# https://syzkaller.appspot.com/bug?id=57cfabf4d241961ea260e979a2788a762b12f254
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"repeat":true,"procs":5,"slowdown":1,"sandbox":"namespace","sandbox_arg":0,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"close_fds":true,"usb":true,"vhci":true,"wifi":true,"ieee802154":true,"sysctl":true,"swap":true,"tmpdir":true,"segv":true}
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCFLSH(r3, 0x540b, 0x1)
ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000080)=ANY=[@ANYBLOB="010c906ca08a4b63b4ffffff010000000500"])
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)={0x14, 0x17, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x20000891}, 0x10)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0)
r6 = syz_io_uring_setup(0x239, &(0x7f00000001c0)={0x0, 0x0, 0x11900}, &(0x7f0000000000)=<r7=>0x0, &(0x7f0000000040)=<r8=>0x0)
syz_io_uring_submit(r7, r8, &(0x7f0000000380)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0xa644}})
r9 = socket$unix(0x1, 0x2, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001040)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7ffffffb}]})
copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x0)
recvmsg$unix(r9, &(0x7f00000002c0)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f0000001900)=[{&(0x7f00000003c0)=""/140, 0x8c}, {&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/166, 0xa6}, {&(0x7f0000000680)=""/71, 0x47}, {&(0x7f0000000140)=""/32, 0x20}], 0x5, &(0x7f0000001980)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x58}, 0x40010140)
io_uring_enter(r6, 0x3e6f, 0x0, 0x0, 0x0, 0x0)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0)
r11 = syz_open_dev$tty1(0xc, 0x4, 0x1)
io_setup(0x206, &(0x7f0000000200)=<r12=>0x0)
r13 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200003400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0)
io_submit(r12, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x15, 0x0, 0x0, 0x1, 0x0, r11, 0x0}])
sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a00010000000a05000000000000000000010000000900010073797a3000000000de0006004a8ad1cd65c2ea6cad48d9e62dcbb0d85da362828327ae59ee93eeb1b8317bf4f6ee48c0cc1e4862fae14b63c4272275bc540a1c8a2f59567feed8b49b9a87ec73ec88a8cf88f8a2e3a454503a27b47ca7214d0731cd41fbbc3a40b05cb07fa916cc17f0a1377283f520eaac83e5cc1abe9a60a93496483671cac09a8906296976a63d64e612d0cdf7eceb82d0ae7e317552ed803b2447b56b384cd5f5d212fedbfafb568d3431ad6c267efd1987f00218d799072bab08e34814c9b028482ec8f12133134c995921b356fc4a5325db78e89a045bc30a8aa2acd8000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000014000480080002400000000008000140000000005c000000060a010400000000000000000100000008000b4000000000300004802c000180090001007866726d000000001c0002800500030001000000080002400000000008000140000000110900010073797a30"], 0x1c0}}, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})