Extracting prog: 13m41.203042477s Minimizing prog: 2h59m16.463915566s Simplifying prog options: 14m8.23366823s Extracting C: 5m13.819199933s Simplifying C: 0s extracting reproducer from 25 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) program did not crash single: failed to extract reproducer bisect: bisecting 25 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6, 9, 10, 20, 15, 33, 28, 6, 14, 3, 5, 3, 8, 2, 9, 19, 2, 6, 19, 2, 14, 6, 4, 4] detailed listing: executing program 2: syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000040), 0x1, 0x5d0c, &(0x7f0000000200)="$eJzs3dtvHFcdB/DfXry+lKZWH6oQcUlTLi2lSeOkTcutqZB4AAGVqrwnMm4VkQJKQkUri7iKxDsSz6j8ETyDUB+LxJ/APxAp7lMFooPGPicZT9bepIl31j6fj+TM/ObseM/k6/Hsemb2BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQP/7Rm6d7EXHx3bRgOeILMYjoRyzW9fGoZ87nxw8j4mhsNcdTEXFkPqJef+ufJyLORsTHRyJub66v1otX7rMfL71x658/ffNnG3/86j/+9d+P/vy3dvsbH/3wJ3+9EbF89A9/+t+NR7PtAAAAUIqqqqpeept/LL2/73fdKQBgKvLxv0rycrVarVar1YevbqrGu9EsImKjuU79msHpeAA4YDbi0667QIfkX7RhRDzWdSeAmdbrugPsi9ub66u9lG+veTw4vt2erwXZkf9G7879HbtNJ2lfYzKtn6+bMYgnd+nP4pT6MEty/v12/he320fpcfud/7Tslv9o+9an4uT8B+38Ww5P/v2x+Zcq5z98oPwH8gcAAAAAgBmW//6/3PH53/mH35T7stf53+NT6gMAAAAAAAAAPGoPO/7fHcb/AwAAgJlVv1evfXjk7rLdPoutXn6hF/F46/FAYdLNMktd9wMAAAAAAAAAAAAASjLcvob3Qi9iLiIeX1qqqqr+amrXD+ph1z/oSt9+KFnXv+QBAGDbx0da9/L3IhYi4kL6rL+5paWlqlpYXKqWqsX5/Hp2NL9QLTbe1+ZpvWx+dB8viIejqv5mC431mia9X57U3v5+9XONqsF9dGw6OgwcACJi+2h02xHpkKmqJ6LrVzkcDPb/w8f+z/3o+ucUAAAA2H9VVVW99HHex9I5/37XnQIApiIf/9vnBdRqtVqtVh++uqka70aziIiN5jr1awbD8QPAAbMRn3bdBTok/6INI+Jo150AZlqv6w6wL25vrq/2Ur695vEgje+erwXZkf9Gb2u9vP646STta0ym9fN1Mwbx5C79eWpKfZglOf9+O/+L2+2j9Lj9zn9adsu/3s7lDvrTtZz/oJ1/y+HJvz82/1Ll/IcPlP9A/gAAAAAAMMPy3/+Xnf/NmwwAAAAAAAAAB87tzfXVfN9rPv//pTGPc//n4ZTz78m/SDn/fjv/1gU5g8b8rdfv5v/J5vrqh18895U8nfn85waj+rnnev3BMF3zU829FZfjSqzFi/c8frij/fQ97XM72lcmtJ+5p31Uty/m9pOxGr+OK/GLO+3zEy6MWpjQXk1oz/kP7P9FyvkPG191/kupvdea1m590L9nv29Oxz3P+Z9/du7evWv6bsbgzrY11dt3ooP+bP2fPDaK315bu3ryd5euX796OtJkx9KVSJNHLOc/l75y/s8+s92ef+8399dbH4weOP9ZcTOGu+b/TGO+3t7npty3LuT8R+kr55+PQOP3/4Oc/+77//Md9AcAAAAAAAAAAAAAAAD2UlXV1i2i5yPi5XT/T1f3ZgIA05WP/1WSl6vVarVarT58dVM13mvNIiL+3lynfs3w+3HfDACYZZ9FxL+77gSdkX/B8uf91dOvdd0ZYKquvff+Ly9dubJ29VrXPQEAAAAAAAAAPq88/ufxxvjPW9cBtcaN3jH+6+tx/JPN9dV3l//z5QM3/md/NNga6zxt0NOx9/jfJ2Lv8b+HE55vbkL7aEL7/IT2hQntY2/0aMj5P50yzvkfSxu21/ivOf/2dMJTdmqv8V+f7aA/Xcv5n0hjPef8v9l6XDP/6i8Hefzf/o78T11/5zenrr33/guX37n09trba786c3bl1dMr586+8uKpty5fWUv/dtjj/ZXzz2Nfuw60LDn/nLn8y5Lz/3qq5V+WnP83Ui3/suT88+s9+Zcl55/f+8i/LDn/51It/7Lk/L+VavmXJef/fKrlX5ac/7dTLf+y5PxfSLX8y5LzP5lq+Zcl538q1fIvS84/n+GSf1ly/vnKBvmXJee/kmr5lyXnfybV8i9Lzv9squVflpz/S6mWf1ly/i+nWv5lyfmfS7X8y5LzfyXV8i9Lzv/VVMu/LDn/76Ra/mXJ+X831fIvS87/e6mWf1ly/t9PtfzLkvP/QarlX5ac/2upln9Z7n7+vxkzZszkma5/MwEAAAAAAAAAAAAAbdO4nLjrbQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+D87cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsLOvcXIWd5nAP/2ZK8NsTeJIRwM2MaAgcW7PuBDWycGQkqhbQgJ6YnUuPbaOPGpXpuTkNgImiKBVC64oJWSAkJVLloFtYkaJBpxUalNb9qr9qZKKzWqUBQqJ+pNo4Kjb+Z9X8/MrudbYw+Z+d7fL8J/e+ebmXe+eWd2n42eAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGi19q6ZPx4qiqL8r/HHRFFcWv59WbG7/Ofctl/0CgEAAIAL9V7jz79cmb6wexFXajnmH67952+fOXPmTFH82apPvFTOYE1RrFhaFM3LgvEfHW87JnimGB8abvn3cMXdj1RcPlpx+VjF5UsqLl9acfl4xeXzTsA8y5q/j2nc2PrGXyeap7RYVYw1Llu/wLWeGVo6PBx/l9Mw1LjOmbEDxaHicDFTTM+7zlDjf0Xx1tryvu4p4n0Nt9zX6qIoTv/kqX1xDUPhHK8v2u6sofW5e/eOYs1Pf/LUvkcnfnbNQrPyNMxbaVFsWFeu89miOPvrqmKoWJrOSVzncMs6Vy+wzpG2dQ41rlf+vXOdpxe5zvi4x8M6/6XLOleHrz1+fVEUc8U5j+n0TDFcLO+413S+x5s7oryN8qn8WDF6Xvtk7SL2SXmdH17fvk8692Q8/2vDORk9xxpan453v7pk3nn/oPukfNT9sFfL276/vNPx8dZfrbbt1fKYp2449x5Y8LlbYA+kvdyyB9ZV7YHhJSONPTB8ds3r2vbApnnXGS6GGvf1zg3d98DUySPHp2afePK2Q0f2Hpw5OHN0y9bNOzdt3r51x/TUgUOHZ8Kf53dKB8jyYjjtwXXhvSbuwZs6jm3dkmdebb4OXrly+7ULzfNZw/hFeh1cyBqKsF++cGO5oEuHi3Ps8fKYZzdc+Osgfd9veR2MtrwOFnxPXeB1MLqI10F5zOkNi/ueOdry30JrWOi98GLsgYmWPXAh3w9b1/BBvh+W9/nQzed+L1wd1vXcLef7/XBk3h6ID2sovPbKr6Sf98Z3hPMyf19cVV5wyZLi1OzMiY2P7z158sSmIowPxcdbnqvO/bK85TEV8/bL8Hnvl92ffX/7VQt8fSKcq/Fbuz9X5TFbJ7s/V41394XPZ9tXNxdhXGQf9vlc6LtZeT5TluhyPstjnr3twn8WTLmk5f1vrOr9b2RstPn+N5LOxljb+9/8p2aksbKiOH3b4t7/xsJ/H/b736o+ef8rz9VDG7vvgfKY56bOdw+Mdn3/uz7MobCem0NiGG/J/e83Lp9rbtOW57Jy34yOjoV9MxrvsX3fbJl3nfLWyvveMP3B9s2G69ufq7afW2q4b8pz9dJ0931THvP2pgt/71gW/9ry3rGkag+MjSwp1zuWNkHz/e7MsrgHNhb7imPF4WJ/uk75LJf3Nbl5cXtgSfjvw37vuKJP9kB5rl7e3H0PlMf8/ZaL+7PThvCVdEzLz06dv184V+a/avTs7XWetoud+ct1fnpr998Nlcf8eOv55ozu5+nW8JVLFjhPna+fc+3p/UX1ebpYe7pc5+Hbu/9uqjxm1bZF7qfdRVG8+fzrzd93NX+/+9en/vXbbb/3Xeh3ym8+//rnrvz+989n/QAAfHDvN/6cW9L8WbPl/7FezP//DwAAAAyEmPuHw0zkfwAAAKiNmPtHwkzkfwAAAKiNmPtHw0wyyf+PDH3tpfeeLtKnAZ4J4uXxNNy/tHlc7HjPhX+vOXNW+fU7Xx+77ztPL+6+h4ui+P97r17w+EeWxnU1HY/rHGn/+jxXXLeo+3/4wbPHtX5+wunh5u3Hx7PYbRC7ym/9x52N211zc3O+fW/RmA/MPfdM4/Z3Nv8dj3/nv5rHfT18aMnuA0Nt198Q1rM+zDXhM2XuX3b2PJQzXu9bbx38x09+8ez9xesNrVvReJgvb2zebvyMqBf/pnl8fNznWv/fPf/Nb5XHP37Dwut/enjh9b8TbveHYf7fu82vt57z77Ss/4/C+uP9xettfO17C67/jb9tHv9G2BevhNm5/jv+5Jr3Fnq+4v3sHm1eL97/9F/c3bhevL14+53rH5+6s+18dN7+2681b2fXo/870np8/Hq8n+jh0fb9PRSe37YeeVEU3/xa0Xaei7Hm9d7sWH+8veOjC6//1o51Hn/1kcb1Ox9P9I0H71rw8cb17P6ribbH8+KKcP6Gl/1TebvvXB32Y7j8Z3PN2+v8LNM3VrS/38TjX5lovm7j7U11rP/FjvXPXVeeu+r13/PT5vrf+NTStvXvXhn200ebs2r9B/98Zdv1X/1Mcz0nHps8emz21KH4GQcTHa/jpePLll9y6UdWrAzvpZ3/3nPs5CMzJ9ZMr5kuijUD+JGBvV7/a2H+T3PMXfx7aPq30ea+e+G+5vetm8aa/34xfP3h8HzG74/f+NOxtv3a+bzPjTfnha7/lrCOxVq9/kc7FnXgf29946V/f+BLnT8XxMdz/LLxxuN7ee3ljcuG3m5e3vl+VeU/L2t/Xf9gVXN+N5zXM+GTmddd3ry/ztuPn03ywuebr9/4k1y8ftHxeSITI+2P40LX/4Pwc8z3rmh//4v747tPd3ya80QxVC5hLrw/FHPNy+NR8Xy/cPryBe8vfg5PMXfl+SzznGafmJ06fOjoqcenTs7MnpyafeLJPUeOnTp6ck/js0v3fLnq+mdf38sbr+/9M9u2Fo1X+7Hm6LFf9PqPP7hv//bpG/fPHNh76sDJB4/PnDi4b3Z238z+2Rv3Hjgw81jV9Q/t37Vp884t2zdPHjy0f9eOnTu37Jw8dPRYuYzmoipsm/7K5NETexpXmd21deem22/fOj155Nj+mV3bp6cnT1Vdv/G9abK89qOTJ2YO7z156MjM5OyhJ2d2bdq5bdvmyk9/PHL8wOyaqROnjk6dmp05MdV8LGtONr5cfu+ruj55mF0Z3u86DIWfzu++dVv6fNzS61895001D5lo/+KPw2dBfX18y47F/Dvm/rEwk0zyPwAAAOQg5v7wwf9nL5D/AQAAoDZi7l8aZiL/AwAAQG3E3D8eZpJJ/tf/1//X/9f/1//X/+8l/X/9/270//X/B3n9+v/6/1Trt/5/zP3LiiLL/A8AAAA5iLl/eZiJ/A8AAAC1EXP/JWEm8j8AAADURsz9l4aZZJL/9f/1//X/9f/1//X/e0n/X/+/G/1//f9BXr/+v/4/1fqt/x9z/0fCTDLJ/wAAAJCDmPtXhJnI/wAAAFAbMfevDDOR/wEAAKA2Yu6fCDPJJP/r/+v/6//r/+v/6//3kv6//n83+v/6/4O8fv1//X+q9Vv/P+b+j4aZZJL/AQAAIAcx938szET+BwAAgNqIuf/jYSbyPwAAANRGzP2rwkwyyf/6//r/+v/6//r/+v+9pP+v/9+N/r/+/yCvX/9f/59q/db/j7n/sjCTTPI/AAAA5CDm/svDTOR/AAAAqI2Y+z8RZiL/AwAAQG3E3H9FmEkm+V//X/9f/1//X/9f/7+X9P/1/7vR/9f/H+T16//r/1Ot3/r/MfdfGWaSSf4HAACAHMTcf1WYifwPAAAAtRFz/9VhJvI/AAAA1EbM/avDTDLJ//r/+v/6//r/+v/6/72k/6//343+v/7/IK9f/1//n2r91v+Puf+aMJNM8j8AAADkIOb+a8NM5H8AAACojZj7rwszkf8BAACgNmLuXxNmkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/WvDTDLJ/wAAAJCDmPvXhZnI/wAAAFAbMfdfH2Yi/wMAAEBtxNy/Pswkk/yv/6//r/+v/6//r//fS/r/+v/d6P/r/w/y+vX/9f+p1m/9/5j7bwgzyST/AwAAQA5i7r8xzET+BwAAgNqIuf+mMBP5HwAAAGoj5v4NYSaZ5H/9f/1//X/9f/1//f9e0v/X/+9G/1//f5DXr/+v/0+1fuv/x9x/c5hJJvkfAAAAchBz/y1hJvI/AAAA1EbM/beGmcj/AAAAUBsx90+GmWSS//X/9f/1//X/9f/1/3tJ/1//vxv9f/3/QV6//r/+P9X6rf8fc/9tYSaZ5H8AAADIQcz9G8NM5H8AAACojZj7p8JM5H8AAACojZj7p8NMMsn/+v/6//r/+v/6//r/vaT/r//fjf6//v8gr1//X/+fav3W/4+5f1OYSSb5HwAAAHIQc//mMBP5HwAAAGoj5v4tYSbyPwAAANRGzP1bw0wyyf/6//r/+v/6//r/+v+9pP+v/9+N/r/+/yCvX/9f/59q/db/j7n/9jCTTPI/AAAA5CDm/m1hJvI/AAAA1EbM/dvDTOR/AAAAqI2Y+3eEmWSS//X/9f/1//X/9f/1/3tJ/1//vxv9f/3/QV6//r/+P9X6rf8fc//OMJNM8j8AAADkIOb+Xwozkf8BAACgNmLu/+UwE/kfAAAAaiPm/l8JM8kk/+v/6//r/+v/6//r//eS/r/+fzf6//r/g7x+/X/9f6r1W/8/5v5dYSaZ5H8AAADIQcz9nwwzkf8BAACgNmLu/1SYifwPAAAAtRFz/+4wk0zyv/6//r/+v/6//r/+fy/p/+v/d6P/r/8/yOvX/9f/p1q/9f9j7r8jzCST/A8AAAA5iLn/zjAT+R8AAABqI+b+u8JM5H8AAACojZj7Px1mkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/XeHmWSS/wEAACAHMfd/JsxE/gcAAIDaiLn/V8NM5H8AAACojZj77wkzyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/l8LM8kk/wMAAEAOYu6/N8xE/gcAAIDaiLn/vjAT+R8AAABqI+b+Xw8zyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/t8IM8kk/wMAAEAOYu7/zTAT+R8AAABqI+b+z4aZyP8AAABQGzH33x9mkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/Z8LM8kk/wMAAEAOYu5/IMxE/gcAAIDaiLn/82Em8j8AAADURsz9XwgzyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/gfDTDLJ/wAAAJCDmPu/GGYi/wMAAEBtxNz/W2Em8j8AAADURsz9vx1mkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/b8TZpJJ/gcAAIAcxNz/u2Em8j8AAADURsz9vxdmIv8DAABAbcTc/1CYSSb5X/9f/1//X/9f/1//v5f0//X/u9H/1/8f5PXr/+v/U63f+v8x938pzCST/A8AAAA5iLn/98NM5H8AAACojZj794SZyP8AAABQGzH3Pxxmkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/XvDTDLJ/wAAAJCDmPv/IMxE/gcAAIDaiLl/X5iJ/A8AAAC1EXP//jCTTPK//r/+v/6//r/+v/5/L+n/6/93o/+v/z/I69f/1/+nWr/1/2PunwkzyST/AwAAQA5i7j8QZiL/AwAAQG3E3H8wzET+BwAAgNqIuf+RMJNM8r/+v/6//r/+v/6//n8v6f/r/3ej/6//P8jr1//X/6dav/X/Y+4/FGaSSf4HAACAHMTc/+UwE/kfAAAAaiPm/q+Emcj/AAAAUBsx9x8OM8kk/+v/6//r/+v/6//r//eS/r/+fzf6//r/g7x+/X/9f6r1W/8/5v4jYSaZ5H8AAADIQcz9R8NM5H8AAACojZj7j4WZyP8AAABQGzH3Hw8zyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/j8MM8kk/wMAAEAOYu4/EWYi/wMAAEBtxNw/G2Yi/wMAAEBtxNx/Mswkk/yv/6//r/+v/6//r//fS/r/+v/d6P/r/w/y+vX/9f+p1m/9/5j7T4WZZJL/AQAAIAcx9z8aZiL/AwAAQG3E3P9YmIn8DwAAALURc//jYSaZ5H/9f/1//X/9f/1//f9e0v/X/+9G/1//f5DXr/+v/0+1fuv/x9z/RJhJJvkfAAAAchBz/5M/Z9+euQDYejCM/vDPtm3btm2b17ZR3CZJOVPNWuckezdp077FE7fY/wAAANBG7v5nxS32PwAAALSRu//ZccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/nLhlyP4HAACACXL3Pzdusf8BAACgjdz9z4tb7H8AAABoI3f/8+OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/wVxy5D9DwAAABPk7n9h3GL/AwAAQBu5+18Ut9j/AAAA0Ebu/hfHLUP2v/5f/6//1//r//X/V9L/6/+P6P/1/zv/r//X/3Nutf4/d/9L4pYh+x8AAAAmyN3/0rjF/gcAAIA2cve/LG6x/wEAAKCN3P0vj1uG7H/9v/5f/6//1//r/6+k/9f/H9H/6/93/l//r//n3Gr9f+7+V8QtQ/Y/AAAATJC7/5Vxi/0PAAAAbeTuf1XcYv8DAABAG7n7Xx23DNn/+n/9v/5f/6//1/9fSf+v/z+i/9f/7/y//l//z7nV+v/c/a+JW4bsfwAAAJggd/9r4xb7HwAAANrI3f+6uMX+BwAAgDZy978+bhmy//X/+n/9v/5f/6//v5L+X/9/RP+v/9/5f/2//p9zq/X/ufvfELcM2f8AAAAwQe7+N8Yt9j8AAAC0kbv/TXGL/Q8AAABt5O5/c9wyZP/r//X/+n/9v/5f/38l/b/+/4j+X/+/8//6f/0/51br/3P3vyVuGbL/AQAAYILc/W+NW+x/AAAAaCN3/9viFvsfAAAA2sjd//a4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7n9H3DJk/wMAAMAEufvfGbfY/wAAANBG7v53xS32PwAAALSRu//dccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/nrhlyP4HAACACXL3vzdusf8BAACgjdz974tb7H8AAABoI3f/++OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/wNxy5D9DwAAABPk7v9g3GL/AwAAQBu5+z8Ut9j/AAAA0Ebu/g/HLUP2v/5f/6//1//r//X/V9L/6/+P6P/1/zv/r//X/3Nutf4/d/9H4pYh+x8AAAAmyN3/0bjF/gcAAIA2cvd/LG6x/wEAAKCN3P0fj1uG7H/9v/5f/6//1//r/6+k/9f/H9H/6/93/l//r//n3Gr9f+7+T8QtQ/Y/AAAATJC7/5Nxi/0PAAAAbeTu/1TcYv8DAABAG7n7Px23DNn/+n/9v/5f/6//1/9fSf+v/z+i/9f/7/y//l//z7nV+v/c/Z+JW4bsfwAAAJggd/9n4xb7HwAAANrI3f+5uMX+BwAAgDZy938+bhmy//X/+n/9v/5f/6//v5L+X/9/RP+v/9/5f/2//p9zq/X/ufu/ELcM2f8AAAAwQe7+L8Yt9j8AAAC0kbv/S3GL/Q8AAABt5O7/ctwyZP/r//X/+n/9v/5f/38l/b/+/4j+X/+/8//6f/0/51br/3P3fyVuGbL/AQAAYILc/V+NW+x/AAAAaCN3/9fiFvsfAAAA2sjd//W4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7v9G3DJk/wMAAMAEufu/GbfY/wAAANBG7v5vxS32PwAAALSRu//bccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/nbhlyP4HAACACXL3fzdusf8BAACgjdz934tb7H8AAABoI3f/9+OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/wdxy5D9DwAAABPk7v9h3GL/AwAAQBu5+38Ut9j/AAAA0Ebu/h/HLUP2v/5f/6//1//r//X/V9L/6/+P6P/1/zv/r//X/3Nutf4/d/9P4pYh+x8AAAAmyN3/07jF/gcAAIA2cvf/LG6x/wEAAKCN3P0/j1uG7H/9v/5f/6//1//r/6+k/9f/H9H/6/93/l//r//n3Gr9f+7+X8QtQ/Y/AAAATJC7/5dxi/0PAAAAbeTu/1XcYv8DAABAG7n7fx23DNn/+n/9v/5f/6//1/9fSf+v/z+i/9f/7/y//l//z7nV+v/c/b+JW4bsfwAAAJggd/9v4xb7HwAAANrI3f+7uMX+BwAAgDZy9/8+bhmy//X/+n/9v/5f/6//v5L+X/9/RP+v/9/5f/2//p9zq/X/ufv/ELcM2f8AAAAwQe7+P8Yt9j8AAAC0kbv/T3GL/Q8AAABt5O7/c9wyZP/r//X/+n/9v/5f/38l/b/+/4j+X/+/8//6f/0/51br/3P3/yVuGbL/AQAAYILc/X+NW+x/AAAAaCN3/9/iFvsfAAAA2sjd//e4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7v9H3DJk/wMAAMAEufv/GbfY/wAAANBG7v5/xS32PwAAALSRu//fccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/n7hlyP4HAACACXL3/zdusf8BAACgjdz9/4tb7H8AAABoI3f//+OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/4a4Zcj+BwAAgAly998Yt9j/AAAA0Ebu/pviFvsfAAAA2sjdf3PcMmT/6//1//p//b/+X/9/Jf2//v+I/l//v/P/+n/9P+dW6/9z998StwzZ/wAAADBB7v5b4xb7HwAAANrI3X9b3GL/AwAAQBu5+2+PW4bsf/2//l//r//X/+v/r6T/1/8f0f/r/3f+X/+v/+fcav1/7v474pYh+x8AAAAmyN1/Z9xi/wMAAEAbufvvilvsfwAAAGgjd//dccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z91/T9wyZP8DAADABLn7741b7H8AAABoI3f/fXGL/Q8AAABt5O6/P24Zsv/1//p//b/+X/+v/7+S/l//f0T/r//f+X/9v/6fc6v1/7n7H4hbhux/AAAAmCB3/4Nxi/0PAAAAbeTufyhusf8BAACgjdz9D8ctQ/a//l//r//X/+v/9f9X0v/r/4/o//X/O/+v/9f/c261/j93/yNxy5D9DwAAABPk7n80brH/AQAAoI3c/Y/FLfY/AAAAtJG7//G4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7n8ibhmy/wEAAGCC3P1Pxi32PwAAALSRu/+puMX+BwAAgDZy9z8dtwzZ//p//b/+X/+v/9f/X0n/r/8/ov/X/+/8v/5f/8+51fr/3P3PBAAA//9eaJjL") openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x42, 0x1ff) renameat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00') executing program 2: syz_usb_connect(0x3, 0xa1, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba23000100010102030109028f00020100803209040000000101000009240100011e0001010c2402010101000203000000092403020103000100090401000001020000090401010101020000072401010101000b2402010202100180bb0009050109000201000007250100000000090401020101020000072401010101000b2402010202100180bb0009050109000201000007250100000000"], 0x0) nanosleep(&(0x7f0000000300)={0x2, 0xbebc200}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x8], [0x0, 0x800], [0x1]], '\x00', [{0x20, 0x20, 0x0, 0x0, 0x1}, {0x40, 0x40, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xbb80, 0xbb80, 0x0, 0x0, 0x1}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}], '\x00', 0xf07}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1bd, @empty}, 0x10) listen(r0, 0xa) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/share,user=root,pass=root,port=445,vers=3.0\x00') (async) r1 = accept(r0, 0x0, 0x0) read(r1, &(0x7f0000000400), 0x100) write(r1, &(0x7f0000000500)="00000080fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100110300000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000008000000000000000", 0x84) executing program 3: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) syz_usb_ep_read(r0, 0x2, 0xc, &(0x7f0000000100)=""/12) syz_usb_ep_write(r0, 0x81, 0x18, &(0x7f0000000200)='\x00'/24) syz_usb_ep_read(r0, 0x2, 0xc, &(0x7f0000000300)=""/12) syz_usb_ep_write(r0, 0x81, 0x1c, &(0x7f0000000400)='\x00'/28) nanosleep(&(0x7f0000000500)={0x1, 0x1dcd6500}, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8914, &(0x7f0000000600)="7777616e3000000000000000000000000100"/40) ioctl(r1, 0x8914, &(0x7f0000000700)="7777616e3100000000000000000000000100"/40) syz_usb_ep_write(r0, 0x81, 0x1a, &(0x7f0000000800)="5744040000000000000057440400000000000000575a00000800") executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r0, &(0x7f0000000100)="0101", 0x2) write(r0, &(0x7f0000000102)='\x00\x00', 0x2) write(r0, &(0x7f0000000104)="02fa", 0x2) write(r0, &(0x7f0000000106)="02aa", 0x2) write(r0, &(0x7f0000000108)="0200", 0x2) write(r0, &(0x7f000000010a)="02fa", 0x2) write(r0, &(0x7f000000010c)="0200", 0x2) write(r0, &(0x7f000000010e)="02fa", 0x2) write(r0, &(0x7f0000000110)="02fa", 0x2) write(r0, &(0x7f0000000112)="02fa", 0x2) write(r0, &(0x7f0000000114)="02fa", 0x2) write(r0, &(0x7f0000000116)="0273", 0x2) write(r0, &(0x7f0000000118)="0202", 0x2) write(r0, &(0x7f000000011a)="0264", 0x2) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) pipe2(&(0x7f0000000300)={0x0, 0x0}, 0x0) write(r2, &(0x7f00000000c0)='\x00\x00TO', 0x4) read(r1, &(0x7f0000000040)=""/4, 0x4) write(r2, &(0x7f00000002c0)='\x00\x00\x00\x00', 0x4) read(r1, &(0x7f0000000044)=""/4, 0x4) write(r2, &(0x7f0000000340)="68488822", 0x4) read(r1, &(0x7f0000000048)=""/4, 0x4) write(r2, &(0x7f0000000380)="e800f00f", 0x4) read(r1, &(0x7f000000004c)=""/4, 0x4) write(r2, &(0x7f00000003c0)="2000f01f", 0x4) read(r1, &(0x7f0000000050)=""/4, 0x4) write(r2, &(0x7f0000000440)="00100000", 0x4) read(r1, &(0x7f0000000024)=""/4, 0x4) write(r2, &(0x7f0000000480)="00101000", 0x4) read(r1, &(0x7f0000000028)=""/4, 0x4) write(r2, &(0x7f00000004c0)="00040002", 0x4) read(r1, &(0x7f0000000100)=""/4, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x2, 0x0) write(r3, &(0x7f0000000180)='0000:00:02.0\x00', 0xd) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x2, 0x0) write(r4, &(0x7f0000000200)='dwc2-pci\x00', 0x9) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/drivers/dwc2-pci/bind\x00', 0x2, 0x0) r6 = timerfd_create(0x1, 0x0) timerfd_settime(r6, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0xf4240}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read(r6, &(0x7f0000000500)=""/8, 0x8) write(r5, &(0x7f0000000280)='0000:00:02.0\x00', 0xd) write(r2, &(0x7f0000000540)="00000088", 0x4) read(r1, &(0x7f0000000010)=""/4, 0x4) executing program 0: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000800), 0x0, 0x4c3, &(0x7f0000000200)="$eJzs3U1oXNUeAPD/nXw0L01f8j54r3SV9wp9fZQmTad5pdAH7apQtGArKOjC0EzStJO2NCmYLMQP0IoK7aYbi6ALBekirlQEkS5ERXDRjaAUVBAbSKtVpAshcu/MxLSZpE1Tc2n8/eBwz7kzc89/5uSeueefSxLAH1ZnROyKiIaI2BIR7dX9hWqJJyslfV6pOHEoLUlMTx+4mkQSEXuLE4dqx0qq29XVA7RExIUPI1ob5/Y7MjZ+pK9cLp2otrtHh493j4yNbx4a7hssDZaOFnu2F4vF3h3F3rv2Xn/45fCZd67vef7sle8//ebi2+eT2BVt1cdmv4+7pTM6Zz6T2RqTiP/f7c5y1pJ3ACza+fvPvJR3DADA8kuv8f8aEf/Orv/boyEqF+uHJx+91h7XBuZ7XcfPr1xezjgBAACAOzcd7bEz3QIAAAArViEi2iIpdFXvBWiLQqGrq3IP79+jtVA+NjK6aeDYyaP9kd0r2xFNhYGhcql2r3BHNCVpuyer/9beelO7GBF/iYhT7X/K2l0Hj5X7805+AAAAwArXFnHpkWfe/efqedb/qS/b844SAAAAWIp0/b/mUmv2p7p+ss4HAACAFSld/1979srHYf0PAAAAK1Zt/T/zf7hUVFRUZip5z1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw1/R0EtMAAADAipZ3/gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHvL3uLEoVpZrj4n9yxXT8xnandEdFTGv1QtlUcaoyXbtkRTRLT+mETjrNclEdGwxL67NkR0xqbPTz/x3VtpierP4RIPyz1i4uu8IyBPzdvyjoA8rXsg7wjI02en8o6APF2cyjsC8rT/QN4RkKd9/8s7AvL08tW8I+CD3RGxpV7+rxBrs20lC3Rz/qchyxAtzSfnIjqj69vZ++bmfwqTS+yGBUztjtgZEaU5+b9C7SkdDdXWmixV2JQMDJVLWyLizxGxMZpWpe2eBfrYu/ZC3UzPi/9Ix//kvlr+Ly1p/7VcYDWOycZVN76uv2+0b6nvm4qppyLWNdYb/2Qm/5vMk/9ddZt9vPfV/uF6+69/lI7/C+8vPP78nqZfjfhP3fM/mXlOWuseHT7ePTI2vnlouG+wNFg6WuzZXiwWe3cUe7uz+aC7NivM9ebTr9f9pv/XwWz+HzP++UnP/9aFxz+b/0fGxo/0lculEyOL7+O5DWfrfoe/cTYd/+YLdzL/NycPZgE2V/c93jc6eqInojm5b+7+rYuPeaWqfR61zysd/43r63//167/KvN/Yc78/7fqtlD5FeK8/vva5br7vzidjn/xIed/ftLx77/F+Z/ccP4vvvLY+v0b6/X9cGTXf+duff5vy4KpHcT1363d7gDlHScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMz2awAAAP//MEf3BQ==") mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./file0/d\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004000)='./file0/d/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004200)='./file0/d/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004400)='./file0/d/CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004600)='./file0/d/DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004800)='./file0/d/EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004a00)='./file0/d/FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF\x00', 0x42, 0x1ff) mknod(&(0x7f0000001000)='./bdev\x00', 0x60777, 0x700) r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./bdev\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000004c00)='./file0/d/GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG\x00', 0x42, 0x1ff) executing program 0: syz_usb_connect(0x5, 0xa1, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba23000100010102030109028f00020100803209040000000101000009240100011e0001010c2402010101000203000000092403020103000100090401000001020000090401010101020000072401010103000b2402010204200100112b09050109000201000007250100000000090401020101020000072401010103000b2402010204200100112b09050109000201000007250100000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x8], [0x0, 0x800], [0x1]], '\x00', [{0x20, 0x20, 0x0, 0x0, 0x1}, {0x40, 0x40, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0x2b1100, 0x2b1100, 0x0, 0x0, 0x1}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}], '\x00', 0xf07}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='1\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./mnt\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f0000001000)='./nullb1\x00', 0x8000, 0xfa01) r2 = fsopen(&(0x7f0000001100)='zonefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000001200)='source\x00', &(0x7f0000001000)='./nullb1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000001300)='\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./mnt\x00', 0x4) executing program 1: r0 = io_uring_setup(0x1, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r0, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x8, 0x0, &(0x7f0000000200)={&(0x7f0000001000)='\x00'/4096, 0x1000}, &(0x7f0000000300)={&(0x7f0000002000)='\x00'/4096, 0x1000, 0x1}, {}, 0x0, 0x1000}, 0x1) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r0, 0x24, &(0x7f0000000400), 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/vm/nr_overcommit_hugepages\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='1000\x00', 0x4) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x48032, 0xffffffffffffffff, 0x0) executing program 1: r0 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_MEM_REGION(r0, 0x22, &(0x7f0000000100)={&(0x7f0000000200)={&(0x7f0000001000), 0x0, 0x1}}, 0x1) mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x0, 0x3, 0x11, r0, 0x20000000) executing program 2: syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="2b00ffff110000ce3926d7ebc19a434805d446cea26a01", 0x17) nanosleep(&(0x7f0000000500)={0x0, 0x10000000}, 0x0) r1 = socket(0x1f, 0x5, 0x8) setsockopt(r1, 0x112, 0x11, &(0x7f0000000100)="00ff000000000000ff0000000500000001000000ff000000050000000100000000000000000000000000000000000000000000000a0000000a000000", 0x3c) connect(r1, &(0x7f0000000200)=@generic={0x1f, "0000000000000100"}, 0xa) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000280)=@ethtool_ringparam={0x11, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x80}}) executing program 1: r0 = syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc0c85512, &(0x7f0000000400)={{0x1}}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='10\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='10\n\x00', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='-2 -3 +4\n\x00', 0x9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='tcp 2049\n\x00', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000002c0)='1\n\x00', 0x2) (async) nanosleep(&(0x7f0000001000)={0x4}, 0x0) nanosleep(&(0x7f0000001000)={0x4}, 0x0) nanosleep(&(0x7f0000001000)={0x4}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380)='nfs4\x00', 0x0, &(0x7f00000003c0)='addr=127.0.0.1,nolock\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/file\x00', 0x42, 0x1ff) fchmod(r5, 0x1ff) executing program 3: syz_mount_image$ocfs2(&(0x7f0000004540), &(0x7f0000004580)='./file0\x00', 0x0, &(0x7f0000000040), 0x1, 0x452c, &(0x7f0000004600)="$eJzs28tvVG0BB+D3DNW2yNevt++Dj0sZwGATk8kMK9GFBauExMjFy8JNM70A1WmnaadGEjeycuHGnSvigoULws6YsCAs/AN0656FC0iMmogSa2bmHDrnzAwd+Dotl+dJ4PS873kvnV/n9LzzQi5Wu7W8kV/eyJdX89WFGxvn8j+rVjZXlkJuj+z3+PSmHznJfv9c+dZ3vv+jcyH84ezvz25tbW2FutHQUanl63///RcLrcdELtOm3m/n3nbLj0MIk23zqjsQQrj6xxCiEMJYXDYeH4dDCIfi+f7rr7/689AuzebRVOHBk+cz1+4Pzt6Nbj+70/XCKITa+X/87fyd+79e+dM/7+3S8AAA8EqXrl/54dViKTyOwsjDgfbn9cPxsdvz8RY9+Wb/owQAAICuttf/o9GLDvt1yc5aly3BsLX1cf8nSd9c/t6V2W8XS/H+b9RW/7W46OmFA4091Oy+b3b/dyzTvvP+b/s4byqZXzLuaIhyhdR5LlcohFC62Dw/Eh3MVaobta/eqG6uLu7aNN5Z6fybu/epdAaah6cXBnrKfzzTf//3/yfafprq5/nd+xF7r6XzP9D1unu/jHrKfyLTbi/y582l82++2U+3XpBv3hPq+f9mYOf8JzP99yv/+jijUX2uQ6k7wIu4vNvzCmnp/L/QKEvdOuMXstv7/7+Z/D/J9L9f9//pi/0d9X2Rzv+LjbJ86ort9/9Ybuf3/6eZ/vcj//r8p/3+70k6/8FmYfrm2Xgle73/H87036/8Lw3H8xyJwkTLvzp9WP8VNrK9X91Y0tSr1/oxi3dfOv/2Xf7t9V+up+e/I5n2e7X+S8ZN1n/JOmQ6aq7/6Cyd/3Bb/evm/1mm/V7ln4wr/9eTzv9g1+t6vf8fzbTr++//aMgK8HNI5/+lrtf1mv+xTDv5v93S+R9qFnZYAPaa//FM//3Kv/HEN5Tkvz3h/w02y4vWfz1J5/9R1+t6zf9Epp33/9stnf9Is3Cg9YqZxt+N9X/Unvt/MvlPZfrfj/V/ff7T2f+ISEfp/OO93NfIP/v538lM//uW/+n+jvq+SOff/VPzev5/6WH9l8+063/+IRR91vfG0vlnd++39Zr/qUw7+b/d0vlnd++3Ne7/Qzvnn73t9jv/r/Sz8w9AOv/uT9K95n8m007+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvpvH4OBqiXCF1nssVCiFMxOdHwsFovrw4N1+pLvx0I4TJuDwfxqOblep8uTK3vFpdXJorVyrVhRA+iesnw1C0UanW5lbKa5++7Gs4urVUXq/NL5VrIYTDcfnx8FHS1/xybaW81rg2qfs4V11fu1VenVtcXv96sVgshs+61pXC0ZfzG4uWfl5bWq01Z9ZsGcKxV9SXGn0mfY9GLd9Yo/mJ7nWlqZff46HoJ9XN9dVypdHmZOfyUr6lr0p1oVxpGedUXPfl9rpSNseZ+Dh7+foPrn+3rTrko3TeidMtr0NtfXN1oVxbmqtUbyav05m4/ndRe337KOyXnfI/1SV/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MPz+BvnfxtCGGie5UII+eSLKP6TqJeFR1OFB0+ez1y7Pzh7N7r97E7mGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+D+7cmzCIBRFAfT9EMgWIROkD2ksXMBxbJ3CygnEEcRlbO3tRPQ3biCcAw/evVwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALid6f9rI+J5pEdEfPKTzsv2Lsb3d5jXoupfZZfqpblsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZ26R+lgSCKA/CbsdBSe+vFatntbBVFbFwRPIHX8EC5QI6VInUgBJJZCPsH0iSk+L7mwfyYeQ/mAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABcnY+f7ve7aSNS3G1vI5bVojrOH0ttXqfv31xgRs7n86t7e2/a8u9plD+Xo9VL3qeb9f9fTNReO9iT4T4djPsMze3b3Hx93/tIuY6Ih5I/pZzr+rS3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAduzOsQ1AABQE0P8tYYNfM4WSSOxhLAvobUYlUSg0uveqSy6XHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDNMI/L1PVxZDRnZuy11bNv77C+7/P/iwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXOzAgQwAAACAMH/rPNoPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHMFAAD//5iWa4U=") mkdirat(0xffffffffffffff9c, &(0x7f0000004580)='./dir123\x00', 0x1ff) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/infiniband/syz0\x00', 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x0499\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x1000\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi2.0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.0/process_ump\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi2.0/ep.0/block.0/direction\x00', 0x2, 0x0) write(r3, &(0x7f00000003c0)='3\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.0/ep.0/block.0/active\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='1\n', 0x2) symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/midi2.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000540)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 2: syz_usb_connect(0x0, 0x43, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402020b10000000000010902310002010080320904000000ffffff00080b0101ffffff000904010002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000200000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000300000)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x80b}]}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='disk', 0x4) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000000181058040550000000000001090224000100000000090400000903000000092100000001221600090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x28, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022160005010902a10185050900150026ff0075089507b102c0"], 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) program did not crash single: failed to extract reproducer bisect: bisecting 25 programs with base timeout 1m40s testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6, 9, 10, 20, 15, 33, 28, 6, 14, 3, 5, 3, 8, 2, 9, 19, 2, 6, 19, 2, 14, 6, 4, 4] detailed listing: executing program 2: syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000040), 0x1, 0x5d0c, &(0x7f0000000200)="$eJzs3dtvHFcdB/DfXry+lKZWH6oQcUlTLi2lSeOkTcutqZB4AAGVqrwnMm4VkQJKQkUri7iKxDsSz6j8ETyDUB+LxJ/APxAp7lMFooPGPicZT9bepIl31j6fj+TM/ObseM/k6/Hsemb2BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQP/7Rm6d7EXHx3bRgOeILMYjoRyzW9fGoZ87nxw8j4mhsNcdTEXFkPqJef+ufJyLORsTHRyJub66v1otX7rMfL71x658/ffNnG3/86j/+9d+P/vy3dvsbH/3wJ3+9EbF89A9/+t+NR7PtAAAAUIqqqqpeept/LL2/73fdKQBgKvLxv0rycrVarVar1YevbqrGu9EsImKjuU79msHpeAA4YDbi0667QIfkX7RhRDzWdSeAmdbrugPsi9ub66u9lG+veTw4vt2erwXZkf9G7879HbtNJ2lfYzKtn6+bMYgnd+nP4pT6MEty/v12/he320fpcfud/7Tslv9o+9an4uT8B+38Ww5P/v2x+Zcq5z98oPwH8gcAAAAAgBmW//6/3PH53/mH35T7stf53+NT6gMAAAAAAAAAPGoPO/7fHcb/AwAAgJlVv1evfXjk7rLdPoutXn6hF/F46/FAYdLNMktd9wMAAAAAAAAAAAAASjLcvob3Qi9iLiIeX1qqqqr+amrXD+ph1z/oSt9+KFnXv+QBAGDbx0da9/L3IhYi4kL6rL+5paWlqlpYXKqWqsX5/Hp2NL9QLTbe1+ZpvWx+dB8viIejqv5mC431mia9X57U3v5+9XONqsF9dGw6OgwcACJi+2h02xHpkKmqJ6LrVzkcDPb/w8f+z/3o+ucUAAAA2H9VVVW99HHex9I5/37XnQIApiIf/9vnBdRqtVqtVh++uqka70aziIiN5jr1awbD8QPAAbMRn3bdBTok/6INI+Jo150AZlqv6w6wL25vrq/2Ur695vEgje+erwXZkf9Gb2u9vP646STta0ym9fN1Mwbx5C79eWpKfZglOf9+O/+L2+2j9Lj9zn9adsu/3s7lDvrTtZz/oJ1/y+HJvz82/1Ll/IcPlP9A/gAAAAAAMMPy3/+Xnf/NmwwAAAAAAAAAB87tzfXVfN9rPv//pTGPc//n4ZTz78m/SDn/fjv/1gU5g8b8rdfv5v/J5vrqh18895U8nfn85waj+rnnev3BMF3zU829FZfjSqzFi/c8frij/fQ97XM72lcmtJ+5p31Uty/m9pOxGr+OK/GLO+3zEy6MWpjQXk1oz/kP7P9FyvkPG191/kupvdea1m590L9nv29Oxz3P+Z9/du7evWv6bsbgzrY11dt3ooP+bP2fPDaK315bu3ryd5euX796OtJkx9KVSJNHLOc/l75y/s8+s92ef+8399dbH4weOP9ZcTOGu+b/TGO+3t7npty3LuT8R+kr55+PQOP3/4Oc/+77//Md9AcAAAAAAAAAAAAAAAD2UlXV1i2i5yPi5XT/T1f3ZgIA05WP/1WSl6vVarVarT58dVM13mvNIiL+3lynfs3w+3HfDACYZZ9FxL+77gSdkX/B8uf91dOvdd0ZYKquvff+Ly9dubJ29VrXPQEAAAAAAAAAPq88/ufxxvjPW9cBtcaN3jH+6+tx/JPN9dV3l//z5QM3/md/NNga6zxt0NOx9/jfJ2Lv8b+HE55vbkL7aEL7/IT2hQntY2/0aMj5P50yzvkfSxu21/ivOf/2dMJTdmqv8V+f7aA/Xcv5n0hjPef8v9l6XDP/6i8Hefzf/o78T11/5zenrr33/guX37n09trba786c3bl1dMr586+8uKpty5fWUv/dtjj/ZXzz2Nfuw60LDn/nLn8y5Lz/3qq5V+WnP83Ui3/suT88+s9+Zcl55/f+8i/LDn/51It/7Lk/L+VavmXJef/fKrlX5ac/7dTLf+y5PxfSLX8y5LzP5lq+Zcl538q1fIvS84/n+GSf1ly/vnKBvmXJee/kmr5lyXnfybV8i9Lzv9squVflpz/S6mWf1ly/i+nWv5lyfmfS7X8y5LzfyXV8i9Lzv/VVMu/LDn/76Ra/mXJ+X831fIvS87/e6mWf1ly/t9PtfzLkvP/QarlX5ac/2upln9Z7n7+vxkzZszkma5/MwEAAAAAAAAAAAAAbdO4nLjrbQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+D87cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsLOvcXIWd5nAP/2ZK8NsTeJIRwM2MaAgcW7PuBDWycGQkqhbQgJ6YnUuPbaOPGpXpuTkNgImiKBVC64oJWSAkJVLloFtYkaJBpxUalNb9qr9qZKKzWqUBQqJ+pNo4Kjb+Z9X8/MrudbYw+Z+d7fL8J/e+ebmXe+eWd2n42eAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGi19q6ZPx4qiqL8r/HHRFFcWv59WbG7/Ofctl/0CgEAAIAL9V7jz79cmb6wexFXajnmH67952+fOXPmTFH82apPvFTOYE1RrFhaFM3LgvEfHW87JnimGB8abvn3cMXdj1RcPlpx+VjF5UsqLl9acfl4xeXzTsA8y5q/j2nc2PrGXyeap7RYVYw1Llu/wLWeGVo6PBx/l9Mw1LjOmbEDxaHicDFTTM+7zlDjf0Xx1tryvu4p4n0Nt9zX6qIoTv/kqX1xDUPhHK8v2u6sofW5e/eOYs1Pf/LUvkcnfnbNQrPyNMxbaVFsWFeu89miOPvrqmKoWJrOSVzncMs6Vy+wzpG2dQ41rlf+vXOdpxe5zvi4x8M6/6XLOleHrz1+fVEUc8U5j+n0TDFcLO+413S+x5s7oryN8qn8WDF6Xvtk7SL2SXmdH17fvk8692Q8/2vDORk9xxpan453v7pk3nn/oPukfNT9sFfL276/vNPx8dZfrbbt1fKYp2449x5Y8LlbYA+kvdyyB9ZV7YHhJSONPTB8ds3r2vbApnnXGS6GGvf1zg3d98DUySPHp2afePK2Q0f2Hpw5OHN0y9bNOzdt3r51x/TUgUOHZ8Kf53dKB8jyYjjtwXXhvSbuwZs6jm3dkmdebb4OXrly+7ULzfNZw/hFeh1cyBqKsF++cGO5oEuHi3Ps8fKYZzdc+Osgfd9veR2MtrwOFnxPXeB1MLqI10F5zOkNi/ueOdry30JrWOi98GLsgYmWPXAh3w9b1/BBvh+W9/nQzed+L1wd1vXcLef7/XBk3h6ID2sovPbKr6Sf98Z3hPMyf19cVV5wyZLi1OzMiY2P7z158sSmIowPxcdbnqvO/bK85TEV8/bL8Hnvl92ffX/7VQt8fSKcq/Fbuz9X5TFbJ7s/V41394XPZ9tXNxdhXGQf9vlc6LtZeT5TluhyPstjnr3twn8WTLmk5f1vrOr9b2RstPn+N5LOxljb+9/8p2aksbKiOH3b4t7/xsJ/H/b736o+ef8rz9VDG7vvgfKY56bOdw+Mdn3/uz7MobCem0NiGG/J/e83Lp9rbtOW57Jy34yOjoV9MxrvsX3fbJl3nfLWyvveMP3B9s2G69ufq7afW2q4b8pz9dJ0931THvP2pgt/71gW/9ry3rGkag+MjSwp1zuWNkHz/e7MsrgHNhb7imPF4WJ/uk75LJf3Nbl5cXtgSfjvw37vuKJP9kB5rl7e3H0PlMf8/ZaL+7PThvCVdEzLz06dv184V+a/avTs7XWetoud+ct1fnpr998Nlcf8eOv55ozu5+nW8JVLFjhPna+fc+3p/UX1ebpYe7pc5+Hbu/9uqjxm1bZF7qfdRVG8+fzrzd93NX+/+9en/vXbbb/3Xeh3ym8+//rnrvz+989n/QAAfHDvN/6cW9L8WbPl/7FezP//DwAAAAyEmPuHw0zkfwAAAKiNmPtHwkzkfwAAAKiNmPtHw0wyyf+PDH3tpfeeLtKnAZ4J4uXxNNy/tHlc7HjPhX+vOXNW+fU7Xx+77ztPL+6+h4ui+P97r17w+EeWxnU1HY/rHGn/+jxXXLeo+3/4wbPHtX5+wunh5u3Hx7PYbRC7ym/9x52N211zc3O+fW/RmA/MPfdM4/Z3Nv8dj3/nv5rHfT18aMnuA0Nt198Q1rM+zDXhM2XuX3b2PJQzXu9bbx38x09+8ez9xesNrVvReJgvb2zebvyMqBf/pnl8fNznWv/fPf/Nb5XHP37Dwut/enjh9b8TbveHYf7fu82vt57z77Ss/4/C+uP9xettfO17C67/jb9tHv9G2BevhNm5/jv+5Jr3Fnq+4v3sHm1eL97/9F/c3bhevL14+53rH5+6s+18dN7+2681b2fXo/870np8/Hq8n+jh0fb9PRSe37YeeVEU3/xa0Xaei7Hm9d7sWH+8veOjC6//1o51Hn/1kcb1Ox9P9I0H71rw8cb17P6ribbH8+KKcP6Gl/1TebvvXB32Y7j8Z3PN2+v8LNM3VrS/38TjX5lovm7j7U11rP/FjvXPXVeeu+r13/PT5vrf+NTStvXvXhn200ebs2r9B/98Zdv1X/1Mcz0nHps8emz21KH4GQcTHa/jpePLll9y6UdWrAzvpZ3/3nPs5CMzJ9ZMr5kuijUD+JGBvV7/a2H+T3PMXfx7aPq30ea+e+G+5vetm8aa/34xfP3h8HzG74/f+NOxtv3a+bzPjTfnha7/lrCOxVq9/kc7FnXgf29946V/f+BLnT8XxMdz/LLxxuN7ee3ljcuG3m5e3vl+VeU/L2t/Xf9gVXN+N5zXM+GTmddd3ry/ztuPn03ywuebr9/4k1y8ftHxeSITI+2P40LX/4Pwc8z3rmh//4v747tPd3ya80QxVC5hLrw/FHPNy+NR8Xy/cPryBe8vfg5PMXfl+SzznGafmJ06fOjoqcenTs7MnpyafeLJPUeOnTp6ck/js0v3fLnq+mdf38sbr+/9M9u2Fo1X+7Hm6LFf9PqPP7hv//bpG/fPHNh76sDJB4/PnDi4b3Z238z+2Rv3Hjgw81jV9Q/t37Vp884t2zdPHjy0f9eOnTu37Jw8dPRYuYzmoipsm/7K5NETexpXmd21deem22/fOj155Nj+mV3bp6cnT1Vdv/G9abK89qOTJ2YO7z156MjM5OyhJ2d2bdq5bdvmyk9/PHL8wOyaqROnjk6dmp05MdV8LGtONr5cfu+ruj55mF0Z3u86DIWfzu++dVv6fNzS61895001D5lo/+KPw2dBfX18y47F/Dvm/rEwk0zyPwAAAOQg5v7wwf9nL5D/AQAAoDZi7l8aZiL/AwAAQG3E3D8eZpJJ/tf/1//X/9f/1//X/+8l/X/9/270//X/B3n9+v/6/1Trt/5/zP3LiiLL/A8AAAA5iLl/eZiJ/A8AAAC1EXP/JWEm8j8AAADURsz9l4aZZJL/9f/1//X/9f/1//X/e0n/X/+/G/1//f9BXr/+v/4/1fqt/x9z/0fCTDLJ/wAAAJCDmPtXhJnI/wAAAFAbMfevDDOR/wEAAKA2Yu6fCDPJJP/r/+v/6//r/+v/6//3kv6//n83+v/6/4O8fv1//X+q9Vv/P+b+j4aZZJL/AQAAIAcx938szET+BwAAgNqIuf/jYSbyPwAAANRGzP2rwkwyyf/6//r/+v/6//r/+v+9pP+v/9+N/r/+/yCvX/9f/59q/db/j7n/sjCTTPI/AAAA5CDm/svDTOR/AAAAqI2Y+z8RZiL/AwAAQG3E3H9FmEkm+V//X/9f/1//X/9f/7+X9P/1/7vR/9f/H+T16//r/1Ot3/r/MfdfGWaSSf4HAACAHMTcf1WYifwPAAAAtRFz/9VhJvI/AAAA1EbM/avDTDLJ//r/+v/6//r/+v/6/72k/6//343+v/7/IK9f/1//n2r91v+Puf+aMJNM8j8AAADkIOb+a8NM5H8AAACojZj7rwszkf8BAACgNmLuXxNmkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/WvDTDLJ/wAAAJCDmPvXhZnI/wAAAFAbMfdfH2Yi/wMAAEBtxNy/Pswkk/yv/6//r/+v/6//r//fS/r/+v/d6P/r/w/y+vX/9f+p1m/9/5j7bwgzyST/AwAAQA5i7r8xzET+BwAAgNqIuf+mMBP5HwAAAGoj5v4NYSaZ5H/9f/1//X/9f/1//f9e0v/X/+9G/1//f5DXr/+v/0+1fuv/x9x/c5hJJvkfAAAAchBz/y1hJvI/AAAA1EbM/beGmcj/AAAAUBsx90+GmWSS//X/9f/1//X/9f/1/3tJ/1//vxv9f/3/QV6//r/+P9X6rf8fc/9tYSaZ5H8AAADIQcz9G8NM5H8AAACojZj7p8JM5H8AAACojZj7p8NMMsn/+v/6//r/+v/6//r/vaT/r//fjf6//v8gr1//X/+fav3W/4+5f1OYSSb5HwAAAHIQc//mMBP5HwAAAGoj5v4tYSbyPwAAANRGzP1bw0wyyf/6//r/+v/6//r/+v+9pP+v/9+N/r/+/yCvX/9f/59q/db/j7n/9jCTTPI/AAAA5CDm/m1hJvI/AAAA1EbM/dvDTOR/AAAAqI2Y+3eEmWSS//X/9f/1//X/9f/1/3tJ/1//vxv9f/3/QV6//r/+P9X6rf8fc//OMJNM8j8AAADkIOb+Xwozkf8BAACgNmLu/+UwE/kfAAAAaiPm/l8JM8kk/+v/6//r/+v/6//r//eS/r/+fzf6//r/g7x+/X/9f6r1W/8/5v5dYSaZ5H8AAADIQcz9nwwzkf8BAACgNmLu/1SYifwPAAAAtRFz/+4wk0zyv/6//r/+v/6//r/+fy/p/+v/d6P/r/8/yOvX/9f/p1q/9f9j7r8jzCST/A8AAAA5iLn/zjAT+R8AAABqI+b+u8JM5H8AAACojZj7Px1mkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/XeHmWSS/wEAACAHMfd/JsxE/gcAAIDaiLn/V8NM5H8AAACojZj77wkzyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/l8LM8kk/wMAAEAOYu6/N8xE/gcAAIDaiLn/vjAT+R8AAABqI+b+Xw8zyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/t8IM8kk/wMAAEAOYu7/zTAT+R8AAABqI+b+z4aZyP8AAABQGzH33x9mkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/Z8LM8kk/wMAAEAOYu5/IMxE/gcAAIDaiLn/82Em8j8AAADURsz9XwgzyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/gfDTDLJ/wAAAJCDmPu/GGYi/wMAAEBtxNz/W2Em8j8AAADURsz9vx1mkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/b8TZpJJ/gcAAIAcxNz/u2Em8j8AAADURsz9vxdmIv8DAABAbcTc/1CYSSb5X/9f/1//X/9f/1//v5f0//X/u9H/1/8f5PXr/+v/U63f+v8x938pzCST/A8AAAA5iLn/98NM5H8AAACojZj794SZyP8AAABQGzH3Pxxmkkn+1//X/9f/1//X/9f/7yX9f/3/bvT/9f8Hef36//r/VOu3/n/M/XvDTDLJ/wAAAJCDmPv/IMxE/gcAAIDaiLl/X5iJ/A8AAAC1EXP//jCTTPK//r/+v/6//r/+v/5/L+n/6/93o/+v/z/I69f/1/+nWr/1/2PunwkzyST/AwAAQA5i7j8QZiL/AwAAQG3E3H8wzET+BwAAgNqIuf+RMJNM8r/+v/6//r/+v/6//n8v6f/r/3ej/6//P8jr1//X/6dav/X/Y+4/FGaSSf4HAACAHMTc/+UwE/kfAAAAaiPm/q+Emcj/AAAAUBsx9x8OM8kk/+v/6//r/+v/6//r//eS/r/+fzf6//r/g7x+/X/9f6r1W/8/5v4jYSaZ5H8AAADIQcz9R8NM5H8AAACojZj7j4WZyP8AAABQGzH3Hw8zyST/6//r/+v/6//r/+v/95L+v/5/N/r/+v+DvH79f/1/qvVb/z/m/j8MM8kk/wMAAEAOYu4/EWYi/wMAAEBtxNw/G2Yi/wMAAEBtxNx/Mswkk/yv/6//r/+v/6//r//fS/r/+v/d6P/r/w/y+vX/9f+p1m/9/5j7T4WZZJL/AQAAIAcx9z8aZiL/AwAAQG3E3P9YmIn8DwAAALURc//jYSaZ5H/9f/1//X/9f/1//f9e0v/X/+9G/1//f5DXr/+v/0+1fuv/x9z/RJhJJvkfAAAAchBz/5M/Z9+euQDYejCM/vDPtm3btm2b17ZR3CZJOVPNWuckezdp077FE7fY/wAAANBG7v5nxS32PwAAALSRu//ZccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/nLhlyP4HAACACXL3Pzdusf8BAACgjdz9z4tb7H8AAABoI3f/8+OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/wVxy5D9DwAAABPk7n9h3GL/AwAAQBu5+18Ut9j/AAAA0Ebu/hfHLUP2v/5f/6//1//r//X/V9L/6/+P6P/1/zv/r//X/3Nutf4/d/9L4pYh+x8AAAAmyN3/0rjF/gcAAIA2cve/LG6x/wEAAKCN3P0vj1uG7H/9v/5f/6//1//r/6+k/9f/H9H/6/93/l//r//n3Gr9f+7+V8QtQ/Y/AAAATJC7/5Vxi/0PAAAAbeTuf1XcYv8DAABAG7n7Xx23DNn/+n/9v/5f/6//1/9fSf+v/z+i/9f/7/y//l//z7nV+v/c/a+JW4bsfwAAAJggd/9r4xb7HwAAANrI3f+6uMX+BwAAgDZy978+bhmy//X/+n/9v/5f/6//v5L+X/9/RP+v/9/5f/2//p9zq/X/ufvfELcM2f8AAAAwQe7+N8Yt9j8AAAC0kbv/TXGL/Q8AAABt5O5/c9wyZP/r//X/+n/9v/5f/38l/b/+/4j+X/+/8//6f/0/51br/3P3vyVuGbL/AQAAYILc/W+NW+x/AAAAaCN3/9viFvsfAAAA2sjd//a4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7n9H3DJk/wMAAMAEufvfGbfY/wAAANBG7v53xS32PwAAALSRu//dccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/nrhlyP4HAACACXL3vzdusf8BAACgjdz974tb7H8AAABoI3f/++OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/wNxy5D9DwAAABPk7v9g3GL/AwAAQBu5+z8Ut9j/AAAA0Ebu/g/HLUP2v/5f/6//1//r//X/V9L/6/+P6P/1/zv/r//X/3Nutf4/d/9H4pYh+x8AAAAmyN3/0bjF/gcAAIA2cvd/LG6x/wEAAKCN3P0fj1uG7H/9v/5f/6//1//r/6+k/9f/H9H/6/93/l//r//n3Gr9f+7+T8QtQ/Y/AAAATJC7/5Nxi/0PAAAAbeTu/1TcYv8DAABAG7n7Px23DNn/+n/9v/5f/6//1/9fSf+v/z+i/9f/7/y//l//z7nV+v/c/Z+JW4bsfwAAAJggd/9n4xb7HwAAANrI3f+5uMX+BwAAgDZy938+bhmy//X/+n/9v/5f/6//v5L+X/9/RP+v/9/5f/2//p9zq/X/ufu/ELcM2f8AAAAwQe7+L8Yt9j8AAAC0kbv/S3GL/Q8AAABt5O7/ctwyZP/r//X/+n/9v/5f/38l/b/+/4j+X/+/8//6f/0/51br/3P3fyVuGbL/AQAAYILc/V+NW+x/AAAAaCN3/9fiFvsfAAAA2sjd//W4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7v9G3DJk/wMAAMAEufu/GbfY/wAAANBG7v5vxS32PwAAALSRu//bccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/nbhlyP4HAACACXL3fzdusf8BAACgjdz934tb7H8AAABoI3f/9+OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/wdxy5D9DwAAABPk7v9h3GL/AwAAQBu5+38Ut9j/AAAA0Ebu/h/HLUP2v/5f/6//1//r//X/V9L/6/+P6P/1/zv/r//X/3Nutf4/d/9P4pYh+x8AAAAmyN3/07jF/gcAAIA2cvf/LG6x/wEAAKCN3P0/j1uG7H/9v/5f/6//1//r/6+k/9f/H9H/6/93/l//r//n3Gr9f+7+X8QtQ/Y/AAAATJC7/5dxi/0PAAAAbeTu/1XcYv8DAABAG7n7fx23DNn/+n/9v/5f/6//1/9fSf+v/z+i/9f/7/y//l//z7nV+v/c/b+JW4bsfwAAAJggd/9v4xb7HwAAANrI3f+7uMX+BwAAgDZy9/8+bhmy//X/+n/9v/5f/6//v5L+X/9/RP+v/9/5f/2//p9zq/X/ufv/ELcM2f8AAAAwQe7+P8Yt9j8AAAC0kbv/T3GL/Q8AAABt5O7/c9wyZP/r//X/+n/9v/5f/38l/b/+/4j+X/+/8//6f/0/51br/3P3/yVuGbL/AQAAYILc/X+NW+x/AAAAaCN3/9/iFvsfAAAA2sjd//e4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7v9H3DJk/wMAAMAEufv/GbfY/wAAANBG7v5/xS32PwAAALSRu//fccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z93/n7hlyP4HAACACXL3/zdusf8BAACgjdz9/4tb7H8AAABoI3f//+OWIftf/6//1//r//X/+v8r6f/1/0f0//r/nf/X/+v/Obda/5+7/4a4Zcj+BwAAgAly998Yt9j/AAAA0Ebu/pviFvsfAAAA2sjdf3PcMmT/6//1//p//b/+X/9/Jf2//v+I/l//v/P/+n/9P+dW6/9z998StwzZ/wAAADBB7v5b4xb7HwAAANrI3X9b3GL/AwAAQBu5+2+PW4bsf/2//l//r//X/+v/r6T/1/8f0f/r/3f+X/+v/+fcav1/7v474pYh+x8AAAAmyN1/Z9xi/wMAAEAbufvvilvsfwAAAGgjd//dccuQ/a//1//r//X/+n/9/5X0//r/I/p//f/O/+v/9f+cW63/z91/T9wyZP8DAADABLn7741b7H8AAABoI3f/fXGL/Q8AAABt5O6/P24Zsv/1//p//b/+X/+v/7+S/l//f0T/r//f+X/9v/6fc6v1/7n7H4hbhux/AAAAmCB3/4Nxi/0PAAAAbeTufyhusf8BAACgjdz9D8ctQ/a//l//r//X/+v/9f9X0v/r/4/o//X/O/+v/9f/c261/j93/yNxy5D9DwAAABPk7n80brH/AQAAoI3c/Y/FLfY/AAAAtJG7//G4Zcj+1//r//X/+n/9v/7/Svp//f8R/b/+f+f/9f/6f86t1v/n7n8ibhmy/wEAAGCC3P1Pxi32PwAAALSRu/+puMX+BwAAgDZy9z8dtwzZ//p//b/+X/+v/9f/X0n/r/8/ov/X/+/8v/5f/8+51fr/3P3PBAAA//9eaJjL") openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x42, 0x1ff) renameat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00') executing program 2: syz_usb_connect(0x3, 0xa1, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba23000100010102030109028f00020100803209040000000101000009240100011e0001010c2402010101000203000000092403020103000100090401000001020000090401010101020000072401010101000b2402010202100180bb0009050109000201000007250100000000090401020101020000072401010101000b2402010202100180bb0009050109000201000007250100000000"], 0x0) nanosleep(&(0x7f0000000300)={0x2, 0xbebc200}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x8], [0x0, 0x800], [0x1]], '\x00', [{0x20, 0x20, 0x0, 0x0, 0x1}, {0x40, 0x40, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xbb80, 0xbb80, 0x0, 0x0, 0x1}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}], '\x00', 0xf07}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1bd, @empty}, 0x10) listen(r0, 0xa) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/share,user=root,pass=root,port=445,vers=3.0\x00') (async) r1 = accept(r0, 0x0, 0x0) read(r1, &(0x7f0000000400), 0x100) write(r1, &(0x7f0000000500)="00000080fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100110300000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000008000000000000000", 0x84) executing program 3: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40e80489680001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) syz_usb_ep_read(r0, 0x2, 0xc, &(0x7f0000000100)=""/12) syz_usb_ep_write(r0, 0x81, 0x18, &(0x7f0000000200)='\x00'/24) syz_usb_ep_read(r0, 0x2, 0xc, &(0x7f0000000300)=""/12) syz_usb_ep_write(r0, 0x81, 0x1c, &(0x7f0000000400)='\x00'/28) nanosleep(&(0x7f0000000500)={0x1, 0x1dcd6500}, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8914, &(0x7f0000000600)="7777616e3000000000000000000000000100"/40) ioctl(r1, 0x8914, &(0x7f0000000700)="7777616e3100000000000000000000000100"/40) syz_usb_ep_write(r0, 0x81, 0x1a, &(0x7f0000000800)="5744040000000000000057440400000000000000575a00000800") executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) pwrite64(r0, &(0x7f0000000000)='100\x00', 0x3, 0x0) executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r0, &(0x7f0000000100)="0101", 0x2) write(r0, &(0x7f0000000102)='\x00\x00', 0x2) write(r0, &(0x7f0000000104)="02fa", 0x2) write(r0, &(0x7f0000000106)="02aa", 0x2) write(r0, &(0x7f0000000108)="0200", 0x2) write(r0, &(0x7f000000010a)="02fa", 0x2) write(r0, &(0x7f000000010c)="0200", 0x2) write(r0, &(0x7f000000010e)="02fa", 0x2) write(r0, &(0x7f0000000110)="02fa", 0x2) write(r0, &(0x7f0000000112)="02fa", 0x2) write(r0, &(0x7f0000000114)="02fa", 0x2) write(r0, &(0x7f0000000116)="0273", 0x2) write(r0, &(0x7f0000000118)="0202", 0x2) write(r0, &(0x7f000000011a)="0264", 0x2) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) pipe2(&(0x7f0000000300)={0x0, 0x0}, 0x0) write(r2, &(0x7f00000000c0)='\x00\x00TO', 0x4) read(r1, &(0x7f0000000040)=""/4, 0x4) write(r2, &(0x7f00000002c0)='\x00\x00\x00\x00', 0x4) read(r1, &(0x7f0000000044)=""/4, 0x4) write(r2, &(0x7f0000000340)="68488822", 0x4) read(r1, &(0x7f0000000048)=""/4, 0x4) write(r2, &(0x7f0000000380)="e800f00f", 0x4) read(r1, &(0x7f000000004c)=""/4, 0x4) write(r2, &(0x7f00000003c0)="2000f01f", 0x4) read(r1, &(0x7f0000000050)=""/4, 0x4) write(r2, &(0x7f0000000440)="00100000", 0x4) read(r1, &(0x7f0000000024)=""/4, 0x4) write(r2, &(0x7f0000000480)="00101000", 0x4) read(r1, &(0x7f0000000028)=""/4, 0x4) write(r2, &(0x7f00000004c0)="00040002", 0x4) read(r1, &(0x7f0000000100)=""/4, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x2, 0x0) write(r3, &(0x7f0000000180)='0000:00:02.0\x00', 0xd) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x2, 0x0) write(r4, &(0x7f0000000200)='dwc2-pci\x00', 0x9) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/drivers/dwc2-pci/bind\x00', 0x2, 0x0) r6 = timerfd_create(0x1, 0x0) timerfd_settime(r6, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0xf4240}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read(r6, &(0x7f0000000500)=""/8, 0x8) write(r5, &(0x7f0000000280)='0000:00:02.0\x00', 0xd) write(r2, &(0x7f0000000540)="00000088", 0x4) read(r1, &(0x7f0000000010)=""/4, 0x4) executing program 0: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000800), 0x0, 0x4c3, &(0x7f0000000200)="$eJzs3U1oXNUeAPD/nXw0L01f8j54r3SV9wp9fZQmTad5pdAH7apQtGArKOjC0EzStJO2NCmYLMQP0IoK7aYbi6ALBekirlQEkS5ERXDRjaAUVBAbSKtVpAshcu/MxLSZpE1Tc2n8/eBwz7kzc89/5uSeueefSxLAH1ZnROyKiIaI2BIR7dX9hWqJJyslfV6pOHEoLUlMTx+4mkQSEXuLE4dqx0qq29XVA7RExIUPI1ob5/Y7MjZ+pK9cLp2otrtHh493j4yNbx4a7hssDZaOFnu2F4vF3h3F3rv2Xn/45fCZd67vef7sle8//ebi2+eT2BVt1cdmv4+7pTM6Zz6T2RqTiP/f7c5y1pJ3ACza+fvPvJR3DADA8kuv8f8aEf/Orv/boyEqF+uHJx+91h7XBuZ7XcfPr1xezjgBAACAOzcd7bEz3QIAAAArViEi2iIpdFXvBWiLQqGrq3IP79+jtVA+NjK6aeDYyaP9kd0r2xFNhYGhcql2r3BHNCVpuyer/9beelO7GBF/iYhT7X/K2l0Hj5X7805+AAAAwArXFnHpkWfe/efqedb/qS/b844SAAAAWIp0/b/mUmv2p7p+ss4HAACAFSld/1979srHYf0PAAAAK1Zt/T/zf7hUVFRUZip5z1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw1/R0EtMAAADAipZ3/gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHvL3uLEoVpZrj4n9yxXT8xnandEdFTGv1QtlUcaoyXbtkRTRLT+mETjrNclEdGwxL67NkR0xqbPTz/x3VtpierP4RIPyz1i4uu8IyBPzdvyjoA8rXsg7wjI02en8o6APF2cyjsC8rT/QN4RkKd9/8s7AvL08tW8I+CD3RGxpV7+rxBrs20lC3Rz/qchyxAtzSfnIjqj69vZ++bmfwqTS+yGBUztjtgZEaU5+b9C7SkdDdXWmixV2JQMDJVLWyLizxGxMZpWpe2eBfrYu/ZC3UzPi/9Ix//kvlr+Ly1p/7VcYDWOycZVN76uv2+0b6nvm4qppyLWNdYb/2Qm/5vMk/9ddZt9vPfV/uF6+69/lI7/C+8vPP78nqZfjfhP3fM/mXlOWuseHT7ePTI2vnlouG+wNFg6WuzZXiwWe3cUe7uz+aC7NivM9ebTr9f9pv/XwWz+HzP++UnP/9aFxz+b/0fGxo/0lculEyOL7+O5DWfrfoe/cTYd/+YLdzL/NycPZgE2V/c93jc6eqInojm5b+7+rYuPeaWqfR61zysd/43r63//167/KvN/Yc78/7fqtlD5FeK8/vva5br7vzidjn/xIed/ftLx77/F+Z/ccP4vvvLY+v0b6/X9cGTXf+duff5vy4KpHcT1363d7gDlHScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMz2awAAAP//MEf3BQ==") mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./file0/d\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004000)='./file0/d/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004200)='./file0/d/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004400)='./file0/d/CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004600)='./file0/d/DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004800)='./file0/d/EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE\x00', 0x42, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000004a00)='./file0/d/FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF\x00', 0x42, 0x1ff) mknod(&(0x7f0000001000)='./bdev\x00', 0x60777, 0x700) r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./bdev\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x4c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x5c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x6c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7000) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7400) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7800) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x7c00) pwrite64(r0, &(0x7f0000005000)='\x00'/128, 0x80, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000004c00)='./file0/d/GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG\x00', 0x42, 0x1ff) executing program 0: syz_usb_connect(0x5, 0xa1, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba23000100010102030109028f00020100803209040000000101000009240100011e0001010c2402010101000203000000092403020103000100090401000001020000090401010101020000072401010103000b2402010204200100112b09050109000201000007250100000000090401020101020000072401010103000b2402010204200100112b09050109000201000007250100000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x8], [0x0, 0x800], [0x1]], '\x00', [{0x20, 0x20, 0x0, 0x0, 0x1}, {0x40, 0x40, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0x2b1100, 0x2b1100, 0x0, 0x0, 0x1}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}, {0x0, 0x7fffffff}], '\x00', 0xf07}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='1\n', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./mnt\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f0000001000)='./nullb1\x00', 0x8000, 0xfa01) r2 = fsopen(&(0x7f0000001100)='zonefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000001200)='source\x00', &(0x7f0000001000)='./nullb1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000001300)='\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./mnt\x00', 0x4) executing program 1: r0 = io_uring_setup(0x1, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r0, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x8, 0x0, &(0x7f0000000200)={&(0x7f0000001000)='\x00'/4096, 0x1000}, &(0x7f0000000300)={&(0x7f0000002000)='\x00'/4096, 0x1000, 0x1}, {}, 0x0, 0x1000}, 0x1) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r0, 0x24, &(0x7f0000000400), 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/vm/nr_overcommit_hugepages\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='1000\x00', 0x4) mmap(&(0x7f0000000000/0x1000000)=nil, 0x40000000, 0x3, 0x48032, 0xffffffffffffffff, 0x0) executing program 1: r0 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_MEM_REGION(r0, 0x22, &(0x7f0000000100)={&(0x7f0000000200)={&(0x7f0000001000), 0x0, 0x1}}, 0x1) mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x0, 0x3, 0x11, r0, 0x20000000) executing program 2: syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="2b00ffff110000ce3926d7ebc19a434805d446cea26a01", 0x17) nanosleep(&(0x7f0000000500)={0x0, 0x10000000}, 0x0) r1 = socket(0x1f, 0x5, 0x8) setsockopt(r1, 0x112, 0x11, &(0x7f0000000100)="00ff000000000000ff0000000500000001000000ff000000050000000100000000000000000000000000000000000000000000000a0000000a000000", 0x3c) connect(r1, &(0x7f0000000200)=@generic={0x1f, "0000000000000100"}, 0xa) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000280)=@ethtool_ringparam={0x11, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x80}}) executing program 1: r0 = syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x10, &(0x7f0000000600)={0x20, 0x81, 0x3, "80bb00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc0c85512, &(0x7f0000000400)={{0x1}}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='10\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='10\n\x00', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='-2 -3 +4\n\x00', 0x9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='tcp 2049\n\x00', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000002c0)='1\n\x00', 0x2) (async) nanosleep(&(0x7f0000001000)={0x4}, 0x0) nanosleep(&(0x7f0000001000)={0x4}, 0x0) nanosleep(&(0x7f0000001000)={0x4}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380)='nfs4\x00', 0x0, &(0x7f00000003c0)='addr=127.0.0.1,nolock\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/file\x00', 0x42, 0x1ff) fchmod(r5, 0x1ff) executing program 3: syz_mount_image$ocfs2(&(0x7f0000004540), &(0x7f0000004580)='./file0\x00', 0x0, &(0x7f0000000040), 0x1, 0x452c, &(0x7f0000004600)="$eJzs28tvVG0BB+D3DNW2yNevt++Dj0sZwGATk8kMK9GFBauExMjFy8JNM70A1WmnaadGEjeycuHGnSvigoULws6YsCAs/AN0656FC0iMmogSa2bmHDrnzAwd+Dotl+dJ4PS873kvnV/n9LzzQi5Wu7W8kV/eyJdX89WFGxvn8j+rVjZXlkJuj+z3+PSmHznJfv9c+dZ3vv+jcyH84ezvz25tbW2FutHQUanl63///RcLrcdELtOm3m/n3nbLj0MIk23zqjsQQrj6xxCiEMJYXDYeH4dDCIfi+f7rr7/689AuzebRVOHBk+cz1+4Pzt6Nbj+70/XCKITa+X/87fyd+79e+dM/7+3S8AAA8EqXrl/54dViKTyOwsjDgfbn9cPxsdvz8RY9+Wb/owQAAICuttf/o9GLDvt1yc5aly3BsLX1cf8nSd9c/t6V2W8XS/H+b9RW/7W46OmFA4091Oy+b3b/dyzTvvP+b/s4byqZXzLuaIhyhdR5LlcohFC62Dw/Eh3MVaobta/eqG6uLu7aNN5Z6fybu/epdAaah6cXBnrKfzzTf//3/yfafprq5/nd+xF7r6XzP9D1unu/jHrKfyLTbi/y582l82++2U+3XpBv3hPq+f9mYOf8JzP99yv/+jijUX2uQ6k7wIu4vNvzCmnp/L/QKEvdOuMXstv7/7+Z/D/J9L9f9//pi/0d9X2Rzv+LjbJ86ort9/9Ybuf3/6eZ/vcj//r8p/3+70k6/8FmYfrm2Xgle73/H87036/8Lw3H8xyJwkTLvzp9WP8VNrK9X91Y0tSr1/oxi3dfOv/2Xf7t9V+up+e/I5n2e7X+S8ZN1n/JOmQ6aq7/6Cyd/3Bb/evm/1mm/V7ln4wr/9eTzv9g1+t6vf8fzbTr++//aMgK8HNI5/+lrtf1mv+xTDv5v93S+R9qFnZYAPaa//FM//3Kv/HEN5Tkvz3h/w02y4vWfz1J5/9R1+t6zf9Epp33/9stnf9Is3Cg9YqZxt+N9X/Unvt/MvlPZfrfj/V/ff7T2f+ISEfp/OO93NfIP/v538lM//uW/+n+jvq+SOff/VPzev5/6WH9l8+063/+IRR91vfG0vlnd++39Zr/qUw7+b/d0vlnd++3Ne7/Qzvnn73t9jv/r/Sz8w9AOv/uT9K95n8m007+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvpvH4OBqiXCF1nssVCiFMxOdHwsFovrw4N1+pLvx0I4TJuDwfxqOblep8uTK3vFpdXJorVyrVhRA+iesnw1C0UanW5lbKa5++7Gs4urVUXq/NL5VrIYTDcfnx8FHS1/xybaW81rg2qfs4V11fu1VenVtcXv96sVgshs+61pXC0ZfzG4uWfl5bWq01Z9ZsGcKxV9SXGn0mfY9GLd9Yo/mJ7nWlqZff46HoJ9XN9dVypdHmZOfyUr6lr0p1oVxpGedUXPfl9rpSNseZ+Dh7+foPrn+3rTrko3TeidMtr0NtfXN1oVxbmqtUbyav05m4/ndRe337KOyXnfI/1SV/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MPz+BvnfxtCGGie5UII+eSLKP6TqJeFR1OFB0+ez1y7Pzh7N7r97E7mGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+D+7cmzCIBRFAfT9EMgWIROkD2ksXMBxbJ3CygnEEcRlbO3tRPQ3biCcAw/evVwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALid6f9rI+J5pEdEfPKTzsv2Lsb3d5jXoupfZZfqpblsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZ26R+lgSCKA/CbsdBSe+vFatntbBVFbFwRPIHX8EC5QI6VInUgBJJZCPsH0iSk+L7mwfyYeQ/mAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABcnY+f7ve7aSNS3G1vI5bVojrOH0ttXqfv31xgRs7n86t7e2/a8u9plD+Xo9VL3qeb9f9fTNReO9iT4T4djPsMze3b3Hx93/tIuY6Ih5I/pZzr+rS3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAduzOsQ1AABQE0P8tYYNfM4WSSOxhLAvobUYlUSg0uveqSy6XHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDNMI/L1PVxZDRnZuy11bNv77C+7/P/iwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXOzAgQwAAACAMH/rPNoPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHMFAAD//5iWa4U=") mkdirat(0xffffffffffffff9c, &(0x7f0000004580)='./dir123\x00', 0x1ff) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/infiniband/syz0\x00', 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x0499\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x1000\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi2.0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/midi2.0/process_ump\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/midi2.0/ep.0/block.0/direction\x00', 0x2, 0x0) write(r3, &(0x7f00000003c0)='3\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.0/ep.0/block.0/active\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='1\n', 0x2) symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/midi2.0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/midi2.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000540)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) executing program 2: syz_usb_connect(0x0, 0x43, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402020b10000000000010902310002010080320904000000ffffff00080b0101ffffff000904010002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000200000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000300000)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x80b}]}) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='disk', 0x4) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000000181058040550000000000001090224000100000000090400000903000000092100000001221600090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x28, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022160005010902a10185050900150026ff0075089507b102c0"], 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) program crashed: general protection fault in gspca_init_transfer single: successfully extracted reproducer found reproducer with 14 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-syz_usb_connect-nanosleep-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) read(0xffffffffffffffff, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-syz_usb_connect-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='vicodec.0\x00', 0xa) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r4, &(0x7f0000000600), 0x1000) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r3, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='vim2m.0\x00', 0x8) write(0xffffffffffffffff, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r3, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/vim2m/unbind\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r3, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r3, &(0x7f0000000600), 0x1000) program crashed: KASAN: use-after-free Read in sd_stopN testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='vivid.0\x00', 0x8) write(0xffffffffffffffff, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)='vivid.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: KASAN: use-after-free Read in sd_start testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000000c0)='vivid.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)='vivid.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)='vivid.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)='vivid.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)='vivid.0\x00', 0x8) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: general protection fault in gspca_init_transfer testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000140)='vimc.0\x00', 0x7) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0)='vim2m.0\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: KASAN: use-after-free Read in sd_start testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: KASAN: use-after-free Read in sd_stopN testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, 0x0, 0x0) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240), 0x0) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, 0x0, 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(0x0, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(0x0, 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, 0x0, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: KASAN: use-after-free Read in sd_stopN validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: general protection fault in gspca_init_transfer validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write-write-openat-write-syz_usb_connect-nanosleep-syz_open_dev$video-read detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/vimc/unbind\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vicodec/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='vicodec.0\x00', 0xa) syz_usb_connect(0x0, 0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40450580800a03010203010902200001010080320904000002ffffff000705810140000107050202400000"], 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) r2 = syz_open_dev$video(&(0x7f0000000500), 0x0, 0x0) read(r2, &(0x7f0000000600), 0x1000) program crashed: general protection fault in gspca_init_transfer validation run: crashed=true reproducing took 3h52m21.446093975s repro crashed as (corrupted=false): general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 PID: 4820 Comm: syz.2.95 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:build_isoc_ep_tb drivers/media/usb/gspca/gspca.c:585 [inline] RIP: 0010:gspca_init_transfer+0x5d2/0x2f60 drivers/media/usb/gspca/gspca.c:796 Code: 8b 44 24 70 89 84 24 b0 02 00 00 b8 01 00 00 00 48 89 44 24 28 4c 8b 6c 24 58 e9 41 0c 00 00 49 8d 5d 10 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 5a 28 00 00 8b 1b 83 fb 10 b8 10 00 00 RSP: 0018:ffffc90004a7f640 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000000 RDX: ffff888029778000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90004a7f9f8 R08: ffffc90004a7f96f R09: ffffc90004a7f8f0 R10: dffffc0000000000 R11: fffff5200094ff2e R12: ffffffff86e9d850 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88805d6ca000 FS: 00007f76ba6ad6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eb4e520660 CR3: 00000000777b5000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: gspca_start_streaming+0x69/0x240 drivers/media/usb/gspca/gspca.c:1360 vb2_start_streaming+0x118/0x4a0 drivers/media/common/videobuf2/videobuf2-core.c:1613 vb2_core_streamon+0x253/0x380 drivers/media/common/videobuf2/videobuf2-core.c:2148 __vb2_init_fileio+0x980/0xc60 drivers/media/common/videobuf2/videobuf2-core.c:2729 __vb2_perform_fileio+0x346/0x1590 drivers/media/common/videobuf2/videobuf2-core.c:2805 vb2_fop_read+0x22e/0x340 drivers/media/common/videobuf2/videobuf2-v4l2.c:1174 v4l2_read+0x193/0x2b0 drivers/media/v4l2-core/v4l2-dev.c:314 vfs_read+0x2db/0x960 fs/read_write.c:468 ksys_read+0x14d/0x260 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f76b979e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f76ba6ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f76b9a26090 RCX: 00007f76b979e0d9 RDX: 0000000000001000 RSI: 0000200000000600 RDI: 0000000000000006 RBP: 00007f76b9835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f76b9a26128 R14: 00007f76b9a26090 R15: 00007ffd2eea9f88 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:build_isoc_ep_tb drivers/media/usb/gspca/gspca.c:585 [inline] RIP: 0010:gspca_init_transfer+0x5d2/0x2f60 drivers/media/usb/gspca/gspca.c:796 Code: 8b 44 24 70 89 84 24 b0 02 00 00 b8 01 00 00 00 48 89 44 24 28 4c 8b 6c 24 58 e9 41 0c 00 00 49 8d 5d 10 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 5a 28 00 00 8b 1b 83 fb 10 b8 10 00 00 RSP: 0018:ffffc90004a7f640 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000000 RDX: ffff888029778000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90004a7f9f8 R08: ffffc90004a7f96f R09: ffffc90004a7f8f0 R10: dffffc0000000000 R11: fffff5200094ff2e R12: ffffffff86e9d850 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88805d6ca000 FS: 00007f76ba6ad6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eb4e520660 CR3: 00000000777b5000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 8b 44 24 70 mov 0x70(%rsp),%eax 4: 89 84 24 b0 02 00 00 mov %eax,0x2b0(%rsp) b: b8 01 00 00 00 mov $0x1,%eax 10: 48 89 44 24 28 mov %rax,0x28(%rsp) 15: 4c 8b 6c 24 58 mov 0x58(%rsp),%r13 1a: e9 41 0c 00 00 jmp 0xc60 1f: 49 8d 5d 10 lea 0x10(%r13),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 5a 28 00 00 jne 0x2891 37: 8b 1b mov (%rbx),%ebx 39: 83 fb 10 cmp $0x10,%ebx 3c: b8 .byte 0xb8 3d: 10 00 adc %al,(%rax) final repro crashed as (corrupted=false): general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 PID: 4820 Comm: syz.2.95 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:build_isoc_ep_tb drivers/media/usb/gspca/gspca.c:585 [inline] RIP: 0010:gspca_init_transfer+0x5d2/0x2f60 drivers/media/usb/gspca/gspca.c:796 Code: 8b 44 24 70 89 84 24 b0 02 00 00 b8 01 00 00 00 48 89 44 24 28 4c 8b 6c 24 58 e9 41 0c 00 00 49 8d 5d 10 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 5a 28 00 00 8b 1b 83 fb 10 b8 10 00 00 RSP: 0018:ffffc90004a7f640 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000000 RDX: ffff888029778000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90004a7f9f8 R08: ffffc90004a7f96f R09: ffffc90004a7f8f0 R10: dffffc0000000000 R11: fffff5200094ff2e R12: ffffffff86e9d850 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88805d6ca000 FS: 00007f76ba6ad6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eb4e520660 CR3: 00000000777b5000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: gspca_start_streaming+0x69/0x240 drivers/media/usb/gspca/gspca.c:1360 vb2_start_streaming+0x118/0x4a0 drivers/media/common/videobuf2/videobuf2-core.c:1613 vb2_core_streamon+0x253/0x380 drivers/media/common/videobuf2/videobuf2-core.c:2148 __vb2_init_fileio+0x980/0xc60 drivers/media/common/videobuf2/videobuf2-core.c:2729 __vb2_perform_fileio+0x346/0x1590 drivers/media/common/videobuf2/videobuf2-core.c:2805 vb2_fop_read+0x22e/0x340 drivers/media/common/videobuf2/videobuf2-v4l2.c:1174 v4l2_read+0x193/0x2b0 drivers/media/v4l2-core/v4l2-dev.c:314 vfs_read+0x2db/0x960 fs/read_write.c:468 ksys_read+0x14d/0x260 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f76b979e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f76ba6ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f76b9a26090 RCX: 00007f76b979e0d9 RDX: 0000000000001000 RSI: 0000200000000600 RDI: 0000000000000006 RBP: 00007f76b9835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f76b9a26128 R14: 00007f76b9a26090 R15: 00007ffd2eea9f88 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:build_isoc_ep_tb drivers/media/usb/gspca/gspca.c:585 [inline] RIP: 0010:gspca_init_transfer+0x5d2/0x2f60 drivers/media/usb/gspca/gspca.c:796 Code: 8b 44 24 70 89 84 24 b0 02 00 00 b8 01 00 00 00 48 89 44 24 28 4c 8b 6c 24 58 e9 41 0c 00 00 49 8d 5d 10 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 5a 28 00 00 8b 1b 83 fb 10 b8 10 00 00 RSP: 0018:ffffc90004a7f640 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000000 RDX: ffff888029778000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90004a7f9f8 R08: ffffc90004a7f96f R09: ffffc90004a7f8f0 R10: dffffc0000000000 R11: fffff5200094ff2e R12: ffffffff86e9d850 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88805d6ca000 FS: 00007f76ba6ad6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eb4e520660 CR3: 00000000777b5000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 8b 44 24 70 mov 0x70(%rsp),%eax 4: 89 84 24 b0 02 00 00 mov %eax,0x2b0(%rsp) b: b8 01 00 00 00 mov $0x1,%eax 10: 48 89 44 24 28 mov %rax,0x28(%rsp) 15: 4c 8b 6c 24 58 mov 0x58(%rsp),%r13 1a: e9 41 0c 00 00 jmp 0xc60 1f: 49 8d 5d 10 lea 0x10(%r13),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 5a 28 00 00 jne 0x2891 37: 8b 1b mov (%rbx),%ebx 39: 83 fb 10 cmp $0x10,%ebx 3c: b8 .byte 0xb8 3d: 10 00 adc %al,(%rax)