Warning: Permanently added '10.128.10.19' (ED25519) to the list of known hosts. [ 64.500730][ T1858] cfg80211: failed to load regulatory.db [ 64.500826][ T2457] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.500857][ T2457] ieee802154 phy1 wpan1: encryption failed: -22 1970/01/01 00:01:05 parsed 1 programs [ 66.329660][ T6866] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 70.256129][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.257754][ T53] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.259173][ T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.260821][ T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.262227][ T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.358317][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.358349][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.367097][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.367504][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.858405][ T6910] chnl_net:caif_netlink_parms(): no params data found [ 70.877167][ T6910] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.877243][ T6910] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.877298][ T6910] bridge_slave_0: entered allmulticast mode [ 70.877713][ T6910] bridge_slave_0: entered promiscuous mode [ 70.878430][ T6910] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.878449][ T6910] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.878498][ T6910] bridge_slave_1: entered allmulticast mode [ 70.878891][ T6910] bridge_slave_1: entered promiscuous mode [ 70.907916][ T6910] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.908758][ T6910] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.916331][ T6910] team0: Port device team_slave_0 added [ 70.917016][ T6910] team0: Port device team_slave_1 added [ 70.924097][ T6910] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.924119][ T6910] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.924131][ T6910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.924623][ T6910] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.924629][ T6910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.924641][ T6910] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.009974][ T6910] hsr_slave_0: entered promiscuous mode [ 71.010293][ T6910] hsr_slave_1: entered promiscuous mode [ 71.340077][ T6910] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.342588][ T6910] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.345865][ T6910] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.348873][ T6910] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.382869][ T6910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.389975][ T6910] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.392462][ T2127] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.392510][ T2127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.393063][ T2127] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.393078][ T2127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.440606][ T6910] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.466189][ T6910] veth0_vlan: entered promiscuous mode [ 71.491260][ T6910] veth1_vlan: entered promiscuous mode [ 71.500653][ T6910] veth0_macvtap: entered promiscuous mode [ 71.503236][ T6910] veth1_macvtap: entered promiscuous mode [ 71.509138][ T6910] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.515142][ T6910] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.522168][ T2206] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.522215][ T2206] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.522230][ T2206] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.522244][ T2206] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.735203][ T2127] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.778054][ T2127] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.826399][ T2127] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.871220][ T2127] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:01:12 executed programs: 0 [ 72.407406][ T6603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.409188][ T6603] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.412196][ T6603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.413058][ T6603] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.413243][ T6603] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.473894][ T7087] chnl_net:caif_netlink_parms(): no params data found [ 72.495592][ T7087] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.495684][ T7087] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.495760][ T7087] bridge_slave_0: entered allmulticast mode [ 72.496187][ T7087] bridge_slave_0: entered promiscuous mode [ 72.497452][ T7087] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.497514][ T7087] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.497579][ T7087] bridge_slave_1: entered allmulticast mode [ 72.497995][ T7087] bridge_slave_1: entered promiscuous mode [ 72.515136][ T7087] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.516217][ T7087] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.532495][ T7087] team0: Port device team_slave_0 added [ 72.534467][ T7087] team0: Port device team_slave_1 added [ 72.543435][ T7087] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.544686][ T7087] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.548955][ T7087] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.552058][ T7087] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.553409][ T7087] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.557632][ T7087] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.571492][ T7087] hsr_slave_0: entered promiscuous mode [ 72.573411][ T7087] hsr_slave_1: entered promiscuous mode [ 72.574943][ T7087] debugfs: 'hsr0' already exists in 'hsr' [ 72.576073][ T7087] Cannot create hsr debugfs directory [ 74.499890][ T6603] Bluetooth: hci0: command tx timeout [ 74.955078][ T2127] bridge_slave_1: left allmulticast mode [ 74.955114][ T2127] bridge_slave_1: left promiscuous mode [ 74.955216][ T2127] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.960644][ T2127] bridge_slave_0: left allmulticast mode [ 74.960671][ T2127] bridge_slave_0: left promiscuous mode [ 74.960922][ T2127] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.093356][ T2127] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 75.141495][ T2127] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 75.160368][ T2127] bond0 (unregistering): Released all slaves [ 75.234529][ T2127] hsr_slave_0: left promiscuous mode [ 75.234786][ T2127] hsr_slave_1: left promiscuous mode [ 75.235037][ T2127] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 75.235052][ T2127] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 75.235660][ T2127] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 75.235670][ T2127] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 75.241182][ T2127] veth1_macvtap: left promiscuous mode [ 75.241220][ T2127] veth0_macvtap: left promiscuous mode [ 75.241669][ T2127] veth1_vlan: left promiscuous mode [ 75.241708][ T2127] veth0_vlan: left promiscuous mode [ 75.368240][ T2127] team0 (unregistering): Port device team_slave_1 removed [ 75.376399][ T2127] team0 (unregistering): Port device team_slave_0 removed [ 75.616633][ T7087] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 75.617752][ T7087] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 75.620444][ T7087] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 75.622743][ T7087] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 75.644694][ T7087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.655041][ T7087] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.658681][ T1830] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.658729][ T1830] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.664050][ T1830] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.664091][ T1830] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.718542][ T7087] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.749221][ T7087] veth0_vlan: entered promiscuous mode [ 75.755020][ T7087] veth1_vlan: entered promiscuous mode [ 75.763699][ T7087] veth0_macvtap: entered promiscuous mode [ 75.764680][ T7087] veth1_macvtap: entered promiscuous mode [ 75.767731][ T7087] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.768628][ T7087] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.773197][ T42] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.773553][ T42] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.773570][ T42] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.773584][ T42] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.890623][ T2206] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.892006][ T2206] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.898870][ T2206] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.898907][ T2206] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.169694][ T2365] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 76.323181][ T2365] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 76.323228][ T2365] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 76.325834][ T2365] usb 1-1: New USB device found, idVendor=eb1a, idProduct=e303, bcdDevice=fc.a0 [ 76.325853][ T2365] usb 1-1: New USB device strings: Mfr=214, Product=33, SerialNumber=3 [ 76.325865][ T2365] usb 1-1: Product: syz [ 76.325871][ T2365] usb 1-1: Manufacturer: syz [ 76.325876][ T2365] usb 1-1: SerialNumber: syz [ 76.329316][ T2365] usb 1-1: config 0 descriptor?? [ 76.333311][ T2365] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (eb1a:e303, interface 0, class 0) [ 76.333326][ T2365] em28xx 1-1:0.0: Video interface 0 found: bulk [ 76.579577][ T6603] Bluetooth: hci0: command tx timeout [ 76.589795][ T2365] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 76.686435][ T2365] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 76.686474][ T2365] em28xx 1-1:0.0: board has no eeprom [ 76.739935][ T2365] em28xx 1-1:0.0: Identified as Kaiomy TVnPC U2 (card=63) [ 76.739965][ T2365] em28xx 1-1:0.0: analog set to bulk mode. [ 76.742959][ T2365] usb 1-1: USB disconnect, device number 2 [ 76.743451][ T2365] em28xx 1-1:0.0: Disconnecting em28xx [ 76.749987][ T7181] em28xx 1-1:0.0: Registering V4L2 extension [ 76.764650][ T7181] i2c i2c-1: Invalid 7-bit I2C address 0x00 [ 76.773801][ T7181] tuner: 1-0061: Tuner -1 found with type(s) Radio TV. [ 76.774284][ T7181] xc2028 1-0061: creating new instance [ 76.774293][ T7181] xc2028 1-0061: type set to XCeive xc2028/xc3028 tuner [ 76.774408][ T7181] em28xx 1-1:0.0: Config register raw data: 0xffffffed [ 76.774416][ T7181] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 76.774420][ T7181] em28xx 1-1:0.0: No AC97 audio processor [ 76.776525][ T7181] em28xx 1-1:0.0: Registered radio device as radio2 [ 76.776548][ T7181] usb 1-1: Decoder not found [ 76.776555][ T7181] em28xx 1-1:0.0: failed to create media graph [ 76.776569][ T7181] em28xx 1-1:0.0: V4L2 device radio2 deregistered [ 76.777541][ T7181] em28xx 1-1:0.0: V4L2 device video11 deregistered [ 76.778546][ T7181] xc2028 1-0061: destroying instance [ 76.779811][ T7181] em28xx 1-1:0.0: Registering input extension [ 76.780559][ T2365] em28xx 1-1:0.0: Closing input extension [ 76.784282][ T2365] em28xx 1-1:0.0: Freeing device [ 76.788698][ T7181] usb 1-1:0.0: Direc ** replaying previous printk message ** [ 76.788698][ T7181] usb 1-1:0.0: Direct firmware load for xc3028-v27.fw failed with error -2 [ 76.788740][ T7181] usb 1-1:0.0: Falling back to sysfs fallback for: xc3028-v27.fw [ 76.788790][ T7181] kobject: kobject_add_internal failed for firmware (error: -2 parent: 1-1:0.0) [ 76.788807][ T7181] firmware xc3028-v27.fw: fw_load_sysfs_fallback: device_register failed [ 76.788839][ T7181] ================================================================== [ 76.788843][ T7181] BUG: KASAN: slab-use-after-free in load_firmware_cb+0xbc/0x14f4 [ 76.788865][ T7181] Read of size 8 at addr ffff0000d76f1318 by task kworker/1:4/7181 [ 76.788870][ T7181] [ 76.788874][ T7181] CPU: 1 UID: 0 PID: 7181 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT [ 76.788880][ T7181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 76.788885][ T7181] Workqueue: events request_firmware_work_func [ 76.788897][ T7181] Call trace: [ 76.788899][ T7181] show_stack+0x2c/0x3c (C) [ 76.788907][ T7181] __dump_stack+0x30/0x40 [ 76.788912][ T7181] dump_stack_lvl+0xd8/0x12c [ 76.788916][ T7181] print_address_description+0xa8/0x238 [ 76.788924][ T7181] print_report+0x68/0x84 [ 76.788930][ T7181] kasan_report+0xb0/0x110 [ 76.788936][ T7181] __asan_report_load8_noabort+0x20/0x2c [ 76.788942][ T7181] load_firmware_cb+0xbc/0x14f4 [ 76.788948][ T7181] request_firmware_work_func+0xe8/0x19c [ 76.788954][ T7181] process_one_work+0x7e8/0x155c [ 76.788960][ T7181] worker_thread+0x958/0xed8 [ 76.788965][ T7181] kthread+0x5fc/0x75c [ 76.788972][ T7181] ret_from_fork+0x10/0x20 [ 76.788977][ T7181] [ 76.788979][ T7181] Allocated by task 7181: [ 76.788982][ T7181] kasan_save_track+0x40/0x78 [ 76.788986][ T7181] kasan_save_alloc_info+0x44/0x54 [ 76.788991][ T7181] __kasan_kmalloc+0x9c/0xb4 [ 76.788994][ T7181] __kmalloc_cache_noprof+0x3a4/0x65c [ 76.788999][ T7181] tuner_probe+0xc4/0x1690 [ 76.789004][ T7181] i2c_device_probe+0x868/0x9c8 [ 76.789010][ T7181] really_probe+0x3b4/0x944 [ 76.789016][ T7181] __driver_probe_device+0x180/0x2d4 [ 76.789022][ T7181] driver_probe_device+0x78/0x330 [ 76.789028][ T7181] __device_attach_driver+0x290/0x4e0 [ 76.789033][ T7181] bus_for_each_drv+0x220/0x2b4 [ 76.789038][ T7181] __device_attach+0x26c/0x388 [ 76.789044][ T7181] device_initial_probe+0x24/0x34 [ 76.789049][ T7181] bus_probe_device+0x178/0x240 [ 76.789054][ T7181] device_add+0x71c/0xa60 [ 76.789058][ T7181] device_register+0x28/0x38 [ 76.789062][ T7181] i2c_new_client_device+0x834/0xe9c [ 76.789067][ T7181] v4l2_i2c_new_subdev_board+0xb0/0x224 [ 76.789073][ T7181] v4l2_i2c_new_subdev+0x138/0x1c0 [ 76.789077][ T7181] em28xx_v4l2_init+0x6f4/0x2918 [ 76.789083][ T7181] em28xx_init_extension+0x10c/0x1b4 [ 76.789089][ T7181] request_module_async+0x68/0x98 [ 76.789094][ T7181] process_one_work+0x7e8/0x155c [ 76.789098][ T7181] worker_thread+0x958/0xed8 [ 76.789102][ T7181] kthread+0x5fc/0x75c [ 76.789108][ T7181] ret_from_fork+0x10/0x20 [ 76.789112][ T7181] [ 76.789113][ T7181] Freed by task 7181: [ 76.789116][ T7181] kasan_save_track+0x40/0x78 [ 76.789119][ T7181] __kasan_save_free_info+0x58/0x70 [ 76.789124][ T7181] __kasan_slab_free+0x74/0xa4 [ 76.789128][ T7181] kfree+0x184/0x600 [ 76.789132][ T7181] tuner_remove+0x1d8/0x1f4 [ 76.789136][ T7181] i2c_device_remove+0x8c/0x1d0 [ 76.789141][ T7181] device_release_driver_internal+0x3a8/0x68c [ 76.789147][ T7181] device_release_driver+0x28/0x38 [ 76.789152][ T7181] bus_remove_device+0x310/0x3b0 [ 76.789157][ T7181] device_del+0x47c/0x808 [ 76.789161][ T7181] device_unregister+0x2c/0xcc [ 76.789166][ T7181] i2c_unregister_device+0x1ac/0x208 [ 76.789171][ T7181] v4l2_i2c_subdev_unregister+0x68/0x78 [ 76.789175][ T7181] v4l2_device_unregister+0x170/0x248 [ 76.789180][ T7181] em28xx_v4l2_init+0x1328/0x2918 [ 76.789185][ T7181] em28xx_init_extension+0x10c/0x1b4 [ 76.789191][ T7181] request_module_async+0x68/0x98 [ 76.789196][ T7181] process_one_work+0x7e8/0x155c [ 76.789200][ T7181] worker_thread+0x958/0xed8 [ 76.789204][ T7181] kthread+0x5fc/0x75c [ 76.789209][ T7181] ret_from_fork+0x10/0x20 [ 76.789213][ T7181] [ 76.789214][ T7181] The buggy address belongs to the object at ffff0000d76f1000 [ 76.789214][ T7181] which belongs to the cache kmalloc-2k of size 2048 [ 76.789219][ T7181] The buggy address is located 792 bytes inside of [ 76.789219][ T7181] freed 2048-byte region [ffff0000d76f1000, ffff0000d76f1800) [ 76.789224][ T7181] [ 76.789225][ T7181] The buggy address belongs to the physical page: [ 76.789229][ T7181] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1176f0 [ 76.789234][ T7181] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 76.789239][ T7181] anon flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 76.789245][ T7181] page_type: f5(slab) [ 76.789250][ T7181] raw: 05ffc00000000040 ffff0000c0002000 0000000000000000 0000000000000001 [ 76.789254][ T7181] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 76.789258][ T7181] head: 05ffc00000000040 ffff0000c0002000 0000000000000000 0000000000000001 [ 76.789261][ T7181] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 76.789265][ T7181] head: 05ffc00000000003 fffffdffc35dbc01 00000000ffffffff 00000000ffffffff [ 76.789269][ T7181] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 76.789271][ T7181] page dumped because: kasan: bad access detected [ 76.789274][ T7181] [ 76.789275][ T7181] Memory state around the buggy address: [ 76.789277][ T7181] ffff0000d76f1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.789280][ T7181] ffff0000d76f1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.789283][ T7181] >ffff0000d76f1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.789286][ T7181] ^ [ 76.789288][ T7181] ffff0000d76f1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.789291][ T7181] ffff0000d76f1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.789293][ T7181] ================================================================== [ 76.789296][ T7181] Disabling lock debugging due to kernel taint [ 76.789305][ T7181] Unable to handle kernel paging request at virtual address dfff800000000005 [ 76.789309][ T7181] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 76.789313][ T7181] Mem abort info: [ 76.789315][ T7181] ESR = 0x0000000096000005 [ 76.789318][ T7181] EC = 0x25: DABT (current EL), IL = 32 bits [ 76.789321][ T7181] SET = 0, FnV = 0 [ 76.789324][ T7181] EA = 0, S1PTW = 0 [ 76.789327][ T7181] FSC = 0x05: level 1 translation fault [ 76.789330][ T7181] Data abort info: [ 76.789332][ T7181] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 76.789335][ T7181] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 76.789338][ T7181] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 76.789342][ T7181] [dfff800000000005] address between user and kernel address ranges [ 76.789346][ T7181] Internal error: Oops: 0000000096000005 [#1] SMP [ 76.889236][ T7181] Modules linked in: [ 76.889865][ T7181] CPU: 1 UID: 0 PID: 7181 Comm: kworker/1:4 Tainted: G B syzkaller #0 PREEMPT [ 76.891540][ T7181] Tainted: [B]=BAD_PAGE [ 76.892121][ T7181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 76.893549][ T7181] Workqueue: events request_firmware_work_func [ 76.894493][ T7181] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 76.895664][ T7181] pc : load_firmware_cb+0x22c/0x14f4 [ 76.896450][ T7181] lr : load_firmware_cb+0xe0/0x14f4 [ 76.897192][ T7181] sp : ffff80009d3d78a0 [ 76.897809][ T7181] x29: ffff80009d3d79f0 x28: 1ffff00011eb0278 x27: 0000000000000000 [ 76.898993][ T7181] x26: dfff800000000000 x25: ffff700013a7af28 x24: 1fffe0001aede263 [ 76.900184][ T7181] x23: ffff80009d3d7940 x22: 0000000000000000 x21: 0000000000000000 [ 76.901344][ T7181] x20: 0000000000000000 x19: ffff0000d76f1318 x18: 00000000ffffffff [ 76.902532][ T7181] x17: 3d3d3d3d3d3d3d3d x16: ffff800082debe40 x15: 0000000000000001 [ 76.903828][ T7181] x14: 1ffff000125cd314 x13: 0000000000000000 x12: 0000000000000000 [ 76.905040][ T7181] x11: ffff7000125cd315 x10: 0000000000ff0100 x9 : 0000000000000000 [ 76.906194][ T7181] x8 : 0000000000000005 x7 : 0000000000000001 x6 : ffff8000805653c0 [ 76.907351][ T7181] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000803c084c [ 76.908476][ T7181] x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000028 [ 76.909662][ T7181] Call trace: [ 76.910148][ T7181] load_firmware_cb+0x22c/0x14f4 (P) [ 76.910882][ T7181] request_firmware_work_func+0xe8/0x19c [ 76.911742][ T7181] process_one_work+0x7e8/0x155c [ 76.912486][ T7181] worker_thread+0x958/0xed8 [ 76.913147][ T7181] kthread+0x5fc/0x75c [ 76.913803][ T7181] ret_from_fork+0x10/0x20 [ 76.914522][ T7181] Code: b5fff65b f9403bf6 9100a2c0 d343fc08 (387a6908) [ 76.915639][ T7181] ---[ end trace 0000000000000000 ]--- [ 77.129141][ T7181] Kernel panic - not syncing: Oops: Fatal exception [ 77.130009][ T7181] SMP: stopping secondary CPUs [ 77.130640][ T7181] Kernel Offset: disabled [ 77.131227][ T7181] CPU features: 0x100000,0001e000,42702281,5427fea7 [ 77.132186][ T7181] Memory Limit: none [ 77.339004][ T7181] Rebooting in 86400 seconds..