x88"
      "\x63\xdc\x81\xd1\xc6\xd8\xef\x12\x4f\x6e\x85\x17\x95\xe3\xec\xee\x59\xb6"
      "\x82\x2b\x4a\x65\x53\x72\xfb\x9e\x74\xc5\x21\x1d\x7e\x0d\xfb\x79\x0b\xa8"
      "\x27\x2d\x6c\x22\x2a\x0f\x4c\xec\xa3\x3a\xf0\xa1\x43\x5c\x86\x09\x79\xad"
      "\x25\xc7\x21\x18\xf0\x3b\xcd\xbd\x85\x9e\x3f\xe8\x4c\x2f\xb4\xa3\xc7\x57"
      "\x2e\x1a\xac\x4e\x45\x86\x31\x5b\x4f\x66\x00\x55\xbf\xc0\x15\x0e\xfe\x00"
      "\x26\xad\x2f\x76\xc1\xb6\x90\x4b\x2a\xc6\x72\x93\x65\xbe\x13\xec\x55\x8e"
      "\x13\x52\xd5\xe6\xa1\x1b\xc2\xb5\x8f\x26\xc8\x86\x12\xa4\x17\x68\x0e\xac"
      "\xb1\xe5\x4d\xf0\x0c\x79\x51\xc3\x77\x1c\xdd\xdb\x06\xc7\xb9\x2d\x42\x80"
      "\x70\x66\x89\xf3\xc3\x27\x6f\xf8\x10\xa7\x0e\x91\xaa\x93\x46\x9e\xf5\xf0"
      "\x0a\x44\xa0\x05\x2e\xf2\xf7\xc1\xe0\x09\x75\xf2\xb1\x20\x67\x59\xf8\x3a"
      "\x01\x81\x86\x30\x64\xcd\x4e\x96\xd4\x2d\xc5\xe7\x35\xdc\x5e\x68\x2a\x70"
      "\x2d\x84\x3f\x18\x1b\x62\x50\x3a\xb1\x1f\x4e\xe8\x6f\xb9\x2b\x1f\x43\xf6"
      "\x55\xaf\xbb\xe3\x6e\x11\x48\x5a\xcc\xcd\x5c\x5d\xd8\x15\x52\xda\x4e\x73"
      "\x09\x15\x90\x9b\x77\xd1\x06\x7b\xbc\x2d\x29\xe5\x23\xb4\x6b\x73\x82\x0d"
      "\x8d\x6a\xa3\x2e\xcd\x86\xaf\x7a\xde\x91\x7b\xc6\x40\xb3\x12\x5b\xfa\xab"
      "\x88\x54\x3c\x48\xca\x87\x3c\x45\xbd\x32\x10\x8e\x49\xb8\xe9\x21\xfe\x78"
      "\x92\x65\x91\xa0\x35\x90\x5f\x6b\xac\x2a\x75\x0f\x26\x94\x54\x9f\x5a\x4f"
      "\x5a\x0c\x75\xe9\x75\xc5\x2b\x49\x39\xa6\x24\xa1\x59\x3b\xaf\x80\xb8\xcd"
      "\xd9\x80\x91\xec\x08\x80\x01\x76\x1d\x0d\x51\xb4\x57\xb1\xb6\xbd\x30\xed"
      "\x7b\x82\x9b\xf8\x0e\x51\xf2\xc0\xed\x81\x12\x02\x25\x0d\x6e\xae\x4a\x01"
      "\x48\x68\x1f\x5e\x31\xa0\x3f\x66\xac\x95\xf3\x44\xb1\x0f\x53\x75\x62\xd8"
      "\x0e\x8f\xf3\x84\x94\x6b\x0d\x87\x3c\xe1\x2d\xbb\x1e\x52\xde\x67\x79\x99"
      "\x1a\xf5\x95\x6c\x21\x90\xf8\xe8\xa9\x03\x2c\x7d\x2c\xaf\xbe\x99\x4a\xf0"
      "\x8e\x8a\x5f\x86\xf1\xe9\xd3\x11\xb9\xb8\xdc\x5a\x89\xa2\x43\xe2\x75\xf4"
      "\xc3\x8a\xfe\x66\x6b\x59\x9f\x46\x09\x47\x00\x03\xf1\x07\x99\x83\xcc\x89"
      "\xbd\x8f\xb7\x2f\xca\xe0\x2f\xd0\x89\xaa\x0d\xe5\xc7\x3d\x30\x8d\x40\x4d"
      "\x53\x95\x82\xa0\xcc\xf1\xa2\xf1\x33\x57\xf8\x94\x2e\xf6\x12\xbc\xcc\x91"
      "\x8a\x99\x74\x0f\xfd\xa0\xff\x12\x0c\xb7\x14\xa5\xc0\x44\xf2\x47\x9a\x3e"
      "\xd3\xab\x68\xcc\x44\x83\xde\x9a\x1c\x7e\x17\xb7\xfb\x9d\x3c\x63\x1d\x9f"
      "\x53\xfc\xfe\x58\xda\x9c\xbd\x6a\xf2\x76\x7c\xb6\xcf\xd3\xb8\xa0\xdd\x30"
      "\x40\xf3\x24\x25\x6b\x0a\xee\x04\xc0\x00\x46\x72\x98\x96\xfe\x91\x9d\x8b"
      "\x65\xf1\x40\xdb\xe7\x2d\x89\x25\x33\x84\xc5\xe6\xd8\x55\x2d\xb4\x1a\x4b"
      "\x14\xd3\x6b\xb8\x57\x9f\x01\x77\x8c\xf2\x94\xa0\x3f\xac\x60\x14\x36\xba"
      "\x41\x86\xd9\x2e\xae\xcd\x0e\x39\xee\xc8\x1b\x26\x95\xb5\x91\xd8\x82\x7d"
      "\x95\x1f\xff\xcb\xf1\x21\x10\xa3\x34\xdf\xaf\x46\x37\x94\x2d\x6f\x72\xc1"
      "\x21\x46\x9f\xbc\x2d\x41\x7b\xaf\xae\x3b\xdf\xb7\x3d\x1b\x71\x1e\x31\x7e"
      "\x85\xaf\xc5\xb1\xc9\xe3\x25\xd8\xc8\x93\x90\xb6\x8f\x53\x83\x3f\x6b\xcf"
      "\xa2\x46\x57\xa0\x93\xd4\x54\x6e\xbf\xac\x8c\x70\x5b\x5a\x98\xd9\xfe\x04"
      "\x20\x7c\x4b\xde\xf1\x5f\xdc\xb1\xaa\xe8\x20\xb7\xb8\x02\x08\xb8\x19\x04"
      "\x98\x05\x40\xed\x50\x71\xfa\xd1\x18\xb3\x32\x5e\xd6\x13\x56\xc6\xee\x3b"
      "\x9e\x8f\x3e\x4c\xb5\x7f\xb6\xdc\x84\x47\x38\x97\x57\xbf\xcb\x15\x2e\x3d"
      "\x06\x92\x10\xcb\xb1\x60\x7c\xd2\xb8\x5b\x1f\x75\xd8\x68\xfb\xb7\xea\xd5"
      "\xe4\x3b\x8a\x9a\x40\x83\xa1\xa7\x34\x46\xb0\x01\xa8\x1f\xe9\x60\x49\x21"
      "\x3a\x91\xff\xb3\xb4\xdd\xbf\xf5\xa3\x46\xf3\x15\xb9\x19\x39\x82\xce\xa1"
      "\x30\x6c\x36\x28\x29\xc4\x3f\x10\x78\x1c\xd3\x1c\xe7\xa9\x3b\x0e\xec\xd3"
      "\x03\x2d\x6b\xf1\x13\x72\x0d\xdb\xc4\x1a\x24\x03\xf6\x9c\x22\x54\x79\x6c"
      "\xa2\xe5\xe5\x32\xbf\x9c\x38\xc0\x43\xdc\x00\x82\xf8\xce\xfb\x69\xf1\xa5"
      "\x86\x20\xc6\xd0\x00\x95\x9e\x7b\x54\x6c\xea\x0e\x00\x21\x0a\xe2\xdb\x2e"
      "\x9a\xe6\x35\x1f\x17\x54\xf4\xee\x80\x20\x95\xe9\x73\xa3\x7b\xd2\xfd\x5c"
      "\x5f\xbf\xc2\x52\x51\x10\x59\x3b\xd9\xf9\xc5\x32\x58\x42\xac\xc9\x34\x63"
      "\xff\xd1\x2d\xcd\x70\x15\xcb\x54\xd6\xcf\x4e\x08\x8b\x3a\xc3\xb2\x04\xe6"
      "\xe3\x5c\xc7\xbe\x56\xe9\x53\x23\x1e\xd5\x58\x80\x61\x6a\x37\x21\x3f\x8b"
      "\xc0\x6c\x45\xc0\x54\xa8\x55\xeb\x85\x0b\x2b\xf0\x99\x07\xf2\xf7\x53\xa6"
      "\x2a\xf0\xc5\x0d\xfd\x5d\xe0\x16\x6d\x4a\x5f\xf4\xea\x69\x20\xd7\x60\x39"
      "\x58\x59\x6b\x45\x9b\x34\x31\x01\x81\x4d\x46\x7a\x8c\x41\xee\xc9\x98\xea"
      "\x32\xfb\xc2\xdb\x71\x6b\x08\xd3\xd2\x95\x43\xfe\xe0\x53\x8d\xec\x2b\xec"
      "\xa5\x26\x26\xaf\x96\x3c\x48\xde\x10\x3a\x6c\x03\x4b\xae\xff\x38\xee\xed"
      "\xa1\xbd\xe7\x9d\xf3\x66\xf5\xc9\x25\xe4\x89\xaa\x3a\x74\x8b\xa7\x86\x54"
      "\xb9\xe9\x67\x43\xd9\x00\xb7\xa5\xe5\x58\x79\x6f\xcf\xb1\xa4\x71\x48\x03"
      "\x62\xfd\x71\xb9\x17\x44\x0d\xf1\x02\x70\x9d\xb9\x69\x26\xb1\x6a\x4a\x07"
      "\x00\x8e\xc5\x36\x85\x63\x86\x42\x69\x20\x97\x90\xac\xae\x9c\x6b\xac\x1f"
      "\xf5\x79\x7f\xaf\x9d\xfa\xd7\x7f\xe1\x2b\x08\xde\x1b\xd3\x2e\x60\x9b\x3f"
      "\xec\xd0\x3f\xa2\x9f\xde\x88\xfc\x32\xda\xde\x71\x0c\x3d\x0a\xff\x79\xe5"
      "\x7f\x98\x98\x8c\x5c\xb2\xd6\xe6\x28\xac\x8f\x5d\x50\xd5\xdd\x97\xc9\xe6"
      "\xdd\xec\x61\x20\xbf\x09\xc5\xea\xa7\x57\xcc\x76\x85\x2b\x24\x99\x1d\x94"
      "\xf7\xbe\x89\x33\x56\xf2\xb3\x49\x6b\xf9\x09\xf0\x1a\x63\xdb\xf6\xf3\x1b"
      "\x52\x05\x5d\x70\x4f\x5b\x5e\x95\x96\xb4\x37\x55\x8f\x99\x07\x3a\x98\xe5"
      "\xef\x4d\xc5\xaf\x35\x61\xe6\xe9\x5e\xe7\xc3\x08\x88\xc0\x0f\x99\xd2\xe4"
      "\x18\x64\x49\x5f\xd0\x74\x54\x35\xf2\x0e\x85\xdf\x0b\x80\x3a\x89\x25\x4e"
      "\x19\xdc\xe8\x06\x94\x4a\xfc\xd8\x4f\xa3\x1f\xb2\xcc\xcb\x2a\x51\xf3\xb8"
      "\xad\xbd\xc2\xfa\x8f\x53\x91\x00\xbe\x8b\x13\x3d\x65\xe5\x44\x37\xf4\x21"
      "\xc1\x80\x5a\x65\xd2\xb2\x20\xf2\x97\xe1\xb7\x0e\x3e\x8d\x80\x96\x8c\xf0"
      "\x98\xcb\x9e\x4c\xa5\x08\x54\xab\x69\xfd\x81\x3f\xe8\x22\xaf\x7a\x62\xdc"
      "\x18\x80\x25\xd1\x9c\x9a\xa2\xaf\x13\x0d\x6c\xd3\x93\x17\xff\x0e\xfe\x59"
      "\xf1\xff\xdf\xe7\x45\xaa\x51\x6e\x03\xd8\x06\x30\xae\xa4\x4c\x7a\xf2\x63"
      "\xca\xc6\xda\xb9\xea\xe4\xac\x5e\xcc\x81\xfa\x54\xf6\x7c\xcc\x36\x49\xdc"
      "\xee\x4d\xc7\x2a\xbf\x30\xb1\x45\x1a\xc1\xdf\x2b\x4c\x42\x6f\x1a\x87\xe2"
      "\x3e\x5a\x35\x90\x16\x33\xb8\x59\xf7\xc1\x7e\x00\x7c\x0f\xdd\x43\x66\x34"
      "\xc3\xb9\xf6\xf7\xb4\x6b\xa9\x44\x5c\x11\xf5\x15\x80\x92\x8b\xbc\xc6\xf0"
      "\x0a\xd6\xc1\xa1\x07\x85\x23\xb6\xa6\xe8\x3e\x20\xc4\x6f\x5c\x6b\x5d\xe4"
      "\x36\x55\x55\x3a\x9b\x89\xb5\x4e\xc1\xae\xb3\x5d\x9e\x8f\x10\xe1\x33\xdc"
      "\x8c\x91\x96\xa6\x72\x48\x7f\x4f\x7d\x69\x77\x72\xe2\xd2\x3c\xc5\xb9\x1f"
      "\x8f\x8d\xd4\x6f\x6d\x5a\x99\xa8\x04\x61\xbc\x5b\x43\x23\xc7\x4b\x13\x60"
      "\xaa\x2c\x1f\xf1\x5d\x0f\x92\x29\xb7\x01\xff\x27\x71\x85\xb1\x38\x4d\xab"
      "\x9f\xf1\xa3\xef\xac\x37\x0e\x20\x85\xc0\x8b\x53\x8a\x03\x0f\x94\x8a\x80"
      "\x3b\x46\xdb\xcc\x92\x1b\x7b\xf0\xbe\xc9\x22\xfe\x17\xd4\xa9\xaa\xa5\x98"
      "\xe0\x49\x0c\x47\x8b\x86\x55\x6c\xb9\x13\xe9\xeb\x87\xe2\xff\x04\x9b\x7e"
      "\xf3\x6c\x06\x05\x15\xfd\x40\x8f\x71\x75\x83\xca\x36\xda\x99\x53\x67\x4b"
      "\xae\x93\xde\x99\xce\x6c\x4c\x28\xdc\x90\x78\xab\xf7\x9e\xcf\x56\xf3\x70"
      "\x7a\x06\x2d\xc3\x95\x22\xe5\x25\xfd\xdf\x5b\x2e\xc5\xac\x56\xd4\x54\xe2"
      "\xb6\x3b\x41\xdb\x01\x47\xbd\x35\x93\xac\x97\xbb\x6f\x9c\x11\xdd\x19\xc0"
      "\x9c\x3e\xa5\x14\x32\x50\xd4\xf9\xa4\x3c\xed\xa1\x15\x99\x14\xb4\x86\x49"
      "\x1a\x3e\x88\x23\xb3\xae\xff\xe6\xe5\x5c\xca\x40\xc4\xe0\xfe\xee\xc9\xf4"
      "\x87\x73\x25\xc5\x2a\x94\xb1\x1e\x92\x5b\xae\xa6\x18\xf5\xa4\x45\xc9\x11"
      "\x1f\x4c\x32\x74\xf6\x59\x32\xb3\x33\xc0\x22\x52\x08\x34\x99\x43\x1e\xfa"
      "\x66\x35\x63\x17\x80\x5d\x18\xb6\x5d\xe3\xae\x5d\xee\xa0\x2d\xde\x32\xb0"
      "\xc0\xbc\xd8\xbe\x6c\x74\x18\x7f\x85\x89\x4e\xf7\x4f\xf6\x0a\x7b\x5f\x99"
      "\x77\x8f\x06\xb8\x3a\x63\xcd\xbe\x30\x76\x40\xcd\x47\x99\x48\xa4\x43\x87"
      "\x55\xd9\x4a\x51\x84\xec\x68\xe2\x3a\xb6\xc2\xd5\x95\xf6\xe6\xfb\xb8\x07"
      "\x2b\x00\xf5\x0b\xea\xac\xdf\xc7\x9a\xea\x16\x79\xdc\xdd\x59\xe8\x73\x5e"
      "\xf0\xe8\x15\xd2\xfb\x12\x22\x22\xb4\x83\x2b\x56\xaf\x11\x4b\xdc\x83\xde"
      "\x0b\x8c\x82\x3e\x31\xd0\x4f\x13\x47\x65\x06\x8c\xf7\x01\x4f\xd1\x41\xd0"
      "\x79\xf0\xb3\xe6\x7b\x8c\xe5\x20\x7e\x7b\x19\x97\xc3\x9c\xa6\x1e\xe0\x2d"
      "\x9e\x64\x23\xfe\x37\xfd\x4c\x9b\x38\x77\x79\xcf\x48\x26\x69\xba\x99\x5e"
      "\xaa\x85\x71\x39\x91\x41\x00\xfa\x08\x29\x5d\xf1\x01\x1d\xae\x20\x11\x29"
      "\x86\x74\xd4\x4e\x1c\xf9\xe9\x40\xd4\x3d\xcb\x1f\x9c\x2f\x86\x0d\xe8\xb7"
      "\xe6\x6e\x6b\x06\x3b\x27\x54\x1b\x72\x84\x74\x06\x19\x05\x22\x3b\x6b\xb0"
      "\x4f\x28\xf8\x2e\x4b\xf5\xf7\x47\xc6\xff\xf4\xe3\xb6\xbb\x3f\xa4\xc7\x43"
      "\x98\x1b\x63\x8a\x4c\x2b\xf5\xd8\x38\xfd\x98\x84\xbf\x78\x6d\xf2\xae\x8e"
      "\x2a\x75\x70\xec\xce\x2c\xc8\xec\xd5\xfe\xe9\x7c\x9d\x11\xa0\xcf\x5e\x59"
      "\x74\xcf\x40\x80\xf6\x43\x42\xcd\x9f\x88\xd1\xe4\xc6\xed\xb7\x23\x30\x44"
      "\x12\xea\x09\xb7\x7e\x56\xbf\xe9\x84\xf5\xc2\xeb\xbe\x11\xb0\x45\xee\xbf"
      "\xe6\x08\xdd\xd4\xa1\xfb\xce\xba\xf5\x59\x7a\xf6\x67\x4b\xa4\x09\x3b\x4f"
      "\x29\x67\x3e\xfb\xc1\x89\x72\x49\x5b\xc5\x4e\x97\x9b\xf9\x2b\xea\x30\x81"
      "\x84\x6e\x55\xec\xae\xa9\x68\x89\x3c\xf0\xa8\xce\xc6\xa2\x0a\x72\x84\xcc"
      "\x30\xf2\xad\x6d\x52\x8d\x44\xdd\xe4\x5e\xe8\x6e\xa2\xbb\xe4\x83\x81\xb8"
      "\x37\x1d\x87\x10\xed\x3e\x99\x74\xf3\x17\x5f\x5a\xc5\xb0\xb9\x17\xf2\xad"
      "\xe0\xd3\xf9\x30\xf1\xb2\x0d\xed\x11\x96\x59\xcb\x27\xb9\x88\x66\x8b\x52"
      "\x56\xef\x4d\x24\x24\xae\x52\xc1\x01\x5c\x2f\xc2\xf7\xb5\x16\x23\xf2\xfc"
      "\xd6\x15\x4f\x68\x4e\x93\x37\xa9\x15\xaa\xa5\xae\xc2\x3d\x3b\x0e\x64\x3a"
      "\xa7\x67\x96\x40\x88\xbd\x39\xa3\xdb\xe8\x44\x70\xbb\xbf\x8c\xa3\x35\x9b"
      "\x0b\x28\x47\x58\xe3\xef\xd0\x72\x01\xed\x6f\xd9\xcf\x23\x9a\xf7\x9f\xf1"
      "\xa8\xb7\xd9\x2b\xb9\x71\xd9\x43\x94\xc6\x9d\xba\x70\x6e\xe9\xe3\x7e\xd4"
      "\xc7\xad\x69\x96\xfa\xbe\xb8\x12\xd7\x4c\xac\x8d\xe0\x4f\xbf\x00\x54\x6f"
      "\x39\x6b\xc3\xbd\x21\x07\xa8\x3d\xc8\xda\xca\xef\xbe\x86\xbb\x43\x26\xd3"
      "\x1f\x33\x52\x18\x0c\x2d\x22\x0c\xdc\x57\x81\x26\xd1\xec\x23\x4f\x11\x6a"
      "\xd2\x30\x2a\xf7\x47\xd3\xf8\x43\x37\xbe\xd7\x4d\xea\x49\x5f\xe3\xd7\xda"
      "\xda\xa0\xdd\x79\x64\x8b\x7b\xb9\xf1\x72",
      4096));
  NONFAILING(*(uint16_t*)0x20002244 = 0);
  NONFAILING(*(uint16_t*)0x20002246 = 0x4e00);
  NONFAILING(*(uint16_t*)0x20002248 = 0);
  NONFAILING(*(uint16_t*)0x2000224a = 0x4e00);
  syz_usb_ep_write(r[0], 0x82, 0x100c, 0x20001240);
  syz_usb_ep_write(r[0], 0x82, 0, 0);
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  install_segv_handler();
  for (procid = 0; procid < 6; procid++) {
    if (fork() == 0) {
      loop();
    }
  }
  sleep(1000000);
  return 0;
}