# https://syzkaller.appspot.com/bug?id=e502519404700a50ba41cb57ad5cc9b9648993d4
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"repeat":true,"procs":6,"slowdown":1,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"resetnet":true,"close_fds":true,"usb":true,"vhci":true,"wifi":true,"sysctl":true,"tmpdir":true}
r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$vim2m_VIDIOC_QUERYCAP(0xffffffffffffffff, 0x80685600, &(0x7f0000000140))
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0xc4800, 0x0)
setsockopt$PNPIPE_INITSTATE(r1, 0x113, 0x4, &(0x7f0000000200)=0x1, 0x4)
bind$unix(0xffffffffffffffff, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
r2 = inotify_init1(0x0)
fcntl$setown(r2, 0x8, 0xffffffffffffffff)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@mcast1, @in6=@mcast1}}, {{@in6=@local}, 0x0, @in=@multicast2}}, &(0x7f00000005c0)=0xe8)
write$FUSE_STATFS(r1, &(0x7f0000000340)={0x60, 0x0, 0x0, {{0x74, 0x9, 0x2, 0x8be6, 0x6, 0x100, 0x10000, 0x6}}}, 0x60)
fcntl$getownex(r2, 0x10, &(0x7f0000000080))
getsockname(r0, 0x0, &(0x7f0000000480))
ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0)
r3 = syz_io_uring_setup(0x8a, &(0x7f00000002c0), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee8000/0x2000)=nil, &(0x7f0000000080), &(0x7f0000000100))
ppoll(&(0x7f0000000000)=[{r3}], 0x1, 0x0, 0x0, 0x0)
fcntl$setstatus(r3, 0x4, 0x2800)
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r4, &(0x7f0000000080)=""/215, 0xd7)
r5 = syz_io_uring_setup(0x86, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=<r6=>0x0, &(0x7f0000000040)=<r7=>0x0)
socket(0x0, 0x0, 0x38)
syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x7, &(0x7f0000000180)={0x0, 0x989680}, 0x1, 0x1, 0x1}, 0x0)
io_uring_enter(r5, 0x450c, 0x0, 0x0, 0x0, 0x0)
poll(0x0, 0x0, 0x138)