// https://syzkaller.appspot.com/bug?id=29f52d4baeec7d90c9fd0fb991721f3cad42a4d5
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/futex.h>
#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_link.h>
#include <linux/in6.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/sched.h>
#include <linux/veth.h>

#ifndef __NR_clone3
#define __NR_clone3 435
#endif

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void thread_start(void* (*fn)(void*), void* arg)
{
  pthread_t th;
  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setstacksize(&attr, 128 << 10);
  int i = 0;
  for (; i < 100; i++) {
    if (pthread_create(&th, &attr, fn, arg) == 0) {
      pthread_attr_destroy(&attr);
      return;
    }
    if (errno == EAGAIN) {
      usleep(50);
      continue;
    }
    break;
  }
  exit(1);
}

typedef struct {
  int state;
} event_t;

static void event_init(event_t* ev)
{
  ev->state = 0;
}

static void event_reset(event_t* ev)
{
  ev->state = 0;
}

static void event_set(event_t* ev)
{
  if (ev->state)
    exit(1);
  __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
  syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
  while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

static int event_isset(event_t* ev)
{
  return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
  uint64_t start = current_time_ms();
  uint64_t now = start;
  for (;;) {
    uint64_t remain = timeout - (now - start);
    struct timespec ts;
    ts.tv_sec = remain / 1000;
    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
    if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
      return 1;
    now = current_time_ms();
    if (now - start > timeout)
      return 0;
  }
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

struct nlmsg {
  char* pos;
  int nesting;
  struct nlattr* nested[8];
  char buf[4096];
};

static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
                         const void* data, int size)
{
  memset(nlmsg, 0, sizeof(*nlmsg));
  struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  hdr->nlmsg_type = typ;
  hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
  memcpy(hdr + 1, data, size);
  nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}

static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
                         int size)
{
  struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  attr->nla_len = sizeof(*attr) + size;
  attr->nla_type = typ;
  if (size > 0)
    memcpy(attr + 1, data, size);
  nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}

static void netlink_nest(struct nlmsg* nlmsg, int typ)
{
  struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  attr->nla_type = typ;
  nlmsg->pos += sizeof(*attr);
  nlmsg->nested[nlmsg->nesting++] = attr;
}

static void netlink_done(struct nlmsg* nlmsg)
{
  struct nlattr* attr = nlmsg->nested[--nlmsg->nesting];
  attr->nla_len = nlmsg->pos - (char*)attr;
}

static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
                            int* reply_len, bool dofail)
{
  if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
    exit(1);
  struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
  struct sockaddr_nl addr;
  memset(&addr, 0, sizeof(addr));
  addr.nl_family = AF_NETLINK;
  ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
                     (struct sockaddr*)&addr, sizeof(addr));
  if (n != (ssize_t)hdr->nlmsg_len) {
    if (dofail)
      exit(1);
    return -1;
  }
  n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  if (reply_len)
    *reply_len = 0;
  if (n < 0) {
    if (dofail)
      exit(1);
    return -1;
  }
  if (n < (ssize_t)sizeof(struct nlmsghdr)) {
    errno = EINVAL;
    if (dofail)
      exit(1);
    return -1;
  }
  if (hdr->nlmsg_type == NLMSG_DONE)
    return 0;
  if (reply_len && hdr->nlmsg_type == reply_type) {
    *reply_len = n;
    return 0;
  }
  if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
    errno = EINVAL;
    if (dofail)
      exit(1);
    return -1;
  }
  if (hdr->nlmsg_type != NLMSG_ERROR) {
    errno = EINVAL;
    if (dofail)
      exit(1);
    return -1;
  }
  errno = -((struct nlmsgerr*)(hdr + 1))->error;
  return -errno;
}

static int netlink_send(struct nlmsg* nlmsg, int sock)
{
  return netlink_send_ext(nlmsg, sock, 0, NULL, true);
}

static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
                                   const char* family_name, bool dofail)
{
  struct genlmsghdr genlhdr;
  memset(&genlhdr, 0, sizeof(genlhdr));
  genlhdr.cmd = CTRL_CMD_GETFAMILY;
  netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
  netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
               strnlen(family_name, GENL_NAMSIZ - 1) + 1);
  int n = 0;
  int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
  if (err < 0) {
    return -1;
  }
  uint16_t id = 0;
  struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
                                         NLMSG_ALIGN(sizeof(genlhdr)));
  for (; (char*)attr < nlmsg->buf + n;
       attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
    if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
      id = *(uint16_t*)(attr + 1);
      break;
    }
  }
  if (!id) {
    errno = EINVAL;
    return -1;
  }
  recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  return id;
}

static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type,
                                    const char* name, bool up)
{
  struct ifinfomsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  if (up)
    hdr.ifi_flags = hdr.ifi_change = IFF_UP;
  netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr,
               sizeof(hdr));
  if (name)
    netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name));
  netlink_nest(nlmsg, IFLA_LINKINFO);
  netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type));
}

static void netlink_device_change(struct nlmsg* nlmsg, int sock,
                                  const char* name, bool up, const char* master,
                                  const void* mac, int macsize,
                                  const char* new_name)
{
  struct ifinfomsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  if (up)
    hdr.ifi_flags = hdr.ifi_change = IFF_UP;
  hdr.ifi_index = if_nametoindex(name);
  netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr));
  if (new_name)
    netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name));
  if (master) {
    int ifindex = if_nametoindex(master);
    netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex));
  }
  if (macsize)
    netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize);
  int err = netlink_send(nlmsg, sock);
  if (err < 0) {
  }
}

static struct nlmsg nlmsg;

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

#define NL802154_CMD_SET_SHORT_ADDR 11
#define NL802154_ATTR_IFINDEX 3
#define NL802154_ATTR_SHORT_ADDR 10

static const char* setup_802154()
{
  const char* error = NULL;
  int sock_generic = -1;
  int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  if (sock_route == -1) {
    error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) failed";
    goto fail;
  }
  sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  if (sock_generic == -1) {
    error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) failed";
    goto fail;
  }
  {
    int nl802154_family_id =
        netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true);
    if (nl802154_family_id < 0) {
      error = "netlink_query_family_id failed";
      goto fail;
    }
    for (int i = 0; i < 2; i++) {
      char devname[] = "wpan0";
      devname[strlen(devname) - 1] += i;
      uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8);
      uint16_t shortaddr = 0xaaa0 + i;
      int ifindex = if_nametoindex(devname);
      struct genlmsghdr genlhdr;
      memset(&genlhdr, 0, sizeof(genlhdr));
      genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR;
      netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr));
      netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
      netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr,
                   sizeof(shortaddr));
      if (netlink_send(&nlmsg, sock_generic) < 0) {
        error = "NL802154_CMD_SET_SHORT_ADDR failed";
        goto fail;
      }
      netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr,
                            sizeof(hwaddr), 0);
      if (i == 0) {
        netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false);
        netlink_done(&nlmsg);
        netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
        if (netlink_send(&nlmsg, sock_route) < 0) {
          error = "netlink: adding device lowpan0 type lowpan link wpan0";
          goto fail;
        }
      }
    }
  }
fail:
  close(sock_route);
  close(sock_generic);
  return error;
}

#define FUSE_MIN_READ_BUFFER 8192
enum fuse_opcode {
  FUSE_LOOKUP = 1,
  FUSE_FORGET = 2,
  FUSE_GETATTR = 3,
  FUSE_SETATTR = 4,
  FUSE_READLINK = 5,
  FUSE_SYMLINK = 6,
  FUSE_MKNOD = 8,
  FUSE_MKDIR = 9,
  FUSE_UNLINK = 10,
  FUSE_RMDIR = 11,
  FUSE_RENAME = 12,
  FUSE_LINK = 13,
  FUSE_OPEN = 14,
  FUSE_READ = 15,
  FUSE_WRITE = 16,
  FUSE_STATFS = 17,
  FUSE_RELEASE = 18,
  FUSE_FSYNC = 20,
  FUSE_SETXATTR = 21,
  FUSE_GETXATTR = 22,
  FUSE_LISTXATTR = 23,
  FUSE_REMOVEXATTR = 24,
  FUSE_FLUSH = 25,
  FUSE_INIT = 26,
  FUSE_OPENDIR = 27,
  FUSE_READDIR = 28,
  FUSE_RELEASEDIR = 29,
  FUSE_FSYNCDIR = 30,
  FUSE_GETLK = 31,
  FUSE_SETLK = 32,
  FUSE_SETLKW = 33,
  FUSE_ACCESS = 34,
  FUSE_CREATE = 35,
  FUSE_INTERRUPT = 36,
  FUSE_BMAP = 37,
  FUSE_DESTROY = 38,
  FUSE_IOCTL = 39,
  FUSE_POLL = 40,
  FUSE_NOTIFY_REPLY = 41,
  FUSE_BATCH_FORGET = 42,
  FUSE_FALLOCATE = 43,
  FUSE_READDIRPLUS = 44,
  FUSE_RENAME2 = 45,
  FUSE_LSEEK = 46,
  FUSE_COPY_FILE_RANGE = 47,
  FUSE_SETUPMAPPING = 48,
  FUSE_REMOVEMAPPING = 49,
  FUSE_SYNCFS = 50,
  FUSE_TMPFILE = 51,
  FUSE_STATX = 52,
  CUSE_INIT = 4096,
  CUSE_INIT_BSWAP_RESERVED = 1048576,
  FUSE_INIT_BSWAP_RESERVED = 436207616,
};
struct fuse_in_header {
  uint32_t len;
  uint32_t opcode;
  uint64_t unique;
  uint64_t nodeid;
  uint32_t uid;
  uint32_t gid;
  uint32_t pid;
  uint32_t padding;
};
struct fuse_out_header {
  uint32_t len;
  uint32_t error;
  uint64_t unique;
};
struct syz_fuse_req_out {
  struct fuse_out_header* init;
  struct fuse_out_header* lseek;
  struct fuse_out_header* bmap;
  struct fuse_out_header* poll;
  struct fuse_out_header* getxattr;
  struct fuse_out_header* lk;
  struct fuse_out_header* statfs;
  struct fuse_out_header* write;
  struct fuse_out_header* read;
  struct fuse_out_header* open;
  struct fuse_out_header* attr;
  struct fuse_out_header* entry;
  struct fuse_out_header* dirent;
  struct fuse_out_header* direntplus;
  struct fuse_out_header* create_open;
  struct fuse_out_header* ioctl;
  struct fuse_out_header* statx;
};
static int fuse_send_response(int fd, const struct fuse_in_header* in_hdr,
                              struct fuse_out_header* out_hdr)
{
  if (!out_hdr) {
    return -1;
  }
  out_hdr->unique = in_hdr->unique;
  if (write(fd, out_hdr, out_hdr->len) == -1) {
    return -1;
  }
  return 0;
}
static volatile long syz_fuse_handle_req(volatile long a0, volatile long a1,
                                         volatile long a2, volatile long a3)
{
  struct syz_fuse_req_out* req_out = (struct syz_fuse_req_out*)a3;
  struct fuse_out_header* out_hdr = NULL;
  char* buf = (char*)a1;
  int buf_len = (int)a2;
  int fd = (int)a0;
  if (!req_out) {
    return -1;
  }
  if (buf_len < FUSE_MIN_READ_BUFFER) {
    return -1;
  }
  int ret = read(fd, buf, buf_len);
  if (ret == -1) {
    return -1;
  }
  if ((size_t)ret < sizeof(struct fuse_in_header)) {
    return -1;
  }
  const struct fuse_in_header* in_hdr = (const struct fuse_in_header*)buf;
  if (in_hdr->len > (uint32_t)ret) {
    return -1;
  }
  switch (in_hdr->opcode) {
  case FUSE_GETATTR:
  case FUSE_SETATTR:
    out_hdr = req_out->attr;
    break;
  case FUSE_LOOKUP:
  case FUSE_SYMLINK:
  case FUSE_LINK:
  case FUSE_MKNOD:
  case FUSE_MKDIR:
    out_hdr = req_out->entry;
    break;
  case FUSE_OPEN:
  case FUSE_OPENDIR:
    out_hdr = req_out->open;
    break;
  case FUSE_STATFS:
    out_hdr = req_out->statfs;
    break;
  case FUSE_RMDIR:
  case FUSE_RENAME:
  case FUSE_RENAME2:
  case FUSE_FALLOCATE:
  case FUSE_SETXATTR:
  case FUSE_REMOVEXATTR:
  case FUSE_FSYNCDIR:
  case FUSE_FSYNC:
  case FUSE_SETLKW:
  case FUSE_SETLK:
  case FUSE_ACCESS:
  case FUSE_FLUSH:
  case FUSE_RELEASE:
  case FUSE_RELEASEDIR:
  case FUSE_UNLINK:
  case FUSE_DESTROY:
    out_hdr = req_out->init;
    if (!out_hdr) {
      return -1;
    }
    out_hdr->len = sizeof(struct fuse_out_header);
    break;
  case FUSE_READ:
    out_hdr = req_out->read;
    break;
  case FUSE_READDIR:
    out_hdr = req_out->dirent;
    break;
  case FUSE_READDIRPLUS:
    out_hdr = req_out->direntplus;
    break;
  case FUSE_INIT:
    out_hdr = req_out->init;
    break;
  case FUSE_LSEEK:
    out_hdr = req_out->lseek;
    break;
  case FUSE_GETLK:
    out_hdr = req_out->lk;
    break;
  case FUSE_BMAP:
    out_hdr = req_out->bmap;
    break;
  case FUSE_POLL:
    out_hdr = req_out->poll;
    break;
  case FUSE_GETXATTR:
  case FUSE_LISTXATTR:
    out_hdr = req_out->getxattr;
    break;
  case FUSE_WRITE:
  case FUSE_COPY_FILE_RANGE:
    out_hdr = req_out->write;
    break;
  case FUSE_FORGET:
  case FUSE_BATCH_FORGET:
    return 0;
  case FUSE_CREATE:
    out_hdr = req_out->create_open;
    break;
  case FUSE_IOCTL:
    out_hdr = req_out->ioctl;
    break;
  case FUSE_STATX:
    out_hdr = req_out->statx;
    break;
  default:
    return -1;
  }
  return fuse_send_response(fd, in_hdr, out_hdr);
}

#define USLEEP_FORKED_CHILD (3 * 50 * 1000)

static long handle_clone_ret(long ret)
{
  if (ret != 0) {
    return ret;
  }
  usleep(USLEEP_FORKED_CHILD);
  syscall(__NR_exit, 0);
  while (1) {
  }
}

#define MAX_CLONE_ARGS_BYTES 256
static long syz_clone3(volatile long a0, volatile long a1)
{
  unsigned long copy_size = a1;
  if (copy_size < sizeof(uint64_t) || copy_size > MAX_CLONE_ARGS_BYTES)
    return -1;
  char clone_args[MAX_CLONE_ARGS_BYTES];
  memcpy(&clone_args, (void*)a0, copy_size);
  uint64_t* flags = (uint64_t*)&clone_args;
  *flags &= ~CLONE_VM;
  return handle_clone_ret((long)syscall(__NR_clone3, &clone_args, copy_size));
}

struct thread_t {
  int created, call;
  event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    event_wait(&th->ready);
    event_reset(&th->ready);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    event_set(&th->done);
  }
  return 0;
}

static void execute_one(void)
{
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  int i, call, thread;
  for (call = 0; call < 18; call++) {
    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
         thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        event_init(&th->ready);
        event_init(&th->done);
        event_set(&th->done);
        thread_start(thr, th);
      }
      if (!event_isset(&th->done))
        continue;
      event_reset(&th->done);
      th->call = call;
      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
      event_set(&th->ready);
      if (call == 8)
        break;
      event_timedwait(&th->done, 50);
      break;
    }
  }
  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
    sleep_ms(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff, 0xffffffffffffffff};

void execute_call(int call)
{
  intptr_t res = 0;
  switch (call) {
  case 0:
    memcpy((void*)0x20000140, "veth1_to_team\000\000\000", 16);
    *(uint8_t*)0x20000150 = 1;
    *(uint8_t*)0x20000151 = 0x80;
    *(uint8_t*)0x20000152 = 0xc2;
    *(uint8_t*)0x20000153 = 0;
    *(uint8_t*)0x20000154 = 0;
    *(uint8_t*)0x20000155 = 0;
    syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x8924, /*arg=*/0x20000140ul);
    break;
  case 1:
    res = syscall(__NR_socket, /*domain=*/0x10ul,
                  /*type=SOCK_SEQPACKET|SOCK_DGRAM*/ 7ul, /*proto=*/0);
    if (res != -1)
      r[0] = res;
    break;
  case 2:
    syscall(__NR_pipe2, /*pipefd=*/0x20000140ul, /*flags=*/0x80ul);
    break;
  case 3:
    syscall(__NR_fcntl, /*fd=*/r[0], /*cmd=*/0x10ul, /*arg=*/0ul);
    break;
  case 4:
    memcpy((void*)0x200000c0, "/dev/fuse\000", 10);
    res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
                  /*file=*/0x200000c0ul, /*flags=*/0x42, /*mode=*/0);
    if (res != -1)
      r[1] = res;
    break;
  case 5:
    memcpy((void*)0x200020c0, "./file0\000", 8);
    memcpy((void*)0x20000100, "fuse\000", 5);
    syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200020c0ul,
            /*type=*/0x20000100ul, /*flags=*/0ul, /*opts=*/0x20002140ul);
    break;
  case 6:
    memcpy((void*)0x200020c0, "./file0\000", 8);
    syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200020c0ul, /*type=*/0ul,
            /*flags=*/0ul, /*opts=*/0ul);
    break;
  case 7:
    syscall(__NR_write, /*fd=*/r[1], /*arg=*/0ul, /*len=*/0ul);
    break;
  case 8:
    *(uint64_t*)0x200062c0 = 0;
    *(uint64_t*)0x200062c8 = 0;
    *(uint64_t*)0x200062d0 = 0;
    *(uint64_t*)0x200062d8 = 0;
    *(uint64_t*)0x200062e0 = 0;
    *(uint64_t*)0x200062e8 = 0;
    *(uint64_t*)0x200062f0 = 0;
    *(uint64_t*)0x200062f8 = 0;
    *(uint64_t*)0x20006300 = 0;
    *(uint64_t*)0x20006308 = 0;
    *(uint64_t*)0x20006310 = 0;
    *(uint64_t*)0x20006318 = 0;
    *(uint64_t*)0x20006320 = 0;
    *(uint64_t*)0x20006328 = 0;
    *(uint64_t*)0x20006330 = 0;
    *(uint64_t*)0x20006338 = 0;
    *(uint64_t*)0x20006340 = 0;
    syz_fuse_handle_req(/*fd=*/r[1], /*buf=*/0, /*len=*/0, /*res=*/0x200062c0);
    break;
  case 9:
    syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0ul,
            /*flags=O_SYNC|O_WRONLY*/ 0x101001, /*mode=*/0);
    break;
  case 10:
    memcpy((void*)0x20000040, "/dev/nullb0\000", 12);
    res = syscall(
        __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000040ul,
        /*flags=O_DIRECT|O_CREAT|O_CLOEXEC|O_RDWR*/ 0x84042, /*mode=*/0);
    if (res != -1)
      r[2] = res;
    break;
  case 11:
    memcpy((void*)0x20000080, "/dev/loop#\000", 11);
    res = -1;
    res = syz_open_dev(
        /*dev=*/0x20000080, /*id=*/0x47ffffa,
        /*flags=O_NONBLOCK|O_NOFOLLOW|O_CREAT|FASYNC|O_APPEND|0x100002*/
        0x122c42);
    if (res != -1)
      r[3] = res;
    break;
  case 12:
    *(uint32_t*)0x20001ac0 = r[2];
    *(uint32_t*)0x20001ac4 = 0;
    *(uint64_t*)0x20001ac8 = 0;
    *(uint64_t*)0x20001ad0 = 0;
    *(uint64_t*)0x20001ad8 = 0;
    *(uint64_t*)0x20001ae0 = 1;
    *(uint64_t*)0x20001ae8 = 0;
    *(uint32_t*)0x20001af0 = 0;
    *(uint32_t*)0x20001af4 = 0;
    *(uint32_t*)0x20001af8 = 0;
    *(uint32_t*)0x20001afc = 4;
    memcpy((void*)0x20001b00,
           "\x33\x9f\x02\x0b\xbe\x82\xb3\x98\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x0d\x0e\xc0\xc1\xb4\xe9\xb1\xc4\x36\x9d\x03\x74\x02\x50"
           "\xce\xaa\xc5\x94\xb1\xb3\xd7\x41\xdd\x17\xc1\xc5\x0d\x38\xef\x2a"
           "\x56\x5e\xf1\xe8\x33\x23\x69\x1c\x58\xd6\x65\x00\x00\x00\x00\x00",
           64);
    memcpy((void*)0x20001b40,
           "\xa9\x10\x39\x39\xc7\x87\xa1\x6c\x1c\xa4\x3f\x80\x02\x6d\x1a\x85"
           "\x54\xfe\x58\x1b\x59\xde\xd1\x30\xe0\x4d\x52\x85\x39\xf3\xd3\x28"
           "\x97\x37\xf0\x37\x4c\x72\xa9\x64\xa0\x24\x47\xa7\x5d\xf8\xa6\x9e"
           "\xa9\x17\xde\xb7\xba\x19\x3b\x3e\x77\x72\xfd\x29\xf3\x52\x39\xd2",
           64);
    memcpy((void*)0x20001b80,
           "\x24\x43\x1a\x1e\x77\xa6\x8e\x17\x4f\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x10\xe2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
           32);
    *(uint64_t*)0x20001ba0 = 0;
    *(uint64_t*)0x20001ba8 = 0;
    memset((void*)0x20001bb0, 0, 64);
    syscall(__NR_ioctl, /*fd=*/r[3], /*cmd=*/0x4c0a, /*arg=*/0x20001ac0ul);
    break;
  case 13:
    res = syscall(__NR_dup, /*oldfd=*/r[3]);
    if (res != -1)
      r[4] = res;
    break;
  case 14:
    *(uint32_t*)0x200030c0 = 8;
    memcpy(
        (void*)0x200030c4,
        "\x50\xad\x59\x87\x29\x7e\x64\x54\xdd\x86\xa2\xfc\x71\xbc\x54\x56\xfe"
        "\xf0\x49\x05\x62\xd7\x1c\xb2\xa4\xb9\x3b\xf4\xda\xd6\x4e\xe3\x56\x70"
        "\xfa\x9d\xb9\x85\x4e\x1f\x25\xa2\xf9\x16\x89\xe9\x77\xaf\x5d\x10\x54"
        "\xdb\x28\x77\x0a\x06\x78\x76\x09\x07\xf3\x96\xc2\xb6\x15\x7d\x74\x71"
        "\x43\x88\xcb\x5c\x12\x49\xbe\x4f\xc1\x55\x14\xed\x0b\x05\x3a\x05\x70"
        "\xa5\xff\xf8\xf5\xdf\xf4\xc8\x4a\xe4\x3c\xe0\x88\x89\x95\x3c\xf0\x22"
        "\xc5\xe3\xa0\xcc\xc9\xee\x06\xb4\xaf\x59\x30\x99\x74\x65\x99\x8b\x4d"
        "\x59\xeb\xcd\x30\x8d\xc3\x79\x12\xd9\xf2\x2d\x1f\x6a\x4a\xca\x40\x71"
        "\xc0\x9b\x1c\x90\x37\x09\x32\xde\x6d\xe0\xc9\x8d\x1b\xb3\xa3\xef\xf4"
        "\x8a\x2b\x15\x38\x0e\x7f\xaa\x3d\x99\x75\x6a\x77\xb8\xf5\x14\x26\x30"
        "\x67\xdb\x00\x7a\x87\xb2\xbb\xdf\x32\x45\x59\x2f\x51\x27\xae\xcd\x55"
        "\xf4\xcb\x7f\x24\xa9\x25\x46\xd7\x29\x96\x09\x7d\x4f\xe8\xab\x5c\x41"
        "\x1a\xbd\x74\x5c\xc0\x6c\x18\xd2\x29\xe0\x09\x2c\xa7\xb3\x9d\x69\x86"
        "\x51\xdf\xe5\x05\x45\x01\x0d\x0d\xf5\xa9\x87\x2b\x04\x8d\xff\x0b\x9f"
        "\xe4\xaf\x94\xb4\x08\x5d\xd8\x61\x6c\x7e\x4d\x7b\x95\xfe\x4a\x1f\x61"
        "\xc4\xf1\xef\x3b\x54\xcf\xb5\x49\x6a\x62\xcd\x79\x38\xb1\x88\x38\xeb"
        "\x2e\x79\x34\x36\xb3\x89\x77\xc1\x36\x65\xe6\x25\x7f\xe4\xf1\xa6\xa4"
        "\x35\x26\xe7\xf2\x5a\x1f\xb6\xcf\x94\x13\xe1\x34\xb0\xc7\xd8\x51\xe0"
        "\x9b\x3e\x1c\x23\x1c\xd0\x06\x5d\xa2\x06\x1b\x66\xbc\x3f\xcc\xa9\xae"
        "\x59\xe1\x91\xfc\x22\xa8\x97\x17\x6c\x25\xcc\xa5\xd3\xc5\x78\xfd\xb1"
        "\x34\x1b\xa1\x7d\x14\x81\xdb\x4f\xc9\x25\x8f\x21\x04\xb8\x00\x85\xe7"
        "\xe3\xa9\x6a\x81\xca\x06\x61\x17\xec\xab\x29\xc8\x61\x2c\x63\x68\x91"
        "\x5b\xdb\x93\xf9\xc3\xc7\x71\x9d\xec\x11\xac\x06\x29\x1c\x46\x14\xcd"
        "\x04\x6e\x16\x8c\x62\xf1\x4b\x4f\x94\x5b\x17\x62\x60\x1c\xd9\x3d\xc2"
        "\x14\x53\x90\xad\x6e\xef\x52\x09\xcd\xa1\xec\xbc\x71\x22\x9c\x5a\x73"
        "\x4e\x91\xda\xd9\x90\xe7\x90\x77\x77\x9d\xae\xb3\x0e\x50\x0b\xb5\xdc"
        "\x52\x08\x7b\xe2\x38\x34\x45\x1e\x73\x26\x52\xba\xf4\x67\xbd\xee\x7b"
        "\xb0\x9c\x39\x54\x39\xec\xfb\x2d\x75\xa4\x75\x92\xa6\x18\xe9\xdd\x9c"
        "\xb1\x55\x10\xa9\xe7\x25\x7d\x22\x53\x0e\x80\xd3\x03\x42\xf9\xa8\x53"
        "\x23\x98\x01\x9a\xb8\x30\xef\xbf\x07\x4d\x61\x4d\xdc\xf2\xd8\x1f\x55"
        "\xb9\x6e\x1c\x35\x57\x70\x44\x52\x54\x16\xae\xa0\x4c\x66\xee\x36\xfe"
        "\x35\xa3\x7e\x27\xbf\x97\xc2\x31\xd8\x0b\x98\xc1\x21\xaf\xc7\xa6\x52"
        "\xac\x3d\x3b\x44\xa5\x8a\x41\xe4\xcb\x81\xcc\xd5\x1c\xf6\xf8\x73\x0b"
        "\xcb\xee\x10\x28\x1c\x5c\x7c\x82\x33\x1c\x2d\x3e\xb6\x3d\x79\x79\x68"
        "\xa0\x47\xa9\x42\x94\x2c\xd6\x29\x8b\x71\x57\x94\xef\xce\x72\x82\x37"
        "\x39\xd9\xf9\x64\xdd\xda\xf4\xe2\xc4\x1f\xc0\x15\xf6\x80\x1f\x00\x26"
        "\x30\x98\x70\x7e\x03\xb6\x7d\x4c\x0c\x1e\x7b\x8d\x11\x4d\xbe\x63\x5c"
        "\x03\x96\x4d\x24\xbd\xbf\xe0\x37\x65\xcf\x01\x99\xc2\xfe\xe5\xe9\xb6"
        "\xb1\x80\x7d\x8d\x0f\x4d\xb1\xe8\x4d\x49\x22\x00\xe1\x52\x93\x50\x1a"
        "\x45\x7a\x78\x1e\x7f\xf8\xb4\x01\x65\x11\xd0\x88\xa5\xe8\xe7\x35\x4f"
        "\x0b\xd2\xa2\x51\x03\x83\xdd\x5d\x0e\x08\xa6\x5d\x62\x70\x1a\x92\x39"
        "\x68\x16\xdb\xbf\x16\x70\x6f\x19\x0d\xb4\x8d\xd0\x78\xf1\xf0\xd7\x7f"
        "\xca\x58\xbd\x2a\x3c\x69\xcd\xba\x84\x0c\xb2\x9f\x14\xdf\x34\xed\x7c"
        "\x3f\x29\xaf\x12\x46\x67\x0b\x65\x77\x3f\xe5\xe7\x52\x42\x34\x7a\x14"
        "\xa5\xe3\x33\x7e\x89\xb1\xb2\x98\xd5\xf6\xfe\x75\x5d\x2f\x58\x31\xb7"
        "\xd2\xcd\xd6\x9a\x10\x22\xa7\xa8\xb4\x1c\x74\x91\xb5\xb7\xf2\x52\xa6"
        "\x07\x74\x4e\x4f\x7b\xb1\xa0\x96\x79\x03\xe4\x04\x95\x17\xe6\x12\xe0"
        "\x24\x7c\x7a\xa8\xbe\xc8\x15\x12\x1a\x84\x67\xda\xdb\xde\x24\x24\x66"
        "\xbf\xc4\x10\x65\x25\xae\xb7\xe8\x98\x69\xeb\x53\x26\xfb\xdb\xfd\xb8"
        "\x0c\xd9\xfc\x06\xd2\xa4\x88\x81\x0f\x32\x28\xcc\x22\x66\xd2\x2d\x82"
        "\xc5\x78\xa9\x16\xc1\xe1\xa8\x6c\x28\xd5\x90\xb9\x58\xe0\xbd\xad\xd6"
        "\x06\xef\x23\x64\xc7\xab\x54\x2c\x93\x4c\x57\xab\x43\x6f\xb5\x55\xb4"
        "\xb0\xa8\x59\xa6\xe3\xe9\xdb\xfd\x31\xfd\xc4\x20\xc3\x37\x35\xb0\xbe"
        "\x7c\xba\x66\xe2\x38\x9f\xf4\x90\xff\x3e\x20\xe1\x35\x01\x1b\x08\x05"
        "\x86\xb7\xde\x20\x94\x2b\xb4\x6d\x28\x1a\xf2\xd0\x5a\xc2\xe3\x90\x73"
        "\xc2\xdd\x92\xe5\x43\x4c\x9e\x87\xc7\xdd\x0f\x81\xbd\xc0\x89\x64\x4a"
        "\xd1\xe7\x22\x6c\x76\x93\xa4\xe1\x16\x0f\x8e\x8e\x41\x0b\xdb\x9c\x5c"
        "\x40\xca\x2e\xc7\x6a\x3f\x39\xd1\x45\x70\x1d\x1f\x2b\x54\x84\xe9\x9b"
        "\x47\x3c\xf6\xa9\x3c\xe8\x6f\xf7\xd7\xcb\x20\x7f\xa3\x83\xf6\xc0\x4f"
        "\x6d\x8a\x79\x43\x6e\x5e\xc9\x6b\x82\x51\x7d\xa7\xfb\xa5\xd2\xe1\xe8"
        "\x04\xf8\xed\x01\x1f\x76\x6e\x23\xba\x72\x51\x72\xc4\xef\x0a\x32\xc2"
        "\x9e\x63\x45\x4e\x38\xbe\xd6\xb5\xf8\xbf\xd1\x50\xe4\xbd\x33\xd5\x8a"
        "\xda\x4d\x93\xc1\x76\xcd\x6c\x94\xfd\x36\xf1\x60\xb4\x31\x51\x3a\x4c"
        "\xcc\x1f\xaa\xf0\x4d\x33\x5a\xbc\x2a\x03\x61\x04\x8c\x30\xee\xce\x0c"
        "\x8b\x3c\xe6\x63\x73\xa6\x81\xbb\x2b\x91\x12\x3e\x76\xbe\xfc\x75\xb6"
        "\xe8\xfc\x98\x04\x53\x33\xf1\x64\x73\xe7\x51\x7d\x86\x90\x82\x08\x85"
        "\xf3\x0a\xcb\xfe\x2d\x6f\x82\xf4\xd2\x16\x0c\x8f\xee\xfc\x5f\xe5\x6d"
        "\x6d\xc9\x21\xfb\x6f\x5f\x6c\x75\xdc\x5b\xf2\xaa\x57\x81\xaa\xf9\xfb"
        "\x3f\xf1\x8d\x25\x28\xb0\xbe\xf8\xf3\x29\x70\xd0\xec\xb2\x48\x5d\xcd"
        "\x1a\xf8\x3c\x99\xfe\x66\xdd\xaa\xce\x78\xb8\x89\x82\x7d\xaa\x5e\x9d"
        "\x32\x5d\xe1\x69\x91\xeb\xbf\xa3\x3b\x9b\x9c\x2a\x0a\x33\xbc\x48\x6d"
        "\x4e\xb7\xbf\x56\x04\x03\x61\x94\x08\xe6\xde\x35\xb2\x55\x31\x08\x68"
        "\x01\x4f\x34\x2e\x8a\xf2\x20\xb5\x2f\xd4\x72\xea\x91\xd7\x59\x00\x5a"
        "\x1c\x20\x02\x94\x96\x6b\xd9\xfb\xd0\x2b\x5a\xd3\xd0\xac\xd2\x12\xf9"
        "\xe9\xf8\x24\x43\xf3\x5e\xe9\x50\x49\x6a\x1c\x3b\xc5\x1e\xfb\x14\x40"
        "\x48\x22\x8c\xde\x54\x3f\xe7\x6e\x54\x69\x87\xcd\xb3\xcd\x48\x24\xe4"
        "\x6b\xe1\x56\xfc\x0a\xc6\xd4\xd0\x93\xd5\x04\x8a\xda\xdb\xca\xc9\x48"
        "\x33\x0e\x7c\x52\x02\xc6\x8f\x4f\xa6\xe9\x97\x51\x1a\x3c\x7b\x5e\x11"
        "\xf3\xa8\x07\x17\xce\x28\x6c\x80\x74\x31\x24\x6e\x9f\xde\xe0\x64\x81"
        "\xb3\xd8\x85\x22\x30\x32\x1a\xad\xfe\x5e\x7e\x76\xa9\x70\x64\x6c\x57"
        "\xbd\x3d\xd5\xbb\x5a\x71\x1b\xdf\xea\x83\xc3\xc9\x11\x44\x95\x97\x86"
        "\xd8\x90\xa4\x4d\x20\xc8\xc5\xa6\x1c\x66\x3a\xf8\x85\xfa\xdf\xd2\x83"
        "\x36\x94\xa0\x45\x01\x11\x74\x17\x0c\xb8\x29\xec\xb3\x6b\x77\x07\xa3"
        "\x36\x82\xdb\x3b\x80\xd7\x3a\x48\x54\x01\x7f\x58\x69\x1b\x91\x10\x1f"
        "\xa9\xf6\xd9\x25\x8e\x14\x03\xe4\xf3\xcf\x27\x29\xdc\xc5\xae\x4e\x30"
        "\x71\xa3\x7a\x4b\xcc\x27\x32\xff\x10\xa0\xa6\x3a\x4f\xfb\x26\xc0\x1f"
        "\x7f\xdb\xc9\x09\x3f\x22\xa4\x18\x84\xf9\x49\x72\x31\xfa\x57\x21\x0f"
        "\x19\xa2\xe4\x53\xa3\x5c\xaf\xa5\x04\xbd\x3c\x93\xe6\x5b\xaf\xd7\xec"
        "\x52\xdd\x4c\x65\x2c\x4f\x13\xe4\xec\x65\x85\x30\x67\x4c\x3e\x3b\x38"
        "\xf9\x10\xb1\x02\xd2\xb7\x4d\x0e\xfc\xec\x34\x60\x5a\x88\x8a\xf2\xa6"
        "\x25\x9d\x65\x4d\x5d\xe5\x2e\x43\x13\x2d\xfb\x8f\xfd\xa2\xb1\xe0\x58"
        "\x8c\xe7\xaa\x53\xbc\x63\xc1\xa4\x2f\xde\xce\xd1\x9e\x9b\xf0\xb4\x9b"
        "\x77\x0f\xc3\x6c\x0b\x98\x54\x16\xdc\x6e\x72\x60\xca\xa5\x09\x92\x33"
        "\x88\x6c\xe0\xc2\xc3\x1f\xe5\xbb\xa3\x2b\xd3\x33\x98\x56\x33\x25\x9a"
        "\xf9\x62\xa0\xde\xe2\xef\xa8\x10\x03\x6b\xf2\x74\xdc\x2a\x58\x24\xd3"
        "\xdf\x7c\x44\x08\x73\xad\xd9\x16\x53\xd1\x40\x66\x7a\xa1\x5d\x66\x8b"
        "\xce\x2c\x60\x8f\x2d\xab\xe3\xe0\xce\xf4\xb5\x86\x68\x75\x89\xe3\xcf"
        "\x44\xaf\x45\x9d\x0c\xf2\x18\xa9\x64\x4f\x3b\xc4\xd3\xd2\x8e\xa0\x48"
        "\x50\xa3\x28\x9d\x7c\xf3\x72\x29\x49\x5e\xf3\x75\xb9\xd3\x15\x67\x54"
        "\xd7\x90\x3e\x05\x3f\xe1\xdb\xc6\x79\x43\xcf\x8b\xe4\xa5\x01\xf5\x83"
        "\xc5\x2b\xb1\x04\xb7\xa0\x53\x79\xa3\xf0\x44\xdd\x12\xd9\x5e\xb3\xa2"
        "\x64\x63\x08\xee\x33\x1e\xa5\xb8\x90\x93\xa9\x2b\x2e\x59\xc6\x25\xed"
        "\x8f\x01\xcf\x9b\x20\x4c\xb2\x93\x14\xe4\xdf\xb6\xdf\xfa\x1b\x52\x91"
        "\x6f\x85\x18\xc0\xae\x95\x06\x06\x26\xae\xb7\x37\xd2\xd7\xe8\xd4\x00"
        "\x9c\x10\xd5\x3f\x8f\x9d\x1f\xff\x96\x34\xc2\x53\x4b\x60\x88\xd7\x3a"
        "\x9f\xd6\xbb\x80\x7a\x8a\x40\xcf\x8b\xa7\x4a\xd1\x92\xb7\x69\xf4\x84"
        "\x91\xe4\x41\xa1\xe8\xf9\x10\x38\x76\xcf\x76\x68\xdd\xb5\x62\x08\xe5"
        "\x5c\xee\x7b\xb2\x39\x9b\x99\x73\xf9\x60\xe6\x37\xd2\xed\xcf\x1e\x3f"
        "\x8d\x98\xc5\xf2\x41\x7d\x83\xe6\xee\x35\x6e\xcc\x7d\xeb\xa8\x9d\x28"
        "\x9e\x61\x68\xb0\xee\x1d\xf3\xb6\x67\x75\x3d\xcd\x1c\x90\x7b\x77\x18"
        "\xf8\xe2\xb2\xea\x49\xfe\x2a\x6d\x2f\xfe\x80\x33\xbc\xfe\xb6\x37\x78"
        "\x12\xc7\xeb\x98\x72\xfa\x7a\x8d\xe3\x9b\xf5\x25\xd2\x5c\xf8\x59\x70"
        "\x52\xa2\xfd\xf4\x65\x31\x36\xbe\xbb\x99\xbe\xfe\xb9\x76\xf2\xdb\xe6"
        "\x95\xd4\xfe\xec\x87\xa4\x43\x33\xe6\xe0\xad\x4c\xb7\x7c\xd9\xa5\x6f"
        "\x71\xbd\x23\x9d\xcf\xa0\x61\x12\x07\x29\xc2\x74\x29\x91\x59\x38\x98"
        "\x87\xf2\x3e\x3d\x64\xbd\x57\x85\x36\xdd\xaf\x27\x49\x21\x7b\xbd\x50"
        "\xf5\xe1\x0a\x9c\x88\x7b\x6a\x64\xbd\x38\x87\xcb\xb6\xa2\x7d\xab\xd3"
        "\x6a\x2a\x0a\x24\x54\x6d\x17\x2a\xb3\x6f\x65\x2c\x62\xc2\xfa\x0b\x26"
        "\xff\x03\x19\xdc\x54\x49\x39\x65\xff\x8b\xec\x82\xec\x62\xd6\x56\xd2"
        "\x68\xa9\xce\x6c\xc2\x2e\xee\x6f\x22\xb8\xbe\xd7\xe1\xc8\xb1\x0e\x62"
        "\x14\xa0\xf5\xc9\x0e\xb7\xc6\xfc\xc5\x45\x82\xf3\xc4\xee\xda\xd3\xa4"
        "\x61\xd1\xd6\xcb\x21\x20\xc5\x90\xca\xb2\x67\x6a\x50\x6d\x80\x73\x34"
        "\xa7\x36\xfc\xc6\x9a\x31\x6c\x41\x33\xce\xf1\x85\x82\x7f\x99\xb5\xab"
        "\x41\x0b\x94\x7f\x70\x76\x2e\x7f\xce\xa8\x38\xd2\x89\xaf\x39\x35\x4b"
        "\x8e\xa1\x7d\xb1\x57\xc7\xae\xea\x32\x2c\x71\xa7\xc5\x8d\x9d\xaa\x70"
        "\xe0\xec\x70\x64\x9c\x22\x7d\x4e\x3e\xf2\x68\xe3\xf2\xba\xf6\xc8\xd4"
        "\xfe\x27\x25\xc6\x17\x44\x8e\x28\x10\xe0\xdf\xd8\xbf\xa3\xa8\x0a\xf3"
        "\xdc\xd3\x6b\x1a\x76\x40\xcb\x19\x28\xd3\x50\x90\x9c\xe2\x20\x64\x64"
        "\x08\xa6\xb9\xd9\x62\xd7\x92\x01\x64\xc4\x2b\xf1\x87\x26\x57\xb5\x9e"
        "\x05\x7b\x8f\xa1\x18\x5b\xd8\xdb\x8a\x19\x05\x48\x45\x1a\x1c\xb8\x88"
        "\x5e\x19\xce\x27\x08\xc2\x14\x3e\x3d\x60\x4d\x96\x54\xa6\xd5\x61\xab"
        "\x45\x60\x08\x91\x0e\xa4\x24\xd2\x27\x94\x44\x3b\xf5\x75\x82\x0a\xea"
        "\xfc\xd8\xc1\xd9\x91\x3e\x01\xd2\xda\x47\x1c\x57\x0f\x65\xe8\x1b\xb8"
        "\xc6\x82\xd3\x6f\x74\x8f\x31\xea\xfd\x41\x10\xae\x7d\x05\xeb\x98\x87"
        "\x1a\x72\x2c\x62\x3a\x48\xbf\xf2\x39\x15\xf2\x41\x5a\x7d\xa1\xdc\x96"
        "\xb4\x44\x70\x47\xaf\x91\xba\xd3\x15\x23\xad\x42\x9c\x0c\x7a\xb5\xc6"
        "\x03\x67\x1a\x98\xb9\x53\x94\xd9\xd5\x24\xf8\x24\x57\x28\xf6\xc8\x07"
        "\xc3\x06\x8a\x66\x5f\xca\x4c\xf3\xe9\x90\xd8\x55\xfa\x52\x3d\x1c\x94"
        "\x80\x59\xca\x10\xaa\x79\xe8\x4b\x3c\x4e\x20\x82\xf5\x07\x98\x5a\x64"
        "\x41\x48\x12\xbb\x2e\x28\xad\x00\x57\xb7\x7d\x38\x6f\x99\x84\x79\xc5"
        "\xe8\xae\xa1\x14\xe6\x1a\x1a\xf9\x4a\xba\x04\xab\x46\x9b\x48\x1d\x25"
        "\xfa\x21\xbb\xfc\x0b\xe7\xf4\x10\x06\xa8\xe6\xed\x75\xd6\xfc\x97\xb1"
        "\xce\x0e\x60\x9c\x95\x8d\xad\x6b\xdd\x72\xe8\xc4\x35\xae\x1f\x5b\x44"
        "\x8f\x76\x46\x65\x7b\x5d\x77\x9d\x06\xf8\xf2\x90\x1e\x35\xa7\x13\xa6"
        "\xe2\x8b\x8c\xa7\x0f\xd1\xa3\x0f\xed\x0c\x62\x54\x90\xe8\x8e\x07\xa3"
        "\xbc\xf9\x32\xf7\x17\x56\x28\xf5\x6c\x05\x90\x1d\x40\x28\xcd\x06\x01"
        "\x87\x89\x87\xfd\x26\x89\xf5\xd1\x3c\xf3\x97\xc6\xa8\x1b\x91\x6e\xd3"
        "\xa6\xc0\xee\xec\x2d\x03\xc9\xf7\x2f\x1f\xed\xb4\x8d\x98\x72\x77\x70"
        "\x1c\x32\x97\x7c\x73\x4f\x3c\xbb\x49\xcc\x22\x02\xed\xe4\x64\xd5\xa3"
        "\x5d\x09\xb6\xba\x4f\x21\xdb\xe9\x67\xd6\xe7\x7f\x1f\x3a\x29\x88\x67"
        "\x28\x7c\x85\x34\x8c\xfd\xbc\xe9\x83\x92\x4d\x8a\xc8\x4d\xbb\xde\x40"
        "\x53\x0b\xc9\xa6\x25\x5f\xb9\x03\xf5\x90\xe1\xfd\x37\x7e\x17\x16\x3e"
        "\x41\x6d\xcc\xd8\xd1\x40\x1f\x4b\x7c\x53\xd0\xcc\x8e\x81\x32\x1b\x1d"
        "\x74\xda\x31\x3e\xd6\xc5\xf6\xae\xb6\xe3\x9c\xfe\x55\xfe\x6b\x1a\x71"
        "\xde\xb9\xbf\xc9\x9b\x96\xfc\xd4\xae\x12\xa5\xf3\xeb\x9f\xd6\x04\x1c"
        "\x92\x30\xb7\x34\x73\xed\xff\x8e\xc9\x08\xc5\xdf\x4d\x0f\x8f\x4d\x88"
        "\x7c\xaf\xaa\x67\x59\x69\x0e\xdf\xe8\x25\x8e\xa9\x0d\x18\x71\x14\x3e"
        "\x46\xc0\xb1\x85\xae\x73\x51\x45\x7e\x86\x1c\x1a\x94\xac\xd3\xc2\x32"
        "\xe2\x3b\x50\x93\x6a\x86\x13\x2f\xeb\x76\x27\x94\x06\x40\x42\x9f\xcc"
        "\xba\xbd\xf6\x15\x0e\xb4\x2f\x00\x4d\x40\x2d\x3d\x1f\xbf\xb2\x59\x6a"
        "\x6d\x90\x76\xbe\xd3\x80\x79\x69\x9d\x8b\xb6\xd2\x35\x7c\x58\xf3\xa4"
        "\xc6\x3a\x47\x71\xe9\x7f\x3a\x1b\xaf\x62\xce\x65\x1c\x68\x4e\x93\x1e"
        "\x46\x15\xb1\x97\xde\x05\x62\xb5\x75\xe5\xfd\x8b\xa3\x7b\x86\xac\xe4"
        "\x14\x71\xda\x16\xc0\x7d\x94\x66\xda\x4f\x84\x52\xbd\x34\x51\x4c\xd9"
        "\x47\xaf\x34\xfb\x41\x9e\x40\xc4\xe1\xa0\x81\xc1\x08\x68\x73\x06\xee"
        "\xfe\x35\xe5\x40\xd4\x54\x6a\x21\x03\x83\x8f\x70\xde\x39\x08\x50\x91"
        "\x29\x3d\xba\xc2\x95\xd9\x93\x10\x8f\x59\xf3\xf9\xd0\x29\x55\x4d\xec"
        "\xe5\x78\xde\xf0\x3b\x69\x9b\xaf\x79\x77\x9b\xcb\xfa\x10\x40\xf0\xa8"
        "\x7c\x43\x3f\xa6\x1f\xee\x97\x2e\xb1\x65\x6f\x89\x92\x11\x55\xa1\x8f"
        "\xac\xa6\xc5\x2e\x80\xe6\x73\x73\xb4\xa1\x7b\x24\x19\xc7\x2b\xce\x54"
        "\xb9\x9e\xab\xf8\xde\x8e\xd8\x57\x52\x4f\xee\x3b\xa8\x2f\x0f\x1d\xb4"
        "\xae\x4c\x03\xcd\x58\x21\x30\x9c\x9b\x43\xbd\x8b\xe3\xb4\x2a\x28\x06"
        "\xdc\x11\x88\x80\x8b\x52\x8e\x65\x07\xdf\xed\x95\x6c\x13\xa3\xd8\x73"
        "\x09\x92\xb3\x9b\x16\x87\xc9\x4c\x97\xbc\xa3\xb0\x9a\xee\x76\xe4\x6d"
        "\xac\xcb\x87\x8c\xe2\x8b\x09\x09\x37\x83\xd0\x8b\xd6\x4e\x52\xfd\xce"
        "\xf5\x68\xbd\x4d\xcc\x8b\xed\x9f\x9a\xd1\xba\xf3\x26\xcd\x60\xc6\x40"
        "\x85\x87\x8a\xc0\x79\xd8\x2c\xbf\x04\xe5\xa8\xdc\xcc\x56\x37\x54\xff"
        "\x8c\xba\x4a\x4d\x19\xd0\x6d\xb0\xf2\xac\xfa\x7f\x34\x2a\xc8\xea\x29"
        "\xac\xf3\x81\x8f\x09\xc7\xca\x97\x63\x94\x41\x41\x1a\x19\xc2\xeb\x28"
        "\x42\x8b\x0f\xe0\x0f\xb3\x0d\xb2\x9c\x81\x62\x2a\x35\x49\xc0\xf9\x5b"
        "\xab\xeb\xbe\x22\x08\xa3\xf3\xd1\xac\x6f\xa8\x25\x7e\x01\x9a\x6b\x1d"
        "\x44\x27\x2b\x52\x45\x65\x72\xaa\x4a\xd0\x8a\x91\xf8\x68\xc1\x06\x76"
        "\x1a\x1f\x0e\xf7\xb5\x2c\xa0\x3b\x2b\x20\xc7\xc7\x9f\x91\x17\x42\x7a"
        "\xf0\xaf\x6f\x0d\x0f\x28\x1e\x29\x47\xec\xee\x0b\xe7\x2c\xa8\xbd\x63"
        "\xf7\xb9\xfe\x88\x73\x42\xf0\x84\x13\x15\x3a\x12\xe6\x9c\xc7\x0f\xf1"
        "\xb1\x88\x8f\x2c\x05\x68\x66\x93\xae\xdd\x29\xe3\x4c\x95\x4d\x60\x5a"
        "\x52\x76\x87\x2f\x8a\x2c\x19\xa0\xa4\x0e\x2d\x2f\x8f\xb4\xf8\xb6\x43"
        "\x14\x67\x50\xf8\x5e\x39\x1e\x67\x1b\xb2\x5a\xfc\xcd\x50\x80\x02\xfa"
        "\x47\xfb\x5d\x05\xd3\x5c\x1f\x1d\xe6\x3a\xfa\x0a\x0a\x46\x45\xe1\xae"
        "\x39\xff\x41\x69\x7f\xb2\x86\x1e\x4a\x03\xd6\x14\x8f\x53\xad\x3f\x80"
        "\x03\xa8\x9f\x35\x9f\x87\x7f\xf4\xa8\x0d\x88\xec\x1e\x06\x06\x87\x70"
        "\xbb\xf5\xf7\x86\x55\x92\x6b\x3a\xaf\x29\x1f\x42\x70\xd5\x78\xc8\x20"
        "\xa9\x93\x67\x72\xe5\x07\x81\x39\xd8\x76\xfa\xe7\x22\x8c\x08\xbd\x03"
        "\x72\xde\xff\xc9\xd4\x36\xeb\x01\x5c\xc5\x6e\x2d\x62\x6f\x7a\x5b\x55"
        "\xb0\xc0\x23\x6c\x05\x31\x5b\xd0\xd8\xa6\x33\x0d\xfc\xd7\x0f\xd7\xfa"
        "\xdc\x71\x8c\x5d\x21\x3d\xf1\x2d\x72\x4f\xdb\xcd\x98\xc5\xbf\x7f\xcd"
        "\xdc\x24\x54\x5c\xad\xbe\x76\x28\x4d\x05\x63\x4c\xeb\xb8\x49\x0b\x55"
        "\x9d\x7e\x42\xdb\xb5\x14\xca\x8e\x13\x98\x64\xa9\xd7\x0e\x1a\x58\xe4"
        "\x7b\x7c\xd4\x83\xdd\xb3\xb7\x43\xb7\xb2\xcd\xac\xdb\x11\x6b\x2e\x02"
        "\xf8\x84\x15\x49\x5c\x94\x7b\xdb\x5d\x99\x38\xc8\x53\x96\x61\xa3\xfe"
        "\x02\x38\x7d\xdf\x29\xf5\x04\xf9\xed\x86\x1b\x28\x11\x1c\x82\x07\xe4"
        "\x45\x1b\xaa\x93\xb0\x94\xd8\x45\xcd\xb6\x2d\xba\x0d\x89\x50\x0f\xf5"
        "\x34\xe5\x86\x16\x88\x7e\x25\xe9\xc9\xfa\x5b\x19\x14\x08\x92\xe8\xf1"
        "\xac\xaf\x16\xc9\x70\xf9\x05\x18\x78\x5b\xa2\x02\x78\x10\x8f\x27\x21"
        "\xe8\xde\x2a\x0e\x6a\x42\xe5\xb1\x2e\x3c\xdc\x8a\xb7\xb0\x0c\x73\x62"
        "\x95\xac\x73\xf5\x0b\xfb\xd6\x9f\xe6\x75\xd2\x2b\xcd\x2d\xff\xa5\x1e"
        "\x0e\xdc\x00\xf2\x84\x8e\xc3\x27\x23\xb7\x2b\x3c\x9b\x6a\x0a\xd3\xdf"
        "\x92\xec\x92\x92\xca\x13\x1e\x4e\xee\xd9\x52\x26\x1f\x82\x5e\xf8\x54"
        "\x73\x37\xf9\x6e\x52\xd3\x9d\xee\x4d\x7b\x4f\x6e\xf1\xb4\x40\xa3\xd3"
        "\x8a\x3c\x2a\x97\x85\x77\xe7\x86\xf0\xd2\xaa\xdb\xd9\x2d\xf6\x07\x3e"
        "\xe1\xb9\xc9\x5b\xf0\xd6\xbd\x31\x1e\x2a\xa3\x01\x03\x64\x95\x5c\xa4"
        "\x85\xc9\x11\x27\x2e\xdb\x30\x17\xfa\xd2\x16\x1b\x52\x20\x50\x80\xf9"
        "\xa5\x08\xe4\x59\x41\x56\x9b\x43\x7e\x85\x59\x62\xd9\xa6\x03\x97\x25"
        "\x26\x0a\x2f\x34\x87\xaf\x94\xff\xb9\xdb\x83\x8d\x55\xcb\x8f\xa9\x62"
        "\xab\x45\x13\x38\x18\x1e\xf5\xd1\x5d\x79\x9e\xf5\xee\x67\x20\x4c\x3d"
        "\xb6\x06\x36\xb2\xcb\xbe\xbe\xb0\x25\x1e\x93\x94\x74\x3f\x55\x83\xab"
        "\xa2\xf5\x09\x29\x4f\xd1\x1a\x82\xfb\x88\xf2\x38\x6d\x38\x47\xd4\x4d"
        "\x49\xb8\xc6\xf4\x64\x3b\x25\xd1\xad\x8e\xbd\xa4\xd5\x2c\x98\x48\xc5"
        "\x21\xd4\x21\xb2\x37\x50\x45\xc4\x7b\xe0\x3c\xd5\x0a\xc3\x78\x9f\xf8"
        "\x1a\xca\xd8\x5e\xb5\x5f\x05\xed\x45\x20\x18\x06\xf9\x31\x0e\x18\x9a"
        "\x64\xd9\x63\x3d\x23\xa4\x55\xcc\x4e\xf6\x4b\xcd\x3b\x3f\x3f\x39\x78"
        "\xca\xfb\x40\x21\xd2\x34\xde\x23\x35\x33\xd5\x2c\x7d\x43\xb4\x2e\x2f"
        "\x4a\x27\x7c\xa4\x00\xb2\xbd\x53\xdb\x1b\x6e\x6e\x50\x03\xba\x03\x32"
        "\x19\xb0\x53\xad\x44\x24\x0f\xec\x9e\x6f\xdb\x4c\x6d\x1b\xdf\x63\xcc"
        "\xb0\x92\x54\xdf\xa9\x4c\xde\xa7\x34\x92\x5d\xfd\xa7\xf0\xf5\xaa\x22"
        "\x85\x10\x5a\x75\x9b\x5c\x8c\x76\xda\x9d\x12\x2a\xdf\x82\xcd\x2c\xa7"
        "\xc5\x61\xad\x71\x69\x78\xc3\xdb\x38\x24\xb2\x14\xbd\xf8\x5b\x1c\xb2"
        "\x37\xf0\x03\xc0\x51\x4e\x1e\xa0\xed\x73\x9b\x36\xc5\xe6\x87\xc2\x66"
        "\x00\x27\x41\xbc\xd0\x3b\x3e\xbd\xd0\x86\x42\x5d\xd5\xb7\xa6\xcc\x6c"
        "\x5c\x11\x0c\x8b\xfa\xf5\xdc\xf6\x6f\x34\x37\xd8\x3d\x15\xef\xfc\xaf"
        "\x94\x07\x15\xeb\xde\x4b\x2c\xf1\xa9\x6c\x51\x98\xd1\x60\xf4\x7d\x6d"
        "\x7a\xa7\x33\xa8\x01\xa7\x8c\x57\x76\xe4\x9e\x60\x70\x99\x94\xb1\x30"
        "\x6a\x19\x1d\x57\x2f\xb2\x1d\x06\x3b\x44\x94\x48\xd6\xec\x7b\x23\x89"
        "\x62\x13\x46\xd9\x8c\xc8\xe4\xfd\xdf\xc7\xe6\xa1\x1f\x51\x01\x1c\x25"
        "\x78\xd9\x18\xd9\x65\x04\xfd\x20\xd5\xe6\x0e\x3f\xcd\x8e\xd9\xc1\xfc"
        "\x8d\x96\xa6\x36\xf8\xee\x27\x59\x84\xa7\xc4\x17\x08\x31\xaf\xee\x41"
        "\x8f\x68\xd2\x51\xc4\x3f\xcd\x67\xe9\xd0\xfe\x2f\x13\x57\xe9\xd2\xe9"
        "\x0d\xa3\x41\x0d\xd8\x00\xef\xec\xac\x85\x42\xcb\x61\x63\xca\xca\xb7"
        "\xad\x70\x11\x45\x9e\x5c\xcc\xd2\x5b\x6e\x04\x60\x1b\x00\x1a\x84\x73"
        "\x2c\x1e\xc9\xcc\x09\xe7\x26\x87\xfc\x2e\x97\xfd\x34\x4c\x45\xed\xcd"
        "\x0f\x96\x44\x83\x1b\x85\xd7\x95\x58\x41\x06\xc0\x92\x54\x64\xeb",
        4096);
    *(uint16_t*)0x200040c4 = 0x1000;
    syscall(__NR_write, /*fd=*/r[4], /*data=*/0x200030c0ul, /*len=*/0x2000ul);
    break;
  case 15:
    *(uint64_t*)0x200034c0 = 0x200100000;
    *(uint64_t*)0x200034c8 = 0x20000200;
    *(uint64_t*)0x200034d0 = 0;
    *(uint64_t*)0x200034d8 = 0x200002c0;
    *(uint32_t*)0x200034e0 = 0x34;
    *(uint64_t*)0x200034e8 = 0;
    *(uint64_t*)0x200034f0 = 0;
    *(uint64_t*)0x200034f8 = 0x20001300;
    *(uint64_t*)0x20003500 = 0;
    *(uint64_t*)0x20003508 = 0;
    *(uint32_t*)0x20003510 = r[4];
    syz_clone3(/*args=*/0x200034c0, /*size=*/0x58);
    break;
  case 16:
    syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0ul, /*f=*/0ul);
    break;
  case 17:
    memcpy((void*)0x20000100, "cgroup.subtree_control\000", 23);
    syscall(__NR_openat, /*fd=*/-1, /*file=*/0x20000100ul, /*flags=*/2,
            /*mode=*/0);
    break;
  }
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  const char* reason;
  (void)reason;
  if ((reason = setup_802154()))
    printf("the reproducer may not work as expected: 802154 injection setup "
           "failed: %s\n",
           reason);
  for (procid = 0; procid < 4; procid++) {
    if (fork() == 0) {
      loop();
    }
  }
  sleep(1000000);
  return 0;
}