// https://syzkaller.appspot.com/bug?id=9727723dea040f961dc281b4fa08b0cca1e2d15d
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/genetlink.h>
#include <linux/netlink.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

#define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len)               \
  *(type*)(addr) =                                                             \
      htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) |           \
            (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static long syz_genetlink_get_family_id(volatile long name)
{
  char buf[512] = {0};
  struct nlmsghdr* hdr = (struct nlmsghdr*)buf;
  struct genlmsghdr* genlhdr = (struct genlmsghdr*)NLMSG_DATA(hdr);
  struct nlattr* attr = (struct nlattr*)(genlhdr + 1);
  hdr->nlmsg_len =
      sizeof(*hdr) + sizeof(*genlhdr) + sizeof(*attr) + GENL_NAMSIZ;
  hdr->nlmsg_type = GENL_ID_CTRL;
  hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
  genlhdr->cmd = CTRL_CMD_GETFAMILY;
  attr->nla_type = CTRL_ATTR_FAMILY_NAME;
  attr->nla_len = sizeof(*attr) + GENL_NAMSIZ;
  strncpy((char*)(attr + 1), (char*)name, GENL_NAMSIZ);
  struct iovec iov = {hdr, hdr->nlmsg_len};
  struct sockaddr_nl addr = {0};
  addr.nl_family = AF_NETLINK;
  int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  if (fd == -1) {
    return -1;
  }
  struct msghdr msg = {&addr, sizeof(addr), &iov, 1, NULL, 0, 0};
  if (sendmsg(fd, &msg, 0) == -1) {
    close(fd);
    return -1;
  }
  ssize_t n = recv(fd, buf, sizeof(buf), 0);
  close(fd);
  if (n <= 0) {
    return -1;
  }
  if (hdr->nlmsg_type != GENL_ID_CTRL) {
    return -1;
  }
  for (; (char*)attr < buf + n;
       attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
    if (attr->nla_type == CTRL_ATTR_FAMILY_ID)
      return *(uint16_t*)(attr + 1);
  }
  return -1;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  int i;
  for (i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0};

void execute_one(void)
{
  intptr_t res = 0;
  res = syscall(__NR_socket, 0x10ul, 3ul, 0x10);
  if (res != -1)
    r[0] = res;
  res = syscall(__NR_socket, 0x10ul, 3ul, 0x10);
  if (res != -1)
    r[1] = res;
  memcpy((void*)0x20000000, "TIPCv2\000", 7);
  res = syz_genetlink_get_family_id(0x20000000);
  if (res != -1)
    r[2] = res;
  *(uint64_t*)0x20000500 = 0;
  *(uint32_t*)0x20000508 = 0;
  *(uint64_t*)0x20000510 = 0x200004c0;
  *(uint64_t*)0x200004c0 = 0x20000540;
  memcpy((void*)0x20000540, "\x1c\x00\x00\x00", 4);
  *(uint16_t*)0x20000544 = r[2];
  memcpy((void*)0x20000546,
         "\x6d\x5b\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x08\x18\xf1"
         "\x9f\xb1\x00\x03\x80\x9e\x20\x6c\xdc\x93\x2a\x2e\x8f\xea\xec\xa8\x7d"
         "\x75\xb0\xb7\x20\x6c\x99\x28\xe0\x69\xd8\x49\x90\xb3\x1d\x31\xa2\x52"
         "\x39\x20\xa9\x02\x55\x7f\x07\xac\xc0\x19\x34\x73\x6e\x3e\x3b\x74\xa3"
         "\x7c\x5b\x85\xdc\xce\xd3\x58\xdb\x11\x70\x4e\x15\x9e\xdc\x16\x03\xc2"
         "\x96\xef\xfa\xad\xa1\xf7\x0f\xe6\x26\x50\x45\xf5\xfc\xcf\x52\x2c\xf7"
         "\x03\xf3\xfa\xab\x21\x10\x10\x72\xc0\x91\xe5\x9f\xdb\xcb\x8b\xd5\x3e"
         "\xb1\x1a\xd6\x65\x18\x70\x2e\x35\x03\xea\x86\x92\x95\x74\xb9\x01\xd7"
         "\xe0\x7c\x28\x87\x5c\xf5\xe4\x4e\xf6\x14\x9b\x52\x1d\xb9\x2b\x8c\xe7"
         "\x6f\x15\x21\x9c\xda\xe8\xd8\x42\x37\x0f\xa9\x2c\xce\xc9\xb7\xd2\x25"
         "\xc6\x00\xc0\x26\x98\x16\x33\xa9\x12\x72\x2d\xa5\x26\xda\xd8\xe0\x4b"
         "\x77\x07\x5c\x4c\xc2\x6a\x1d\x5a\x49\x42\x31\x67\x06\x04\xfc\xc7\xe1"
         "\xfb\xab\xfe\xad\xbe\xec\x61\x36\xfc\x96\xf3\x65\xbf\xa0\x91\xb0\xf9"
         "\x56\xa6\xbd\xf7\xc6\x50\xb1\x97\xf3\x65\x97\x70\xb8\x4d\x61\x36\x99"
         "\x9b\x94\x06\xf6\x49\x4e\x3b\xe3\xe6\x43\xd5\x12\x79\xf7\x8f\xdf\x10"
         "\xfb\xd9\xa7\xf1\x0a\xe2\xe0\xe7\x5c\x6e\x05\x31\x93\xe6\x17\xba\xc3"
         "\xd3\x93\x8c",
         275);
  *(uint64_t*)0x200004c8 = 0x1c;
  *(uint64_t*)0x20000518 = 1;
  *(uint64_t*)0x20000520 = 0;
  *(uint64_t*)0x20000528 = 0;
  *(uint32_t*)0x20000530 = 0;
  syscall(__NR_sendmsg, r[1], 0x20000500ul, 0ul);
  *(uint64_t*)0x20000480 = 0;
  *(uint32_t*)0x20000488 = 0;
  *(uint64_t*)0x20000490 = 0x20000440;
  *(uint64_t*)0x20000440 = 0x200000c0;
  *(uint32_t*)0x200000c0 = 0x2c0;
  *(uint16_t*)0x200000c4 = r[2];
  *(uint16_t*)0x200000c6 = 1;
  *(uint32_t*)0x200000c8 = 0x70bd26;
  *(uint32_t*)0x200000cc = 0x25dfdbfd;
  *(uint8_t*)0x200000d0 = 0xf;
  *(uint8_t*)0x200000d1 = 0;
  *(uint16_t*)0x200000d2 = 0;
  *(uint16_t*)0x200000d4 = 0x7c;
  STORE_BY_BITMASK(uint16_t, , 0x200000d6, 5, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x200000d7, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x200000d7, 1, 7, 1);
  *(uint16_t*)0x200000d8 = 8;
  *(uint16_t*)0x200000da = 1;
  memcpy((void*)0x200000dc, "eth\000", 4);
  *(uint16_t*)0x200000e0 = 8;
  *(uint16_t*)0x200000e2 = 1;
  memcpy((void*)0x200000e4, "udp\000", 4);
  *(uint16_t*)0x200000e8 = 0x1c;
  STORE_BY_BITMASK(uint16_t, , 0x200000ea, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x200000eb, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x200000eb, 1, 7, 1);
  *(uint16_t*)0x200000ec = 8;
  *(uint16_t*)0x200000ee = 3;
  *(uint32_t*)0x200000f0 = 0x1ff;
  *(uint16_t*)0x200000f4 = 8;
  *(uint16_t*)0x200000f6 = 1;
  *(uint32_t*)0x200000f8 = 0x17;
  *(uint16_t*)0x200000fc = 8;
  *(uint16_t*)0x200000fe = 3;
  *(uint32_t*)0x20000100 = 1;
  *(uint16_t*)0x20000104 = 0x4c;
  STORE_BY_BITMASK(uint16_t, , 0x20000106, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000107, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000107, 1, 7, 1);
  *(uint16_t*)0x20000108 = 8;
  *(uint16_t*)0x2000010a = 4;
  *(uint32_t*)0x2000010c = 0x1000;
  *(uint16_t*)0x20000110 = 8;
  *(uint16_t*)0x20000112 = 2;
  *(uint32_t*)0x20000114 = 0x33;
  *(uint16_t*)0x20000118 = 8;
  *(uint16_t*)0x2000011a = 2;
  *(uint32_t*)0x2000011c = 9;
  *(uint16_t*)0x20000120 = 8;
  *(uint16_t*)0x20000122 = 2;
  *(uint32_t*)0x20000124 = 3;
  *(uint16_t*)0x20000128 = 8;
  *(uint16_t*)0x2000012a = 3;
  *(uint32_t*)0x2000012c = 0x822;
  *(uint16_t*)0x20000130 = 8;
  *(uint16_t*)0x20000132 = 2;
  *(uint32_t*)0x20000134 = 0xffff;
  *(uint16_t*)0x20000138 = 8;
  *(uint16_t*)0x2000013a = 3;
  *(uint32_t*)0x2000013c = 0x67;
  *(uint16_t*)0x20000140 = 8;
  *(uint16_t*)0x20000142 = 3;
  *(uint32_t*)0x20000144 = 4;
  *(uint16_t*)0x20000148 = 8;
  *(uint16_t*)0x2000014a = 1;
  *(uint32_t*)0x2000014c = 0x1c;
  *(uint16_t*)0x20000150 = 0x98;
  STORE_BY_BITMASK(uint16_t, , 0x20000152, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000153, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000153, 1, 7, 1);
  *(uint16_t*)0x20000154 = 8;
  *(uint16_t*)0x20000156 = 2;
  *(uint32_t*)0x20000158 = 0x7fff;
  *(uint16_t*)0x2000015c = 8;
  *(uint16_t*)0x2000015e = 2;
  *(uint32_t*)0x20000160 = 0x1000;
  *(uint16_t*)0x20000164 = 8;
  *(uint16_t*)0x20000166 = 1;
  *(uint32_t*)0x20000168 = 0x720;
  *(uint16_t*)0x2000016c = 0x1c;
  STORE_BY_BITMASK(uint16_t, , 0x2000016e, 3, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x2000016f, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x2000016f, 1, 7, 1);
  *(uint16_t*)0x20000170 = 8;
  *(uint16_t*)0x20000172 = 1;
  *(uint32_t*)0x20000174 = 7;
  *(uint16_t*)0x20000178 = 8;
  *(uint16_t*)0x2000017a = 1;
  *(uint32_t*)0x2000017c = 0x94;
  *(uint16_t*)0x20000180 = 8;
  *(uint16_t*)0x20000182 = 2;
  *(uint32_t*)0x20000184 = 0x9a;
  *(uint16_t*)0x20000188 = 4;
  *(uint16_t*)0x2000018a = 4;
  *(uint16_t*)0x2000018c = 8;
  *(uint16_t*)0x2000018e = 2;
  *(uint32_t*)0x20000190 = 2;
  *(uint16_t*)0x20000194 = 0x54;
  STORE_BY_BITMASK(uint16_t, , 0x20000196, 3, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000197, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000197, 1, 7, 1);
  *(uint16_t*)0x20000198 = 8;
  *(uint16_t*)0x2000019a = 1;
  *(uint32_t*)0x2000019c = 0xff;
  *(uint16_t*)0x200001a0 = 8;
  *(uint16_t*)0x200001a2 = 1;
  *(uint32_t*)0x200001a4 = 2;
  *(uint16_t*)0x200001a8 = 8;
  *(uint16_t*)0x200001aa = 1;
  *(uint32_t*)0x200001ac = 9;
  *(uint16_t*)0x200001b0 = 8;
  *(uint16_t*)0x200001b2 = 2;
  *(uint32_t*)0x200001b4 = 0x3f;
  *(uint16_t*)0x200001b8 = 8;
  *(uint16_t*)0x200001ba = 2;
  *(uint32_t*)0x200001bc = 5;
  *(uint16_t*)0x200001c0 = 8;
  *(uint16_t*)0x200001c2 = 2;
  *(uint32_t*)0x200001c4 = 6;
  *(uint16_t*)0x200001c8 = 8;
  *(uint16_t*)0x200001ca = 2;
  *(uint32_t*)0x200001cc = 8;
  *(uint16_t*)0x200001d0 = 8;
  *(uint16_t*)0x200001d2 = 1;
  *(uint32_t*)0x200001d4 = 4;
  *(uint16_t*)0x200001d8 = 8;
  *(uint16_t*)0x200001da = 2;
  *(uint32_t*)0x200001dc = 2;
  *(uint16_t*)0x200001e0 = 8;
  *(uint16_t*)0x200001e2 = 2;
  *(uint32_t*)0x200001e4 = 0x79;
  *(uint16_t*)0x200001e8 = 0x6c;
  STORE_BY_BITMASK(uint16_t, , 0x200001ea, 5, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x200001eb, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x200001eb, 1, 7, 1);
  *(uint16_t*)0x200001ec = 0x14;
  STORE_BY_BITMASK(uint16_t, , 0x200001ee, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x200001ef, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x200001ef, 1, 7, 1);
  *(uint16_t*)0x200001f0 = 8;
  *(uint16_t*)0x200001f2 = 4;
  *(uint32_t*)0x200001f4 = 0x7fffffff;
  *(uint16_t*)0x200001f8 = 8;
  *(uint16_t*)0x200001fa = 3;
  *(uint32_t*)0x200001fc = 3;
  *(uint16_t*)0x20000200 = 8;
  *(uint16_t*)0x20000202 = 1;
  memcpy((void*)0x20000204, "eth\000", 4);
  *(uint16_t*)0x20000208 = 7;
  *(uint16_t*)0x2000020a = 1;
  memcpy((void*)0x2000020c, "ib\000", 3);
  *(uint16_t*)0x20000210 = 7;
  *(uint16_t*)0x20000212 = 1;
  memcpy((void*)0x20000214, "ib\000", 3);
  *(uint16_t*)0x20000218 = 0x34;
  STORE_BY_BITMASK(uint16_t, , 0x2000021a, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x2000021b, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x2000021b, 1, 7, 1);
  *(uint16_t*)0x2000021c = 8;
  *(uint16_t*)0x2000021e = 2;
  *(uint32_t*)0x20000220 = 3;
  *(uint16_t*)0x20000224 = 8;
  *(uint16_t*)0x20000226 = 1;
  *(uint32_t*)0x20000228 = 3;
  *(uint16_t*)0x2000022c = 8;
  *(uint16_t*)0x2000022e = 4;
  *(uint32_t*)0x20000230 = 3;
  *(uint16_t*)0x20000234 = 8;
  *(uint16_t*)0x20000236 = 2;
  *(uint32_t*)0x20000238 = 4;
  *(uint16_t*)0x2000023c = 8;
  *(uint16_t*)0x2000023e = 3;
  *(uint32_t*)0x20000240 = 4;
  *(uint16_t*)0x20000244 = 8;
  *(uint16_t*)0x20000246 = 3;
  *(uint32_t*)0x20000248 = 1;
  *(uint16_t*)0x2000024c = 7;
  *(uint16_t*)0x2000024e = 1;
  memcpy((void*)0x20000250, "ib\000", 3);
  *(uint16_t*)0x20000254 = 0x1c;
  STORE_BY_BITMASK(uint16_t, , 0x20000256, 9, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000257, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000257, 1, 7, 1);
  *(uint16_t*)0x20000258 = 8;
  *(uint16_t*)0x2000025a = 2;
  *(uint32_t*)0x2000025c = 0;
  *(uint16_t*)0x20000260 = 8;
  *(uint16_t*)0x20000262 = 2;
  *(uint32_t*)0x20000264 = 3;
  *(uint16_t*)0x20000268 = 8;
  *(uint16_t*)0x2000026a = 2;
  *(uint32_t*)0x2000026c = 2;
  *(uint16_t*)0x20000270 = 0x48;
  STORE_BY_BITMASK(uint16_t, , 0x20000272, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000273, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000273, 1, 7, 1);
  *(uint16_t*)0x20000274 = 8;
  *(uint16_t*)0x20000276 = 2;
  *(uint32_t*)0x20000278 = 7;
  *(uint16_t*)0x2000027c = 0x2c;
  STORE_BY_BITMASK(uint16_t, , 0x2000027e, 3, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x2000027f, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x2000027f, 1, 7, 1);
  *(uint16_t*)0x20000280 = 8;
  *(uint16_t*)0x20000282 = 2;
  *(uint32_t*)0x20000284 = 6;
  *(uint16_t*)0x20000288 = 8;
  *(uint16_t*)0x2000028a = 1;
  *(uint32_t*)0x2000028c = 9;
  *(uint16_t*)0x20000290 = 8;
  *(uint16_t*)0x20000292 = 2;
  *(uint32_t*)0x20000294 = 0x72;
  *(uint16_t*)0x20000298 = 8;
  *(uint16_t*)0x2000029a = 1;
  *(uint32_t*)0x2000029c = 0xbba;
  *(uint16_t*)0x200002a0 = 8;
  *(uint16_t*)0x200002a2 = 1;
  *(uint32_t*)0x200002a4 = 0x40;
  *(uint16_t*)0x200002a8 = 8;
  *(uint16_t*)0x200002aa = 1;
  *(uint32_t*)0x200002ac = 3;
  *(uint16_t*)0x200002b0 = 8;
  *(uint16_t*)0x200002b2 = 2;
  *(uint32_t*)0x200002b4 = 8;
  *(uint16_t*)0x200002b8 = 0x8c;
  STORE_BY_BITMASK(uint16_t, , 0x200002ba, 6, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x200002bb, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x200002bb, 1, 7, 1);
  *(uint16_t*)0x200002bc = 0x3c;
  *(uint16_t*)0x200002be = 4;
  memcpy((void*)0x200002c0, "gcm(aes)"
                            "\000\000\000\000\000\000\000\000\000\000\000\000"
                            "\000\000\000\000\000\000\000\000\000\000\000\000",
         32);
  *(uint32_t*)0x200002e0 = 0x14;
  memcpy((void*)0x200002e4, "\xeb\x4c\xd9\x18\x85\xa3\xca\x2e\xd0\x78\x3f\xe8"
                            "\x60\xa6\x27\x27\xea\x90\x18\xd4",
         20);
  *(uint16_t*)0x200002f8 = 4;
  *(uint16_t*)0x200002fa = 3;
  *(uint16_t*)0x200002fc = 8;
  *(uint16_t*)0x200002fe = 1;
  *(uint32_t*)0x20000300 = 3;
  *(uint16_t*)0x20000304 = 0x3c;
  *(uint16_t*)0x20000306 = 4;
  memcpy((void*)0x20000308, "gcm(aes)"
                            "\000\000\000\000\000\000\000\000\000\000\000\000"
                            "\000\000\000\000\000\000\000\000\000\000\000\000",
         32);
  *(uint32_t*)0x20000328 = 0x14;
  memcpy((void*)0x2000032c, "\x30\x1d\xb4\xff\x0b\x51\x35\x18\x7e\xe0\xb0\x4f"
                            "\x90\xf4\x90\x97\xb9\x14\xe8\xb3",
         20);
  *(uint16_t*)0x20000340 = 4;
  *(uint16_t*)0x20000342 = 2;
  *(uint16_t*)0x20000344 = 0x1c;
  STORE_BY_BITMASK(uint16_t, , 0x20000346, 2, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000347, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000347, 1, 7, 1);
  *(uint16_t*)0x20000348 = 8;
  *(uint16_t*)0x2000034a = 1;
  *(uint32_t*)0x2000034c = 8;
  *(uint16_t*)0x20000350 = 0xc;
  STORE_BY_BITMASK(uint16_t, , 0x20000352, 3, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000353, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000353, 1, 7, 1);
  *(uint16_t*)0x20000354 = 8;
  *(uint16_t*)0x20000356 = 1;
  *(uint32_t*)0x20000358 = 0x97ea;
  *(uint16_t*)0x2000035c = 4;
  *(uint16_t*)0x2000035e = 4;
  *(uint16_t*)0x20000360 = 0x14;
  STORE_BY_BITMASK(uint16_t, , 0x20000362, 9, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000363, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000363, 1, 7, 1);
  *(uint16_t*)0x20000364 = 8;
  *(uint16_t*)0x20000366 = 1;
  *(uint32_t*)0x20000368 = 1;
  *(uint16_t*)0x2000036c = 8;
  *(uint16_t*)0x2000036e = 2;
  *(uint32_t*)0x20000370 = 0x1f;
  *(uint16_t*)0x20000374 = 0xc;
  STORE_BY_BITMASK(uint16_t, , 0x20000376, 9, 0, 14);
  STORE_BY_BITMASK(uint16_t, , 0x20000377, 0, 6, 1);
  STORE_BY_BITMASK(uint16_t, , 0x20000377, 1, 7, 1);
  *(uint16_t*)0x20000378 = 8;
  *(uint16_t*)0x2000037a = 1;
  *(uint32_t*)0x2000037c = 0;
  *(uint64_t*)0x20000448 = 0x2c0;
  *(uint64_t*)0x20000498 = 1;
  *(uint64_t*)0x200004a0 = 0;
  *(uint64_t*)0x200004a8 = 0;
  *(uint32_t*)0x200004b0 = 0x84;
  syscall(__NR_sendmsg, r[0], 0x20000480ul, 0x4000ul);
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  for (procid = 0; procid < 6; procid++) {
    if (fork() == 0) {
      loop();
    }
  }
  sleep(1000000);
  return 0;
}