last executing test programs: 12m32.368459755s ago: executing program 32 (id=4): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0xfffffffd}, 0x50) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) lseek(r0, 0xc, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) r3 = socket$rds(0x15, 0x5, 0x0) r4 = socket(0x23, 0x80805, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) write(0xffffffffffffffff, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x24622, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0xe, &(0x7f00000003c0)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00'], 0x0, 0x6, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0xb, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) listen(r4, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, &(0x7f0000001580)='/dev/fuse\x00') bind$rds(r3, 0x0, 0x0) sendmsg$inet(r3, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{0x0}], 0x1}, 0x0) sendmsg$rds(r3, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r3, 0x114, 0x1, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002ebd7000000000001400000018000180140002006e657464657673696d300000000000000800"], 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040800) 11m22.248683857s ago: executing program 0 (id=88): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000001c0), 0x140001, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x58, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x44, 0x1, [@m_sample={0x40, 0x0, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x48}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x58}}, 0x24040000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="080001", @ANYRES32=r3], 0x90}}, 0x4048801) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa8203, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000080)={0x20004, r5, 0x2}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = io_uring_setup(0x566d, &(0x7f0000000580)={0x0, 0x968, 0x4000, 0x1}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r10, 0xf, &(0x7f0000000540)={0x1002, 0x0, 0x0, 0x0, 0x28}, 0x20) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000440)={0x0, 0x0, r7}) close_range(r0, 0xffffffffffffffff, 0x0) 11m18.926728861s ago: executing program 0 (id=93): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) mq_open(0x0, 0x2, 0x48, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x2) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) clock_settime(0x8d71ca88fffffffd, 0x0) mount$overlay(0x0, &(0x7f0000000180)='.\x00', &(0x7f0000000000), 0x880, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './cgroup.cpu/cgroup.procs'}}]}) ioctl$CEC_RECEIVE(r3, 0xc0386106, &(0x7f0000000000)={0x4, 0x80007, 0x9, 0xfffffffe, 0x8, 0x16, "260000000100000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) 11m15.438227999s ago: executing program 0 (id=106): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, 0x0, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r4, 0x80106f53, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x44, '\x00', @data=0x8, 0x8}, {0x6, '\x00', @buffer={"8f01000000000000003acd90d11555827d3ac01c0075e71885aa05a1f7a01e83", 0x20}, 0x1c}]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b00000000000400"], 0x44}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 11m11.02538751s ago: executing program 0 (id=100): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000540)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000003380), 0x0, 0x100, 0x0) r4 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0xd, 0x0, 0x6800c101}, 0x40000) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x328, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x388) r6 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @mcast1, 0x9}, 0x1c) dup(r4) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000200)=0x237a, 0x4) setsockopt$inet6_int(r7, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) dup2(r3, r3) sendmmsg$inet6(r7, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x3e07b7b9}, 0x1c, 0x0}}], 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r7, 0x29, 0x40, &(0x7f0000000100)={'raw\x00', 0x0, [0x9, 0x4, 0xffffffff, 0xe7, 0xd]}, 0x0) recvmmsg(r7, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/35, 0x23}, 0x7}], 0x40000cb, 0x12141, 0x0) 11m8.211486722s ago: executing program 0 (id=104): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000cc0)=ANY=[@ANYBLOB="0200000002004e21e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000002004e23ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e217f00000100"/459], 0x210) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) r6 = epoll_create1(0x0) epoll_pwait(r6, &(0x7f0000000000)=[{}], 0x1, 0x7c0e, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cgroup.stat\x00', 0x0, 0x0) openat2(r7, &(0x7f0000000180)='./file0\x00', &(0x7f0000001200)={0x20100, 0x0, 0x5}, 0x18) close_range(r3, 0xffffffffffffffff, 0x0) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x101342, 0x105) write$cgroup_int(r8, &(0x7f0000000000)=0x3ff, 0x12) ioctl$SNDCTL_FM_4OP_ENABLE(r1, 0x4004510f, &(0x7f0000000040)=0xfffffff9) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f00000001c0)={{0x3, 0x200, 0x85c2, 0x1, 0x0, 0x4}, 0x348, [0x1, 0x84, 0x1, 0x9, 0xffffffff, 0x9, 0xff, 0x7, 0x7, 0x0, 0x7, 0x5, 0x9c, 0x3, 0x6, 0xb9, 0x4, 0x6, 0x6, 0x7, 0x8, 0x8, 0x9, 0x1, 0x4c1b, 0x3, 0x7, 0x9, 0x4, 0x8295, 0x80000001, 0xb5, 0x8, 0x7, 0x8, 0x6, 0x7fffffff, 0x9, 0x1, 0x2, 0x200004, 0x8, 0x2, 0x5, 0x81, 0xcc88, 0x2a6f, 0x10000, 0x6a, 0x0, 0x17, 0x800, 0xfc, 0x8, 0x2, 0x400, 0x0, 0xb22, 0x4, 0xc9a, 0xfff, 0x401, 0x8, 0x109c7d, 0x5, 0x0, 0x6, 0x7fff, 0x0, 0x3, 0xffff8382, 0x7fffffff, 0x1ff, 0x6, 0x9, 0x8, 0x0, 0xc13, 0x8, 0x8c, 0x7, 0x400, 0x2, 0x2, 0x10, 0x6, 0x8000, 0xd3, 0x7f, 0x16cf, 0x3, 0x8, 0x2, 0xd7b, 0x9, 0x7fff, 0xffffff5c, 0x1, 0x666, 0x9, 0x8, 0x7, 0x3, 0x3, 0x3, 0x1, 0x3, 0x368, 0x8, 0x3, 0x6, 0x2, 0x6, 0x10, 0x70955bc4, 0x1, 0x2, 0xfffffffb, 0x0, 0x2, 0x3, 0xfffff38f, 0x2, 0xa000000, 0xeb, 0x5b2, 0x4, 0x960, 0x6, 0x79, 0x3, 0x30, 0x3, 0x7, 0x1, 0x7fff, 0xf2, 0x5, 0x7, 0xff, 0x4, 0x2, 0x12e4, 0x3, 0x0, 0x101, 0x0, 0x7, 0x40, 0x0, 0x1, 0x3, 0x2, 0xffffff00, 0x702, 0x7, 0x800, 0x81, 0xfffffff7, 0x7, 0x1, 0xd, 0x40, 0x10000, 0x3, 0xffffffff, 0x23db, 0x6, 0x0, 0x5, 0x7, 0xffffffff, 0x1, 0x7, 0x6, 0x2, 0x200040, 0xb7, 0x6, 0x638, 0x0, 0x800, 0x6, 0x6, 0x0, 0x8, 0x7, 0x2, 0x8, 0x2, 0xfffffffb, 0x6, 0x80, 0xffff7fff, 0x4, 0x200, 0x7f, 0x1, 0x5, 0x8, 0x1, 0xfffffffa, 0xc, 0x50c2, 0xc1ed, 0x401, 0x3, 0x7, 0x101, 0x800, 0x5, 0x5, 0x8, 0x1, 0x1, 0xfffffff8, 0xe9, 0x1, 0x7f, 0x7ff, 0x0, 0x7, 0xac, 0x80000000, 0x81, 0x80000001, 0xffffffff, 0x80, 0x3ff, 0xa639, 0x0, 0x53647e6f, 0x2, 0xd792, 0x14b, 0x4, 0x3, 0xb36, 0xa, 0x1, 0x4, 0x94, 0x5f, 0x1, 0x8, 0xfffffff8, 0x7fff, 0xf, 0x400, 0x7f, 0x80000001, 0xd08, 0x2, 0x1, 0x6, 0x9, 0x7d9, 0x1, 0x3, 0x3, 0x8, 0x6, 0x400, 0x86, 0x2, 0x1000, 0xbdf6, 0x41bf, 0xc, 0x2487005d, 0x2, 0x1, 0xaa1, 0x6, 0x80000001, 0x9, 0xe, 0x2, 0x0, 0x4, 0x401, 0x5, 0x87a0, 0x54, 0x5, 0x3, 0xf, 0x7fffffff, 0x0, 0x8d, 0xe, 0x3, 0xb6, 0x5, 0x9, 0x100, 0xfff, 0x10, 0x1, 0x6, 0xb7, 0x7, 0xfffffffa, 0x4, 0x5, 0x81, 0x6, 0x5, 0xdcdf, 0x7ff, 0x9, 0xffffffe3, 0x74d, 0x3, 0xf1c, 0x8021, 0xffffffff, 0x70, 0x3, 0x7, 0x4, 0x1, 0x0, 0x4, 0x7aed, 0x4, 0x8, 0xe, 0xffffffc0, 0x8b7, 0x5, 0x5, 0x200, 0x40, 0x3fd, 0x4, 0x0, 0xa, 0xc, 0x7, 0xe324, 0xf, 0x7, 0x97a, 0x7fff, 0xffffffff, 0x8, 0x7, 0x40000000, 0x7, 0x6, 0x7, 0x6f007526, 0xa, 0x80000000, 0x0, 0x200, 0xaeb, 0x315c, 0x9, 0x1000, 0xd, 0x5, 0x0, 0xf0f, 0x6, 0x20, 0xffffffff, 0x9, 0x2, 0x9, 0x4, 0x6, 0xb37, 0x8, 0x5, 0x8, 0xa6b7, 0x10001, 0x2, 0x1, 0xf, 0x8, 0x8, 0x3ff, 0x1, 0x4, 0xbe, 0x5, 0x10001, 0x7fa, 0xe7ad, 0x4, 0x6, 0x6, 0x81, 0x10000, 0x3, 0xbd7, 0x71e5119d, 0x62, 0xffd, 0x5, 0x6, 0x4, 0xc, 0x3, 0x7, 0x400, 0x4, 0x400277e, 0xe4a4, 0x3, 0x4, 0x3, 0x4, 0x6, 0x6, 0x7, 0x6, 0x8, 0x5, 0x3ff, 0x9ad9, 0x8, 0x1, 0x0, 0x3, 0x400, 0x2, 0x9, 0x6, 0x40, 0x1000, 0x82, 0x4, 0x1000, 0x8, 0x3d, 0x2, 0xe, 0x4, 0x3, 0xfffffffc, 0x4, 0x8, 0x10, 0x6, 0x9, 0xffffffff, 0x10, 0x0, 0x1, 0x9225, 0x3be, 0xd, 0x401, 0x81, 0x13, 0x0, 0x80000000, 0x1, 0x9f18, 0x2, 0x8f86, 0x417db73f, 0x7, 0x1, 0x7, 0x6, 0x3, 0x6, 0x7, 0x0, 0xd, 0x0, 0x7, 0x7, 0x2, 0x8, 0x5, 0x0, 0xab, 0x5, 0x94, 0xb3ab, 0x5ae, 0x2, 0x40, 0x5, 0x0, 0x8001, 0x8, 0x800, 0xb, 0xa4, 0x50, 0x8, 0x99, 0x10, 0x5, 0x100, 0xfffff800, 0x5, 0xca, 0x0, 0x4, 0x6, 0x7ff, 0x6e15d2ec, 0x7, 0x5, 0x8, 0x7ba, 0x21c0, 0xe64, 0xa, 0x7, 0x6d4, 0x5, 0x3, 0x7fff, 0x121, 0x9, 0xe6d8, 0x1000, 0x1ff, 0x42db5dac, 0xffff, 0x6, 0xfffffff8, 0x3ff, 0xfcf, 0x1000, 0x7, 0x2, 0x2, 0x6, 0x7, 0x2, 0x7, 0x80000001, 0x7, 0x8, 0x7, 0xfffff000, 0xfffffffe, 0x5, 0x5, 0x7, 0x80000001, 0x4, 0x2, 0x53f, 0x8, 0x6, 0x0, 0xfffffff8, 0x6, 0x8, 0x9, 0x8, 0x6d, 0x48, 0x8001, 0x1, 0x1, 0x2e7a, 0x8, 0x4, 0x10000, 0x5, 0x1ff, 0x1, 0x8, 0xfffffffd, 0xc217, 0x6, 0x3, 0x2, 0x3, 0xba7a, 0x6d9c7f55, 0x4, 0x9, 0x1000, 0x3, 0x10001, 0x2, 0x2, 0x7, 0x6, 0x2, 0x1, 0x27a, 0x9, 0x2, 0xde26, 0x99, 0xfffffffe, 0x5, 0x1, 0xdba4b27, 0x6, 0x100, 0x0, 0x9, 0x7, 0x1, 0x7ff, 0x0, 0x2, 0xffff9369, 0x4, 0xff, 0x6, 0xed1, 0x80, 0x0, 0x3, 0x80000001, 0xe, 0x9, 0x1, 0xffff, 0x6, 0x9, 0x4, 0xef3, 0x1, 0xfffffffb, 0x7, 0x40, 0x6, 0x4, 0x9, 0x7f, 0x3, 0xc4d1, 0x3, 0x2, 0xc15e, 0x6, 0x0, 0x6, 0x8, 0xffffffff, 0x8, 0x401, 0x0, 0x10, 0x3, 0x2, 0x4, 0x50d, 0x3, 0x4b, 0x7, 0x0, 0x2, 0x75, 0x80, 0x1, 0xdb, 0x401, 0x6, 0x1, 0x0, 0x6, 0xbf0d, 0x18, 0x1, 0x5, 0x95, 0x7fff, 0xe7, 0xa, 0x4, 0x0, 0xffffff16, 0x10, 0xae25, 0x908, 0x78e, 0x6, 0x1, 0xb2b7, 0xc, 0x7, 0x0, 0x8, 0x9, 0x8, 0x73, 0x558, 0xfffffffe, 0x5df, 0x1, 0x7, 0x81, 0xffffffaa, 0x3, 0x6, 0xd, 0xffffc4e6, 0xffff0001, 0x4, 0x5, 0x10001, 0x5, 0x3, 0x0, 0x6, 0x4, 0x3, 0x8, 0x3, 0x8, 0x5, 0x3, 0xc3f, 0x10, 0x2, 0x6, 0x6, 0xaed, 0x4, 0x9, 0x7, 0x7, 0x8, 0xff, 0x8000, 0x5, 0x9, 0x4, 0x5da, 0x80000000, 0x80000000, 0x4, 0x8, 0xab84, 0xb4, 0xfffffc00, 0x908b, 0x8, 0xc9, 0xfffffffe, 0x1, 0x3, 0x8, 0xfffffffb, 0x0, 0xf8, 0xfffffff0, 0x637, 0x6, 0x4, 0xd, 0x80, 0xfffffff9, 0xfffffb6f, 0x0, 0x120e, 0x7, 0x0, 0x6, 0x2, 0x1000, 0x6, 0x6, 0x2, 0xd, 0x3ff, 0x5e18, 0xf, 0x9ebe, 0x7, 0x2, 0x1, 0x7, 0x7, 0x9e, 0x8, 0xedd3, 0x9, 0x1, 0xffffffff, 0x5, 0x1ff, 0x8, 0x1, 0x5, 0x2, 0x40, 0xe, 0x4, 0xc, 0xc65, 0x40, 0x4, 0xbb7d, 0x10, 0x79, 0x1ff, 0x8, 0x6, 0x80, 0x2, 0xf, 0x7, 0x80000000, 0x6e0, 0xfffffffe, 0x5, 0xd1, 0x9, 0x8, 0xfffffe00, 0x0, 0x1, 0x4, 0xe449, 0x4, 0x40, 0x37, 0x1000, 0x0, 0xca, 0xffff, 0x10001, 0xfffff891, 0x5, 0xfe, 0x200, 0xffffff81, 0xfffffff8, 0x4, 0x101, 0x68f0, 0xbfb, 0xdfe2, 0x0, 0x4, 0x9e74, 0x8, 0x7, 0x3ff, 0x80, 0xde7, 0x5, 0x51, 0x0, 0xb, 0x3, 0xad, 0x8, 0x2, 0x1, 0x8000, 0x4, 0x7, 0x8, 0x4, 0x10, 0x80000000, 0x6, 0x1400000, 0xf7, 0x8, 0x81, 0x4, 0x6790, 0x9, 0xfa6, 0x400, 0x7f, 0x3ff, 0x4, 0x2, 0x9, 0x6, 0x9107, 0x1, 0xcac, 0x40, 0x7, 0xc, 0x1, 0x5, 0x7, 0xb923, 0x2, 0xffff3818, 0x3, 0x1, 0x5, 0xe39, 0x4, 0x6, 0x7ff, 0xfff, 0x5, 0x5, 0x1, 0x101, 0xfffffff9, 0x3, 0x1, 0x400, 0xe59, 0x6, 0x8, 0x3ff, 0x6, 0x3ff, 0x9, 0x2, 0x6, 0x12dd, 0x0, 0x10, 0x6, 0x40, 0x0, 0xffffff80, 0x3, 0x0, 0x1, 0x7, 0x997, 0x7, 0x7bffffff, 0x81, 0x1, 0xe, 0x7e, 0x9, 0x3, 0x5, 0x7c, 0x4, 0x9, 0x3, 0x0, 0x1ff, 0x4, 0x926a, 0x9, 0x6, 0xea, 0x9, 0x9, 0xc0000, 0xf4d, 0x80000001, 0x1, 0x2, 0x1, 0x3, 0x7fff, 0x3, 0x1, 0x5851, 0x9fc, 0x0, 0x6, 0xcf4, 0x6, 0x1, 0xffb8, 0x0, 0x10001, 0x7, 0x8, 0x7b, 0x6, 0x89, 0xfffc0000, 0x9, 0x1, 0x4, 0xb, 0x9, 0x3, 0x5, 0xc2, 0x5, 0x0, 0x9, 0x3, 0x2c33, 0x5, 0x4, 0x0, 0x5, 0x9, 0x1, 0xa, 0x819, 0x5, 0x4, 0xeaa8, 0xb, 0x5, 0x8000, 0xffff, 0x8, 0x7fff, 0x10, 0x3, 0x6, 0xffffffff, 0x7, 0xba, 0x1, 0x2, 0xc7c, 0x8, 0xdc, 0x3, 0x5, 0x9, 0x1]}) openat$vicodec0(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000024c0), &(0x7f0000000000), 0xb97a}, 0x38) 11m1.920809281s ago: executing program 0 (id=119): r0 = add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) openat$damon_target_ids(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = socket(0xa, 0x3, 0x87) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f00000001c0)={0x20000000, 0xc6f, 0x101}) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@local, 0x78, r5}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8936, &(0x7f0000000000)) keyctl$negate(0xd, 0x0, 0x7, r0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, 0x0, &(0x7f0000000100)) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') r7 = socket$rxrpc(0x21, 0x2, 0x2) getsockopt(r7, 0x110, 0x6, 0x0, 0x0) keyctl$link(0x8, r0, r0) pwritev(r6, &(0x7f0000000280)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x4a628) 10m45.408750948s ago: executing program 33 (id=119): r0 = add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) openat$damon_target_ids(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = socket(0xa, 0x3, 0x87) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f00000001c0)={0x20000000, 0xc6f, 0x101}) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@local, 0x78, r5}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x8936, &(0x7f0000000000)) keyctl$negate(0xd, 0x0, 0x7, r0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, 0x0, &(0x7f0000000100)) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') r7 = socket$rxrpc(0x21, 0x2, 0x2) getsockopt(r7, 0x110, 0x6, 0x0, 0x0) keyctl$link(0x8, r0, r0) pwritev(r6, &(0x7f0000000280)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x4a628) 10m4.54742413s ago: executing program 4 (id=163): r0 = add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) openat$damon_target_ids(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket(0xa, 0x3, 0x87) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f00000001c0)={0x20000000, 0xc6f, 0x101}) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={@local, 0x78, r6}) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x8936, &(0x7f0000000000)) keyctl$negate(0xd, 0x0, 0x7, r0) getsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, 0x0, &(0x7f0000000100)) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') r8 = socket$rxrpc(0x21, 0x2, 0x2) getsockopt(r8, 0x110, 0x6, 0x0, 0x0) keyctl$link(0x8, r0, r0) pwritev(r7, &(0x7f0000000280)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) pread64(r7, 0x0, 0x0, 0x4a628) 9m58.454042725s ago: executing program 4 (id=175): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000240)={0x2, 0x4, 0x0, 0x0, 0x12, "0062ba7d820700000000000000000000096304"}) syz_open_pts(0xffffffffffffffff, 0x1c882) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYRES16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x11, 0x2}, 0x0, 0x0, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r5, 0x29, 0x44, &(0x7f0000000000)={'icmp6\x00'}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r6, &(0x7f0000000000)={0xa, 0xfffe, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x5}, 0x1c) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x36, 0x0, 0x0, 0x20000000}, 0xa}], 0x400000000000172, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, 0x0, 0x0) 9m56.012991256s ago: executing program 4 (id=167): openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$tmpfs(0x0, 0x0, 0x0, 0x86022, &(0x7f0000000580)=ANY=[@ANYBLOB="61756469742c67e1506910fc83995f747970653d696d9e2343237846886d617369672c736d61636b667368"]) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) openat$null(0xffffff9c, 0x0, 0x101201, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000100)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) fanotify_init(0x200, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000010"], 0xfe44, 0x0) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x4c, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r7 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r7, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r6, 0x0, 0x0}) 9m51.874443931s ago: executing program 4 (id=169): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r2, 0x6, &(0x7f0000002000)={0x1}) fcntl$lock(r2, 0x26, &(0x7f00000031c0)={0x1}) fcntl$lock(r2, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}) fcntl$lock(r2, 0x7, &(0x7f0000000200)={0x0, 0x2, 0x8, 0x7}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_ORPHAN_MASK={0x8, 0xa, 0xd3b}, @TCA_FQ_QUANTUM={0x8, 0x3, 0xf1ff}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x8}]}}]}, 0x48}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = socket$key(0xf, 0x3, 0x2) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r8, 0x80045104, &(0x7f0000001180)) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r8, 0x40047211, &(0x7f00000000c0)) sendmsg$key(r7, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020300020c00000027bd706971000000030005002b800000020010000000000000000000000000000200010000000000000005fc010000e0030005000000000002000000ac1414aa0000000000000000020008000800000034"], 0x60}, 0x1, 0x7}, 0x0) ioctl$sock_netdev_private(r5, 0x89fa, &(0x7f0000000140)="480998b9d0e5d0ac42bcfabb57989b03d2d4249075ce3b19d414626408c4c6500ea08976d68840579843e015272a7ce160ba68a4e37889a7770fda12d9ccd5bbde7eba20642f715f2e9018c56bf4a7e6a8a6dff9ffa77886394c920a75c236595cec54febfbe3081491f28064bb65e7ac4458fd393575b5402b0f76b30353251c036166e86fd58") r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) timer_create(0x3, &(0x7f0000000000)={0x0, 0x1a, 0x1, @tid=r9}, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000200)={r10, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x20) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000100)={r10, 0x1, 0x6, @broadcast}, 0x10) sendmsg$key(r7, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000007c0)={0x2, 0xb, 0x6, 0x7, 0x1c, 0x0, 0x70bd2d, 0x25dfdbfc, [@sadb_ident={0x2, 0xa, 0x4, 0x0, 0x628}, @sadb_sa={0x2, 0x1, 0x4d5, 0x62, 0x6, 0x74, 0x4, 0x1}, @sadb_x_sec_ctx={0xb, 0x18, 0xb, 0x20, 0x4d, "373e20d80cf0ac8333916e2ac1e0c23637223f325fa5768daab5ef22e2c4f10b9368af1a2a175db48a54cb92e77ade9d389318f91dc2425fe5dfdacdf2505d7b983d17643261c923dc11da7346"}, @sadb_lifetime={0x4, 0x4, 0x7, 0x5, 0x3, 0x9}, @sadb_address={0x3, 0x5, 0xeb, 0x80, 0x0, @in={0x2, 0x4e23, @multicast2}}, @sadb_ident={0x2, 0xa, 0x8, 0x0, 0x2}, @sadb_ident={0x2, 0xb, 0x7e02, 0x0, 0x10000}]}, 0xe0}}, 0x0) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000040)={r4, 0x11, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c000000100001002cbd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="a821000000000000140003006e657464657673696d30000000000200140014006e657464657673696d300000"], 0x7c}}, 0x0) 9m46.959428265s ago: executing program 4 (id=178): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0xe0) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="cd2f8a"], 0x1c}, 0x1, 0x0, 0x0, 0x20000890}, 0x40080) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x8001, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40186f40, &(0x7f0000000180)={0x8, 0x0, 0xe3f, 0x1, '\x00', 0x10003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat(0xffffffffffffff9c, 0x0, 0x40, 0x1) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x50000, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r3, r3, 0x0, 0x200000) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x8d, 0x8000, 0x0, 0x11030, 0xffffffffffffffff, 0xd, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1, 0x9, @void, @value, @value=r0}, 0x50) sendfile(r4, r4, 0x0, 0x1002000ff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000200)=r5) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000300)=@generic={&(0x7f0000000240)='./cgroup.cpu/cgroup.procs\x00'}, 0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="3103fc1f0000000000400800000008000300", @ANYRES32=r8], 0x24}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) 9m43.22531659s ago: executing program 4 (id=180): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x1, 0xffffffff}, 0x14}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') io_setup(0x6, &(0x7f0000001380)=0x0) io_submit(r3, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x8001, r2, 0x0}]) write$vga_arbiter(r1, &(0x7f0000000200)=@unlock_all, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x2000278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000000)) syz_usbip_server_init(0x6) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r6, 0x107, 0x5, 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r0, 0x0, 0x5004) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) 9m25.310015992s ago: executing program 34 (id=180): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x1, 0xffffffff}, 0x14}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') io_setup(0x6, &(0x7f0000001380)=0x0) io_submit(r3, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x8001, r2, 0x0}]) write$vga_arbiter(r1, &(0x7f0000000200)=@unlock_all, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x2000278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000000)) syz_usbip_server_init(0x6) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r6, 0x107, 0x5, 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r0, 0x0, 0x5004) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) 6m29.168129203s ago: executing program 6 (id=421): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r4, &(0x7f0000000040)={0xa, 0x0, 0xbf, @empty, 0x4, 0x100}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$l2tp6(r4, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c0000000406010800000000000000000200000205000100070000008d19e0da1eab44795dee96d502b9dd1c0facca66750302e07ad5035f33ea1709268fc24f1c6db1613898b0be3c12717a4c67"], 0x1c}, 0x1, 0x0, 0x0, 0x20000810}, 0x80d0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c000280140003002000000000000000030007116b61979e0c000100636c75737465720008000240000000000900010073797a30000000000900020073797a32"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_open_dev$loop(0x0, 0x3, 0x2000) ioctl$LOOP_SET_CAPACITY(r7, 0x4c07) sendmmsg$inet6(r4, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0, 0x0, 0x0, 0x0, 0xc0fe}}], 0x17fd147c801ae9af, 0xff14) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000040)) 6m27.273950292s ago: executing program 6 (id=424): socket$inet6(0xa, 0x2, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffd, 0x0, 0x0, 0x8, 0xfc, 0x4, 0xe9, 0x7, 0x1, 0x9, 0x3, 0x6, 0x9}, {0x0, 0x0, 0x0, 0x40, 0x10, 0x6, 0xfd, 0xfc, 0x1, 0xfd, 0x47}, {0x3, 0xa, 0x22, 0x8, 0x40, 0x0, 0x4, 0x1, 0x2, 0x2, 0x0, 0x0, 0xfffffffffffffffd}], 0x1ffffff}) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8000000001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x82) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r2, &(0x7f0000006300), 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x22110039, 0x1000, 0x0, 0x7ff, 0x58, 0x0, 0x0, 0x6, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r5, &(0x7f0000000040)=0x8000000001cb, 0x12) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x100000000, 0x0) 6m23.088163917s ago: executing program 6 (id=437): syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="040e04f34120", @ANYRESDEC], 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='myproc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x0, 0x0) read(r0, &(0x7f0000000500), 0xfa0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000380)={0x2140280, 0x0, 0x0, 0x0, {0x20080021}, 0x0, 0x0, 0x0, &(0x7f0000000340)}, 0x58) openat(0xffffffffffffff9c, &(0x7f00000001c0)='myproc\x00', 0x280, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='Midi1\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='2\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000003c0)='dummy_udc.0\n', 0xc) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) userfaultfd(0x80001) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000180)={0x200005, 0x200027, 0x801, 0x0, 0x7}) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8) 6m21.699804712s ago: executing program 6 (id=431): execve(&(0x7f0000000980)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) futex(&(0x7f0000000040)=0x1, 0x7, 0x2, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f00000000c0)=0x1, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x28101) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x400, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_AUTORATE={0x8}]}}]}, 0x3c}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x28383, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ftruncate(0xffffffffffffffff, 0x51a9497) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffc, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0xa0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, {0x0, 0x40000000000009, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffff8}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x82520, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000900), r0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_delneigh={0x28, 0x1e, 0x1, 0x0, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x0, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}}, 0x4040080) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000640)={'tunl0\x00', &(0x7f00000003c0)={'erspan0\x00', r3, 0x8, 0x10, 0x3, 0x8, {{0x32, 0x4, 0x1, 0xc, 0xc8, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast1, @rand_addr=0x64010102, {[@timestamp_addr={0x44, 0x4c, 0xca, 0x1, 0x9, [{@remote, 0x3}, {@private=0xa010102, 0xfff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@rand_addr=0x64010102, 0x10}, {@remote, 0x10001}, {@loopback, 0x15}, {@local, 0x1000}, {@private=0xa010100, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xfffffff8}]}, @timestamp_addr={0x44, 0xc, 0x9f, 0x1, 0xf, [{@loopback}]}, @ssrr={0x89, 0x1b, 0x9b, [@private=0xa010101, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x23}, @broadcast, @remote, @empty]}, @lsrr={0x83, 0xb, 0xa0, [@multicast1, @empty]}, @rr={0x7, 0xf, 0xa1, [@multicast1, @private=0xa010102, @loopback]}, @rr={0x7, 0x1f, 0x97, [@loopback, @broadcast, @broadcast, @remote, @empty, @multicast1, @multicast1]}, @timestamp={0x44, 0x8, 0xa2, 0x0, 0x0, [0x101]}]}}}}}) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000740)={&(0x7f0000000140), 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x4c, r7, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r9}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @remote}, @FOU_ATTR_PEER_V4={0x8, 0x8, @private=0xa010100}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x1) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000000)={0x18, r7, 0x603, 0x70bd2b, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4010}, 0x20004044) syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) 6m17.527327078s ago: executing program 6 (id=438): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x80000100008f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) fcntl$setown(0xffffffffffffffff, 0x8, r5) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) mount$bind(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x0, 0x0, &(0x7f00000049c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002580)={0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0}) 6m15.217582526s ago: executing program 6 (id=440): syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000010, &(0x7f0000000440)=ANY=[], 0x1, 0x703, &(0x7f00000011c0)="$eJzs3c1vHGcdB/DvrNeut1SN0ya0QkGYRCpIEYkTK4VwwSCEcqhQVQ49W4nTWNkkVeKitELgAoITEof+AQXJNw4IiXtQuHAJt1594FAJiUvEIepl0czOrnftXb8kjp2IzycazzPzvMxvf/vMjHed1Qb4v3XpdJr3UuTS6bfultvra/Pt9bX5F+rqdpKy3Eia3VWKm0lxP1ko64t0K4q6fTHuOJ8sX3zns4frn3e3mvVStZ/Yrt8II9qu1ktm6/FmR/ac3O0hVuvw8lKSy/V62NRuxxpqWCbtVL2GQ9cZ1khndS/d93LeAs+Y3t2p6N43t5hJXkwyXf8ekPrq0Di4CPfV13uFPV3lAAAA4Dn14NZhRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPn+r7/1v9zUZ3VzKbovf9/1O9fXX5GbSw65b3nmocAAAAAAAAAHAwvvYoj3I3L5flySSdovqb/8mq8li+6CRfyge5k6XczpnczWJWspLbOZdkZmCgqbuLKyu3z/V7lkb3PD+yZ7m3OjQAAAAAAAAA8Bh+mVb37/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPCsKJKJ7qpajtXrzKTRzEZdVpN/Jpk67Hj3oBi1897BxwEAAABPZPox+hx5lEe5m5d7252ies3/5er18nQ+yM2sZDkraWcpV+rX0OWr/sb62nx7fW3+RrmU28Pjfv8/ewpjqh5hotoadeTXqxatXM1ytedMLlfBXEmje+xT/TcjujHVcQ34uIyp+F5tl5E167SWB/v9uHcR9sXwWxGNbVq2NoJL+hmZq2Mrex7tZqCo3qgpMzI8wOZnZ8vBmkNbM1WTyf6RzqXRT/axXq73Mecv1uvy8fzmqeZ8OxP1ejAX/Uw0UmXifG/2lefM9plIvvHXP717rX3z+rWrd04fzkN6DBNj9m+eE/MDmXjtuc5Ec4/t56pMHO9vX8qP8pOczmzezu0s56dZzEqW0qnrF+v5XP6c2T5TC0Nbb+8UyVT9vHSfs93ENJsfVqXFnKz6vpzlFLmVK1nKm9W/8zmXb+dCLuTiwDN8fGzc1WOrzvrG5rO+90z/bWTwp75ZF8qr2283rnIL2z3icbNzv3Sv/WVejw7ktTvrH/ZbHR04D+YGsvRKLzuTIwffem0c3W5Q8yt1oTzGr3a4TxysmToT5QnUu0v0onu1m4lm/+483PUPneqht292OtcW3x8z/uqm7TfqdTmt1r66U+uekSkutu+zV+V8eSXT9ZVkeHaUda/2rzIDdZ2NudytG77jlv2OV3VF0TtTf5xb1QTYeqZO1b/DbR3pfFX32qa6E/U1vKx7faBu6Pet3Eo7V/YpRwDst3+82y/O5MWp1r9bD1qftn7dutZ6a/oHL3znhRNTmfz75HebcxNvNE4Uf8mn+fnG638AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODx3fnwo+uL7SJJVWgv3b7TKxypm2zsGV9obeme8Y3/9SDZXFXU38Yzqtf1+lsKdg7j2SlMJxnaU33P0YGH0docxpZC5xfJgednatup9buy0NzV070wtOfPWwf8eOd4JrJpHmbMPDyYQiNPZeTOkTEzYSKjJ8BhXI2Ag3R25cb7Z+98+NG3lm8svrf03tLNyQsXLs5dvPDm/Nmry+2lue7Pw44SeBo2bvqHHQkAAAAAAAAAAACwW6M+KnDypZ0+NLKl0MiWj/RM+Z+FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwL64dDrNeylybu7MXLm9vjbfLpdeeaNlM0mjkRQ/S4r7yUK6S2YGhivyx/vpjDjOJ8sX3/ns4frnG2M1u+2TRr0eb/vaJKv1ktkkE/X6CQyNd/mJxyv+23sMZcK+6HQ6C08WH+yP/wUAAP//5lTkuw==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x8a002, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r2], 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e00"], 0x24}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000002080)={0x8, 0x86}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000040), 0x0) timer_create(0x3, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) close(0x3) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) ioctl$EVIOCSABS20(r6, 0x40044591, 0x0) read$FUSE(r5, &(0x7f0000000040)={0x2020}, 0x9d2) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f00000001c0)={0x4, 0x0, 0x0, 'queue0\x00'}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x1, 0x80) open$dir(&(0x7f0000000100)='./file0\x00', 0x6400, 0x140) 5m57.535791811s ago: executing program 35 (id=440): syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000010, &(0x7f0000000440)=ANY=[], 0x1, 0x703, &(0x7f00000011c0)="$eJzs3c1vHGcdB/DvrNeut1SN0ya0QkGYRCpIEYkTK4VwwSCEcqhQVQ49W4nTWNkkVeKitELgAoITEof+AQXJNw4IiXtQuHAJt1594FAJiUvEIepl0czOrnftXb8kjp2IzycazzPzvMxvf/vMjHed1Qb4v3XpdJr3UuTS6bfultvra/Pt9bX5F+rqdpKy3Eia3VWKm0lxP1ko64t0K4q6fTHuOJ8sX3zns4frn3e3mvVStZ/Yrt8II9qu1ktm6/FmR/ac3O0hVuvw8lKSy/V62NRuxxpqWCbtVL2GQ9cZ1khndS/d93LeAs+Y3t2p6N43t5hJXkwyXf8ekPrq0Di4CPfV13uFPV3lAAAA4Dn14NZhRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADPn+r7/1v9zUZ3VzKbovf9/1O9fXX5GbSw65b3nmocAAAAAAAAAHAwvvYoj3I3L5flySSdovqb/8mq8li+6CRfyge5k6XczpnczWJWspLbOZdkZmCgqbuLKyu3z/V7lkb3PD+yZ7m3OjQAAAAAAAAA8Bh+mVb37/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPCsKJKJ7qpajtXrzKTRzEZdVpN/Jpk67Hj3oBi1897BxwEAAABPZPox+hx5lEe5m5d7252ies3/5er18nQ+yM2sZDkraWcpV+rX0OWr/sb62nx7fW3+RrmU28Pjfv8/ewpjqh5hotoadeTXqxatXM1ytedMLlfBXEmje+xT/TcjujHVcQ34uIyp+F5tl5E167SWB/v9uHcR9sXwWxGNbVq2NoJL+hmZq2Mrex7tZqCo3qgpMzI8wOZnZ8vBmkNbM1WTyf6RzqXRT/axXq73Mecv1uvy8fzmqeZ8OxP1ejAX/Uw0UmXifG/2lefM9plIvvHXP717rX3z+rWrd04fzkN6DBNj9m+eE/MDmXjtuc5Ec4/t56pMHO9vX8qP8pOczmzezu0s56dZzEqW0qnrF+v5XP6c2T5TC0Nbb+8UyVT9vHSfs93ENJsfVqXFnKz6vpzlFLmVK1nKm9W/8zmXb+dCLuTiwDN8fGzc1WOrzvrG5rO+90z/bWTwp75ZF8qr2283rnIL2z3icbNzv3Sv/WVejw7ktTvrH/ZbHR04D+YGsvRKLzuTIwffem0c3W5Q8yt1oTzGr3a4TxysmToT5QnUu0v0onu1m4lm/+483PUPneqht292OtcW3x8z/uqm7TfqdTmt1r66U+uekSkutu+zV+V8eSXT9ZVkeHaUda/2rzIDdZ2NudytG77jlv2OV3VF0TtTf5xb1QTYeqZO1b/DbR3pfFX32qa6E/U1vKx7faBu6Pet3Eo7V/YpRwDst3+82y/O5MWp1r9bD1qftn7dutZ6a/oHL3znhRNTmfz75HebcxNvNE4Uf8mn+fnG638AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODx3fnwo+uL7SJJVWgv3b7TKxypm2zsGV9obeme8Y3/9SDZXFXU38Yzqtf1+lsKdg7j2SlMJxnaU33P0YGH0docxpZC5xfJgednatup9buy0NzV070wtOfPWwf8eOd4JrJpHmbMPDyYQiNPZeTOkTEzYSKjJ8BhXI2Ag3R25cb7Z+98+NG3lm8svrf03tLNyQsXLs5dvPDm/Nmry+2lue7Pw44SeBo2bvqHHQkAAAAAAAAAAACwW6M+KnDypZ0+NLKl0MiWj/RM+Z+FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwL64dDrNeylybu7MXLm9vjbfLpdeeaNlM0mjkRQ/S4r7yUK6S2YGhivyx/vpjDjOJ8sX3/ns4frnG2M1u+2TRr0eb/vaJKv1ktkkE/X6CQyNd/mJxyv+23sMZcK+6HQ6C08WH+yP/wUAAP//5lTkuw==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x8a002, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r2], 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e00"], 0x24}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000002080)={0x8, 0x86}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000040), 0x0) timer_create(0x3, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) close(0x3) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) ioctl$EVIOCSABS20(r6, 0x40044591, 0x0) read$FUSE(r5, &(0x7f0000000040)={0x2020}, 0x9d2) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f00000001c0)={0x4, 0x0, 0x0, 'queue0\x00'}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x1, 0x80) open$dir(&(0x7f0000000100)='./file0\x00', 0x6400, 0x140) 2m37.283757487s ago: executing program 2 (id=1172): socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000180)={0x4, &(0x7f0000000240)=[{0xfff8, 0x6, 0x36, 0x7}, {0x4006, 0x6, 0x3, 0x7ffcfff7}, {0x9, 0x5, 0x35, 0x8}, {0x3, 0x4, 0xf}]}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r3, 0x42, 0x1ff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) truncate(&(0x7f0000000100)='./file0\x00', 0x8) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) syz_fuse_handle_req(r4, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r4, &(0x7f0000004200)="a28096c80abf3543ecde7564abff5085d2227ebcb0f164ae92706ad0b083a3f469a3efd15b4921e9c3063b98b3082068e7c31950dde842eac55df0f991453cad62a6956b0b6f7b8cf49b506a3060fe1127eca99663ade8efa89ee189acb5f3b92f6bc4c46621c803eed0d0bb5f32384870ed08f89d4f74445762fb99715e083c4c92a8878be19ffacc30d0f2da64f971cd40563163adc15670ecf25cd3ad96138967c4b53ad9d04b5193ab5fb674aa0030a9d703d1baf810ce897f969121f142161919e583c275671b999e7f363891dfdfdf3556d01b86ee29eca8fccbfeaf1771395148706cc6e6be7ce29fc9ffef061b5420950c1a525bf75ad06edec51538d1c5bbc77da72dc90fd9998936fffdda2427e5a68966c7e2208f76304680182ec73007e482f034195712af922db2726195d997708734db9e7825a864be00b2a4f800881fc0363f5e618398454f35b148b4ccb88d418269fac868a8ba4a2d5b4f06a1ac01b5ad158b842e05adca22c7372585bf4ce95560b6c1e021a3ed2ff7bd3b6b3c7734c3b66d7e4c460096312082f89b16baa6e73814aa60925780cd92cd65087e260ec046fc363264366a9df2c849c0644911303946adad544521ceb469a3e193ecc9a7876403fac461a4a70d6193b2451189a5c5120b3535e9edf619108af7f517b58abd3fa7fb1ab832213430d2e6901076fba9c9e1acc6c6f48ff0e419bbc45589745a176f52a7407ad5e3dd49acb31b47862806f47077dda04905e45a80a12cbcd4d2dd9fe66c2d1f99394fed8ec60961cd2dc7115a96ece432fac86d51bebb08b95f447a83792fe80291fca7b298c9043ef2c26f0f7e42798d3f54c84b94c24c76c555d83ecc53b99bb22d71845e5cf21a5ba7fbeffeb6306e1730db14561b950a3f24bcfd78d4ab0d97de8054bb1a6077ae7cca6e45d846d3df82298d07212922742cb0facac3b77edfbab90e9ee2d4f7b0ee9b17bb11ec5e5721340d84cb6bd93428167e69b47759172557acda313c3decdfc6fe9336bfade459f43b39d0f2289f9142db280f4ee668e650e12858c577e12e2b9a57ee66c834be97979bcbe94747fa5d8d0b7d3a9f8f218df1bf960f828429a1efe838616b18faf6629236ddbded43a093efae163228e5c38fd7714743c2fcca47e3382bcfb1ab893fd7377527b4ec43f3fa60ebd338161d8de7cad65b15579e4af258f5fe3a63c2637a15703207029b0899b5427767647baef11e291358e6e54f6f13d3d2ca7a5e7969e04d2733b3b9ab822c69a3cfac097384de5071a9b74a656136d55eb1000008747b509fd610ff62b4950ef71c934fe21a48a4931d3d9458b415f112cee65c660f5490e982341da1c58634b3967ca6f3596d20cc90f508382156e36f16539093240ef5f2aa6a2c0dff2a67df30dcf50bf6e0b82a3d49f2d532a8dde1b3ceefcf0837190b74186090d1c18b59917d7efce1adfb238ef4a7b1d22c4cef09320221de883e97e6882466508de06fcdabad3b741bdca2cff879d57ddda52f42b3dcb8a78cfc05826af7e4ff155960ff8491194f4d321ef195990abaeeefdcb852d1e1e3703f317385a9458b6c2dd9db830f757ec29c9939fc7313e639fe485bc1e41ddaaef3fbf1f7cc527c8fad0d21b8082482caad7bee440e5097665f636c3dfec82f8c98afb6243bc3944939675a594277d278ba4361461f7da52e224e4ce5dee4a467bf6ae9f67b61ac6eb0a440406abac2016eec907e241c57f5f44be47290fd0fef785ff04df3810ccd637b4d97a84bae8486a36f75d872e645fe46625969fc2d1f032c56ed44bd98ea27bd9b6ddc8eb2dc2ec9f90f2f1ca1bd20e37ac58b03c84c872f4ba47310654986641460dfdd531ac62a76ad87b89c103ac5c9c2e7e70c66447b3412d4a1e5cbc30e16939505116c04de33ae054ed366de8d1f971c2de439957a194e22a488f58d7efd46439177f3f3c45a1475927eecd846d3d2e6a2ab5c7f8addd99062c2fc6b272d1f51bb8f22f1b6f8bb3faf8aa85e5eb9abf7df5cf8f26267323808b0833a987989cbe59205e7ad06556e2d1b8a4873ca1cbcbc8d43abc145fd4eb832e7a58ab2c793d003ce7b1850ce45eb7480417a1e9eb9d39a1028a2a04a2aa649c098c4f8eee514db5f6021173bb254b8e22b150b2ca01dc7ff235db46ed78d07f43d1adab13b8445d1b32069eb45f9d389fcf5a3f7d3ebe243c5b1fe17b1f5a3d571b65f21b9e471e818172554dc956749b99cb7a5f303ec480d7194a29e86e204f06aa1becdddc8c49082c527e7064ac2ad77dc05639d3d2a7778f6943ed6105ebf6f0b9e94fddbe05c236ec000f4d1d4e496b10068211ab68ada4c7f7ac61f5f5ba5f1810d5bbe87ff4f8356af0d3f682baedb0ad8f8488b277421f0a03fc5e3095ee34bc4472d8f17e3f7013cf2f79f5ff3ea4b6bae56d1365a33b09bfa9a496323f7da923b7e29dce4beb80035f13130004c96e56d7ef6ca6c101d20c27a218e623227c33c9e488b17e7ae9ac20da8240501f7b614a1730f164553fe479ef149866e4ea47296814284a3d3eb7cbb294289ffb996e0eb053b9c16e54cf267832e3d360eb196ed51305630223309ea97215628f01ec9d3ea48096418d5e962cac5063460f0a18772ec7ce66d14a1cce14b52c40bbbfafccbf1e76f09e57ff0718048e5b993157a6cf4718826b1e09430413a3596a15c4a620fa8c8e1d1663e5739f9f790ddbb3be0e00187d43717d659242467d8681ac10303346157f894d9037641417010e9654c6a5b22383e73a5a37128f50078a980c30930321aa5c5e7851d5d392ddce3a14a96916fa8421ae6728f37f5de7c3e98feb4babd4e1bd2315d595e209d52748f70adc2284fcdaa6ad880470d2a071f3490aaf3491fb64b4547419e8eccdc491a8921156cb4811ad1e66514a32b0b31b641438881f28c1e6461b4f451938999af671e8c6a5cd0c072a9fe4cdbefe24ca616f3d0a15ac97cca835b1a440e04fa28340c6044176c8ecc8ee0d033d47db8a0aacfa0eabdfa1c9509fc2604008f01cbafeb5bd2b503b809ed672340b9a576593f1ef388391b54b605e7a15bef7b1345627a34fca57738b0f8f4f19eea93c903495274a4425a1a1cc6c4c6e335b631df5185c95b485a4257867b5347a40e4e14dcc560f061fd4fd265137dc68afd548adde778f1330f769acb1ccf5da14ff6992c24e210ea6e6179421881b803393bc6974e37106c5b5b3b5d0b3469f8969bffb7e4ceb2c98e928e74366492d27235ae4c74a2f48511aeeaa53a2beafa7a331b50e454c507af1b63350a5cef35668a5b9325014192277e509561008b3601088f79d42eaa8b1e4ae2000b31749e2b8094312ddb7f3c1cd625ef885c11fa22a66e374b52b3425e0b8016154e1fd8471339e32e7373d63ab646d893fbe09ae07b06074c01401ea76b3c382a9d32f24f93c789964e16bc4206ecd75c10917ab84ffd8d6cdf4cd28fd90375ff28518f8c1a3befc538e1b9e427fb671988d29f2fb2fcd039f4d341c84eb4d7cf600ddaba88bb094e4d87a1419180149f491368e648b69985b05ac39a4ecdd3c5135f3a5c8ad7792dacb6470144bb9e67805a211efb3ec9ccaf8e0901345fb19e4da579e1fbe86a1207f4f13c3436009c2c640b7cf3f8b77ca7bd994bf93308027359c6dd1b7db1e153fc0821968ef36c003b6c73fe890f4de24f5c6458dbaaf3819edeaa91783c3cfc7e773689236248195c7bbd60113f2476fa3687621d668d1728ee433d2f8f4db707345d30f1e52ab87a2a0afd547c6bb06500f59f17facde48f693490e22494b75d11df1a143b85068d143ef6a9bb5937a9df380c8948f1a01e9675e18409edb0f6b9605b68e34632fcce472dc50b90b0f6dcd57931f78e1e8861a0fb62e72b0baad6f9d23c1cfb0f19b25013c8d9fcd786a2f6f79768b5fb398f7b2baa31ce8156d1fc4a46c1c463fdf30360d42aeed2ef11611d0b7f654bb51052fd4dc39328f8ec4c58bbda05e6f1b3c8f6d8adca0268f2410e9a4a7d63b6616006d0e02f6edacc10e5c54fd85f15a8bd7648a293f23d6a699bd9a675250475a73a96d7475e4fabb89fb5e7de5d7a3479aa485c0befc60d0ac4fd5ac6dbecceb06cad86e219fc0ce4720758917811a3215f8d13e413bfb64fc065fc421aede0b56691797dac428c7e463479fa591b9072c309b7533e427c5cc11a1f6cf9a5b995d328d796d874c5b55dfc12a5039b413ce319cf5ba1f355c4e0717d32650b43e18010f37f048731931c52c4f36eb969dda702afe96c2a5241350a67ba2d026946189c5e281293c9a8e2cff3784776f1de78b917101b54e5ab00c045ea15f28a0e3f509962cf8bd3385d85250737eae5c34ece86b86669c13b00308a3b13c0ac3c83ff26fb52a4aa83c1233a9490cb9ca917a056908931751bddb88a62379a713395f0764e4a393faf253a4026d0472270e6036287d56850df1751543484d65b3062155b6300e0024241c59a862ae769c1a9232a2d9fb24705177a09cceb3eefbf9f106f67e01be14cdeb4d2fc7d8661df3e75de5ccd09a7e559f028fb9837c621ea0045b4d1b679067f246339c974631aa7134d4e910efb28d3c48929cef1df7e6c73668762d55086b6c59c36ac90154135fd7ca4e4047dd0aa161fa982d8edf9c0cb9666477e096c55718f6e4742415fefd4f696d1f1ccd6322bc19496ddebd36282a7c707d5b44113e30678e6e33ab7d34be04a59ac614d6a54134490998be02636fa91633d6294781c2b9a54c611c0045cfcfe81f49aa21b29d835cd2047c854486fd8e65a2ebf629f7ced602b9dd107bfde483e5c9b5cbba4a08cdce09920bda9978b7fc2b4a89bf1573a26389e52090fdf5dccf22111dc8c42fd3c8c477092895398086cc22cca665269e193fc650742a361a44b857d258429f701f22e9b7615bc3dab78c1479a41cf8575cdb17169470b347adfc03e03daea3e269725cfc72df5664b9df36d2f2b55013b71133e0b80577a47182511ebb308b6248d457bd2af7b28e77182c305241178c4124ab102771fd5a8c3dacb8775de881301d71587c76bcf0a97a72ad244d0c42fd71aceec32dd48bb5c9a95b391166c832ac5bac8c7cae4d18b3f7d9f2e4782fdf97732e3d51f67bbb57f989ee0d7589dbd0c2a5c63840e914b9d7d720fa120acbffebf816b588b2ccc052e7fa78992e0ea39dd21a122add41195f8e2e1acd777c1a4e8ef4362fef441feb4d9252c6bfbd2742152300a32027776e3341620d3c8d9365e10e81adcca7d87a0e555c98a0353c692557d90ee9be3fbaab766abf93e2462149fd99c92a5fc58d899ee75535cd1fe1386c5ab0b157c2102039d6015258f59cef3f15b951893a30ae839f740402a30b34e7be73796286403c5beb0853d856d83f1b00b48328f56dcb32e1faab08a3435b1482bf18b21c95aefeaafa7fd761c7f28d416fcde06bf7aee5c6e9eb50e55874253ba3f1d0ce2505b4fc7c3fc996bfbb8446bafe84f5bea94bfd7ca5aeaf237fe793b66e5c521d4092e4e1f9bde1dfcfe53fa55005d21cfa833a338fd9792614129336060e10d1911862070761aa20c2902eb7c5a355eff4cf6253d7102a2ca1fead4c53b57d576d104c081310d92797e4e2e8c269d19910d0d4cedf30fa28ba680c00137f83de940624229b6a125ce5233c6cf4a3640b74f58f288dad8451fbe37641c5559a5f3caf1299c8bfb230723652278fe378efd8e459b9da26cffeb58468a6301dbc06d713ba2d8d43d9038f5f2dc8b831ba58a88eeb5b1786b21e398aeeeb7c1f3d6f01d82b3947862fb9e7cbd7da5d04c5fcd34da28d53e2246e3ac1e3a619ad174efa6435eaa0fc94d610799ce0158421dce046306eb5042143daa336d52206b12610ea6389cdda49bf5af1d4ee42ac090a94ae7b7612073f3a5c36a2245eda887f41478f7d20f18667f941f71eebcfa76c1ab28f2a49a3bd56bd3f4e6bd079ab3fe2d94782236e83585a03e52907abaef7456a95d5d3f3d37efdc035dbfd7c41b8ba0af2df8adf1cf24f7ff0beccd3d26bc91caf42314ef7e466f74e19ae0df2e2298fc2f694a7ec134632035585d530e7e19f65c256f001d75382d9825ef741bc213af186377d9ca10d3722354e1897ca5c23ac6a5359ad0e6b686e1776f7ec65df033e8f4d5db80c1bc354093b319cb70df93d610667675816328c99322f14e636b95f04e6497f139d508b453f53ddb5c289d849fd5407c9bdcefd1642abd46e28cb4e94371bdc606eeb67c9fe17747c68f2d50e82711da4d3edb0eda06f41b7f93fa8fb4d83cf21c79da67000bac2275508217ade1659fa8d24e5f8efb9f4bd21073ebef3d06368eb03fa3cf0d638448bd055ed20d292033ffdba538559c8ff9a2a5c8f83b5c393643d6585d1df994c3be43e72b8f3f53114d2a5f6bcedb573842b23b6a3eb7fca8495bf03bd03fde7b19bd39a16cec49e01f38e671af33cae082d9788e3202799bc466babec2080528d0609c0b731964719093735b4c1e73bd0705637c47516922197c552baeaf3516b5e3bbc2cd1afa3ef8215196ed580d9561092f620b897e98e786a0c7cbb0eedda8063292ba6482497f5f6bb62fb5ab4c97cb7658dc6579718eb97b547fcf47ced1426561af93a15fb4dc6d3d93b868644943c2c94b23b0570bbb81df2666c24f5abccfcdd71e209f3bb43c01d17f9bc8b9af2c26762fc6a741a150b7d1186e4f35175f3c315243e1c11e92c43a1fc492eef5a13c77a81fcf514ebfd0f8e645dae15a07e86b2f01fda065db4505a5eea83cb616f744f6bee731be191c65449c02603556d5a51422cf9c2f19f8d6843e0c1091e0708aa271e91f71c8602b9fa72189e036b7cb6af1569f21269283de94a6d7fe5849fd433d5b719c80419873db0587fc29786cc598d896fb16360bddd2ce12e54d05418f4f5e5f2d7aafe9fcd6268cbe2e9e6329ffb6c67fab8f3ce673028cc06aaa6b857556bba3b44d3fab5b6e875e70a2f3ad4b2ff76f31ead3462d3801ba373b3c2f545e94f57021575e2947f81f53283fc0a5137fd44fa3d074c92de54a0a3465c858f5a7ef08313faddbc3663e4e0167f3cba39612057a7518fbfb031f5ad0f9f75831973ebd733b82e554bf3fdec84e51f65dab6028c6c51366d9d4700fdf255e4c7bd70766e7f2281b3f2a5363f85ce49f9135904d14bcb117ad754c2594dcdca2d30e40ff265b5accfb116f64ed99aad570c4c5a91efdbb984ac651d8721405a0342cf77f448c17a152eabf29e88950558a86d0074e1cefab1eb7c366682f686ee1338737e675ea58eb8b4c86b9f28a6f6e96459f29e3b4dc59ff044c61a0dcc5c31d803e6e98420e446229ccdec3d0f705e92ffe016bb3696373eadab7f35ccf65ab4d9be09a085ce21bbd7c0555376e4d7fe68b5e7a64f48b5127825fb2be598d991f9c1a54bf52713417dcc599e812d85513a537e6eafa738edc972b67e065595d11678449bce6cd3d69800a649b560d0e057c502ca3e72e97820829ecfea801192c3f4e2c8763c095a43ee6fe45fe8730130937668df1d4ee577ada28238be03286481f2d2a004cc4d48856e71fbd64f1a0043a4520ecbbf1b3abdc96b87a27be8495a20542967aa4cd3a44a11502419a083d84e97abfde0901b66dde48388649a0ed6d93b9f20c530e990c7c52370a114d800d6ab3f6687d6bbc105b63738fe05fa6cac98ad6663936bb18cb923264e4c921012b68a26a70977446b8f15f9d62467d8b356560c183a6bd6cd76ec868c3bd94a595cd7bf996755a508a814980c5e588b275200c45afd900c8c2de329ec2484b0e3ecd7b0960e5e3425881d1ff7f8bd8b20f5cc98ffc3acb77f5e88775a4bd3ab9f9eb027e27d3af55ebdf4eebab48ea911128d668d00fc3f5b5480aa0d9a4af563ba577384448e5425157133d59e1cef3c722f33700bd372825046b1fa5824e405154a3af1440bc2b75acfbd07cf92e8c162587e74b5ab66b1c6aeab3ad5fa3ee91da4900ef30ad04baea326df912517dd96e1696b4a91faa66675978a375e81f25464a1073dc6737af08d7e25956bb31d438548a7da38662d49db812a8cf1d6cc65f5c63879fd9ee7fd2a66ca3fc1a768cb239aab88c87206470b4c60592afeb6d69ed97a8f990155862ba4e22b64804142c131a23792937aa8a8696e165c24d7692a04bb4471b0f0d2507fe7c8618421428fc7a0acc984ca5cc6bacb772e8a717bbaa646f9643275910a6037afaf5a80678d18edda138a4e13d06d04a5d06431eab48738225cf1567e960e765728dc12e91b91c6f2b33dfb6e033aa68c1c2334d24335abc4a7a1df5636dec29091da54d5f5a1fff41e4a35a0c2f04f968f7d78e2f51c73577e2192bb20f289aaba5a175c2ed533855bd9ed9a842ad482136dd5e0cf45eb5e2d31ff62a3be1cf8a94a58316e74f4ab9fc54f3a0bb83beef0f355993bdea2c83e61cdc796bf2564ae51fae616799e8711998cd88d35cd9824452fdd65226174b46792cb87f4dd282e4e6f67eb66da413ad877ed6ce775f7e19bc93f48bb9e5ec04009de3c042aeacf7f4b25ad6b30e017303f64fe07ac79e8744aab6926d117f13513d0469cef335fe1d0d787c2d0b2c031a9521786ac10e9f8b768271680337f2c3262abdccb5d3107c632bf1f74c83ee91f49988222fb080cc8faa9b1a02526d8b6087e0b2354173d29016b3309587c16f057dd812aa63c3169150de81f3af97d082a8f8da4ce4f909ff649821d7f96d97613552e8cc4902e046ecfa329b1d980ff5ece69b8f1615fdff5244f41cec0af924624ae1641ecae5fa26c5fb9006e57100ee71377ced7c255ae17a0845e2ee0287c62c1852f93877f9f86157ca9675d383fff5cd6f2b001ec0136c07cf37f5ace1853122c2baa1092d418e2a490c4a5c8f56b828ce1bafeef4e77f095d6b4ed99d56f66812cb19be540ebe5d52e7eff2d69cbb8477e11514f7e3604bf9999f78c2f1ca6f60a2216b87fa0f25269c425b7d50709b200912b3b7899c95e12d6e9c4dacc19e327721860e0477a53e6793fbb7fb9704a848f395f48c24a6e79b9e1358cc3497251de88b8d3a7b22c6d8af1a7fab81530d9f0cc98f62debb222b54780d89794238532717b447d71b46a60ed481c21db85b590b31720009695ecffd4ef029964e5d5149622233ac013e960a005c924f73ea82c318455546c53d74aa3f7e2ff26aa074c40a55aba8b08027fc19b596eec6c4f89bae39e74b9aad88344f7cc5ad3eefa5095f2ab47222e9a357ecd71c6700ac576025201490d9e446603dfd4bda7617dd500981b2d2ab8c43882a5208494cb3f8ebc720bca8a7cf6c80bd7aaaf89507bb3412ea490a78973f12cc30413e9df1458917ea3d68b438d424c1314bc8d01939c5a5a842438281e62d0c800dee704b2a6cd3e1e4b885a6b26b894a98765fa3308c9e4b87f93625faecdb17c29a27cd243bf6030a67874ec9f2443cf8154261ac2a834c01cbe1f314ee7aa3ca552e1648cf8b42a63f249e3538026e09e44d69dc259adb0d1a0cbccb5a5dd5d0dccc90d023da79d5634188ff060f7e35a5f9d7ad99546824d63975d4452de876093f4e997dc46eedcd80a9eebf5e4f077fbb10c7d9e19a3419e7b845972a3b62613c5404a209b16fa88e0ff49d7b4f21fecc1f773c5b4be61021e0cab8602c6e8257649303aaeafcbb178e7a460ff07f219c46eb6fe5bf8113723e454003bd707767c107daf4255751daaf8decf35262640058924eb6587868b2c08230b317e97396ebc928ba8d274ca0eed0bfcb637676003c64e8c1e1a0420b6c96a44226061ced41b8448382abd2f3d0c472afcde231fbc9ee90c2f1132f8e2391246f95ad93354c7460e20de996ad0f61b13b27646887a637cede90b94b7d8c3130f0fe060e8d955c711a2700b302a75bdeb32a0a6802ea795cb114f5f82a1a381a86bbff88b299e47728b746dff964c94c52b661b9429376b1320b46081426b7c340206dc0da151bf84be2a49e78b6b5938753d2b1be8d9e67c43c5d70e72519f5f90d0500e84ee38f82b191ac4d968b0a37901fd923cb289d585693ac3c3f8a94fca6df45e694e199a9cd0b1bc1fa7394bcc96aae670dca6605a998793b7e067ac410ba631057b8b76fcbe9524df820c02efef1608b743cd2aa6d60d3d8e476fa12d3acc329f8272b087d89471177ed531fec1f9c24a975ca2fcd8c246a33e291a3f00b7f234052067a0059c86762475256bb5e7dac6f121a0925506b18933c6e314915d4b3b2130aafc2483ef22ff8bb7b887565b1bd22fabca22037d8fc9437f675c5313526266f60bb7c7c47f30c7d567ed142ea5ec367c4298328d20e5344f01c0c90cf8a6302f4d84b6ba7495fba314a05ba29b63bb6d458fdb05a4411136958309f418fb178e19aa09ff9e62b29732fb2986c96e738f7a688cb2122dbb8f2ad9a5f28bc49ec0c462413552afee8e403259b55ad6dc334dde7f2d306929dd01f2aa6036cafd41874522689301b81c9e50e86828894140356db0a3317b081ed9d8148c41e77e6bda6287762532b86eb91f5480915680deb8a91fb8652b7f0109064865d2b846af0861f67d3f720d6e306540cd7b68f095ef3690b88ea93fb6a402ff5697597cda83171f159e85307d1a8c01611189bd4eb4f0453ab88d43ae181a562a76902a67c687514079d6f4304d9a7c0fa24b6e86074ea0a9fd8187c120312078f5ebfa674adc0303734bf8f6b5585943706594192ad64c9f7d9794fb83758924f862855ddd50bff58b522c43d73c03289baec628cd693cab93101b1e473b76532510e10f03e86812fea6f2d6f5467dcf29e6d7cf8524f383a0ded3f0951c3ffb171a6b8a6d97b5fa8899a19f1a3d0e934a1d4741076e4394ba225158f697bf7d5651717c6950229a0be22e8120d76a414edbcd03d505264b7ede8272ccbd6dbdcebaf11daf6a652f6f9eb74ba7a3ecc942892891388005ae5d971e4e79d696564906dffd44845b704a9abc2fa5ba1bb69a548423a08044ad6d0e365db7e6bea0f3844a452759716cb98dcf326001ec90c1c343174098cdf47ea2e13341058ca014d2a30e9ba3c526de72a6e387181bf76a278c9cbc518d8c374a3f1d9802a39464a100903dbec16f8f095f5d82d9d09507281e4f7fe0ce4fbeced193902a5f658af2a4c1d0952dabdc6ae5830b6b5a2c3f5b8d33a73665990822e5f4a7ce5366755a1615543bdf78299c71e890e0bedb6ec277b10a389d6a3ba9c037221421279e51ab50fb115de2076cc99444202e88ebd9d0fbe4e60234b7b761495ac6c9e615ddac8176164a88fb6d6cc2b52672c8949afe3efc1e87a598896bc93e421423844fcaafe65af898a015b3bcaf623ebeef9a57155af5278ceb52b995f7ca466d9e18b05e86380679e0257cff6d0c6750078462f2ee4701d6d8289ed848b877cf5918625b7937060d667c11119881c30809056892352c6c53c01e395af6866ea350e6f21fa3db772c1177c759999973b51e11ffc590800", 0x2000, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x78, 0x0, 0x6, {0x8, 0xbffffffe, 0x0, {0x0, 0x5, 0x0, 0x200000000000, 0xffffffffffff87b8, 0x0, 0x1, 0x3966, 0x1, 0x2000, 0xfffffffc, r6, r7, 0x1, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x0, 0x0) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmctl$SHM_INFO(0x0, 0xe, 0x0) shmctl$IPC_RMID(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) 2m36.121739396s ago: executing program 2 (id=1174): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r4, &(0x7f0000000040)={0xa, 0x0, 0xbf, @empty, 0x4, 0x100}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$l2tp6(r4, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c0000000406010800000000000000000200000205000100070000008d19e0da1eab44795dee96d502b9dd1c0facca66750302e07ad5035f33ea1709268fc24f1c6db1613898b0be3c12717a4c67"], 0x1c}, 0x1, 0x0, 0x0, 0x20000810}, 0x80d0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c000280140003002000000000000000030007116b61979e0c000100636c75737465720008000240000000000900010073797a30000000000900020073"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_open_dev$loop(0x0, 0x3, 0x2000) ioctl$LOOP_SET_CAPACITY(r7, 0x4c07) sendmmsg$inet6(r4, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0, 0x0, 0x0, 0x0, 0xc0fe}}], 0x17fd147c801ae9af, 0xff14) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000040)) 2m34.538170846s ago: executing program 2 (id=1183): socket$nl_audit(0x10, 0x3, 0x9) mknodat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x1000, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x3d, &(0x7f0000000200)=0x10000002) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) getpgrp(r0) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x17, 0x0) keyctl$session_to_parent(0x12) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000002100)='net/igmp\x00') mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r4 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000001c0)=@newlink={0x50, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8a33}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80020001000001}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x3}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) r6 = syz_clone(0x20042400, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r6, &(0x7f00000005c0)=[{&(0x7f0000000000)=""/214, 0xd6}], 0x1, &(0x7f0000000940)=[{&(0x7f00000014c0)=""/4096, 0x1000}], 0x1, 0x0) preadv(r3, &(0x7f00000029c0)=[{&(0x7f0000002200)=""/175, 0xaf}], 0x1, 0x20007c, 0x8001) 2m33.443524304s ago: executing program 2 (id=1187): syz_mount_image$nilfs2(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x1080c, &(0x7f0000000180)=ANY=[@ANYRES64=0x0, @ANYRESOCT=0x0, @ANYBLOB, @ANYBLOB="d1794da8c0ccda034276e28a25c45c8e1eb8b595a37ffdfe7d2a8c3972a6931d2cbb0d8dc920bbde15d8790d46ccb3a5f36ff412236251d86334f17545ccae88", @ANYRES8=0x0, @ANYRES32=0x0, @ANYRES32, @ANYRES64, @ANYRESDEC=0x0, @ANYRESOCT, @ANYRES32], 0x1, 0xa8f, &(0x7f0000001400)="$eJzs3UuMHEfdAPCe3Z31M5/H+WxinJDYBJIIyG68a8zDgjiKL1gx4hYp4mI5TrBwDMKRQqJI2D5xI5FlboiHOOUSAUIiF2TlxCUSscQlp8CBA5aRInGABHvQzlbNzvw9k57ZV+/s/H5ST013VXdVz3b39quqCmBsTbQ+663Pq29dOf6Ph/6+beH74+0UjdbnVMfYQupaGp8Ky3t/cjG89cGrp3uFtWKu9ZnHJzvm3VEUxcXiQHGtaBT7r15//Z25p05eOnH54LtvHL2xBqsOAABj51vXjh7e+9c/37v7wzfvP1ZsaU/P5+eNNL4znfcfSyf+C8FULV8/LF0P1DqGTtMh3VQaJkK6yR7pio509Zxua/d8Mf/psNx6n3RbSvKfDNcotVAeGGV5O24UtYmZrvGJiZmZxWvyonVdP12bOX/23HMXKioosOr+9UBRFAcMhnEbmrvaO0HlZalu6PgVACoVnxfe4WK8s7Ay7aVNDZb/zScmes/frb6aZWR8rPf2L/+4/O5yrHf+Zev/60trvP6MlcG3pq1rWo7Vltcr70c703h8jhDfXxr2+JOXNxmWN+gJQL/nCKPyfKFfOSfXuRzL1a/8cbvYrL6Wwvw7fD3Ed+4/8W86Kn9joLd/b7j7/9uWCld5WQyGzT00qzz4ANUquayP7801kxwf3+uL8VtK4reWxG8rid++OLX9Gl+M31EyP4yz3734k+K1WtGzPl6xeP3f2lkGvR+W77PdlcL/G7I88X7ksPfj4nu/w1pp/vF9YtjI/nDq6TNffvaZ64vv/9fa2//ttL0fSOONtG9dSwny/cJ4X7397n+jO5+JPunuDuW5q0f61vc93elqe5aWU3QcZ+4ox77u+Xb1S3dfd7pGSLctDfF0KZ6fbA/z5fOPfFzNv9dUWN96WI/pUI58XNmdwtF6GsNGlbfHfu//5+1zX1GvPXf23JnH0njeTv80Wd+yMP3QOpcbWLlB6//sK7rr/+xsT69PdB4Xdi1Nr3UeFxph+lyf6fNpPP+f+87kttb0mdPfO/fsaq88jLkLL7/y3VPnzp35gS+++OJL+0vVRyZgrc2++ML3Zy+8/MqjZ1849fyZ58+cnz9yZH5u7shX5g/Pts7rZzvP7oHNZOmf/tCzetQFAAAAAAAAAAAAFXnpxPHrf3n7S+8t1v9fqv+X6//nN39z/f8fh/r/sZ58rgef6wHu7hHfShMaWJ0O6epp+P9Q3j0hn71hvk+ksN2PX6r/n7OL7brm8twTpsf2e3O60JzAHe2lTIc2SGJ/gZ9O4eUU/qqACtV+1ntyCsvat87ben4ZWLsUoyn/3XJ7Jrkdk1z/u1+7Tvn4v7v3Yn+02uVkda1HdcKq1xHo7Z8brv3vNRmWGvysvCwdVwyVl8Ww0YZbzWZzPfNrNj+uFw99TQHrp+r+P/N9zxye/+M3ti4MOdnNJ7qPl7H9UliJqvu/rCz/fGNxXNd/wPxXu//Pdv93Ax//Qo95jeXl+5+f33ivI9tif9/8txRd+cf1z+1A7xku/w9T/nltHi765d+9/s1fhvzjA6EBfRTy3z5g/nH9rwybccrwvyn//LM98uCg+S8uoDbRXY543zg//4v3jbNbYf1z257Drv9yO2q8nfKHcTYq/cwOq6v/30vN9e//d4U9DMX3ML6YxvOBML/nEPs7ubW1GKr8+f2K/H9gb1h+reT/m/5/R9tXU1i2P+T+f/P22OgxPtExXu/x227WYw2MqvdX7flfxxtzG+A5ymYYXtpVfRlGYajZ5pY9NJvNSh/yecJYrap//6qvE6rOv+rfv0zs/zeew8f+f2N87P83xsf+f2N8677iR0ud9sbfa3uYP8bH/n9j/D0h39g/8L6S+E+WxO8vib+3JP6+kvhPlcQfLIm/vyT+gZL4u0viHyyJ/0z4i8f4z5bM/1BJ/CMfHz//w5L5N7tcH2Vc1x/GWayfd+f+v8wHvMCGl5//9Nv/95TEA6Prp28eevKZ3367sVj/f7p9PyQ/xzuWxuvp2jleL8X7J5Mp7u00/rcQv9Hvd8A4ie1nxP/vD5fEA6Mrv+dl/4YxVOvdYs+g7Vb1O89ntHwuhZ9P4RdS+GgKZ1I4m8JDKZxbp/KxNp78ze+PvlZbut7fFeIHfR8+1geK7UTND1ieeH9g2PfxYzt+w1pp/susDgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFCZidbn4cP7akVx9a0rx58+eXZ2Ycrj7RSN1udUx1i9PV9RPJbCyRT+In259cGrpzvD2ymsFXNFrai1pxffvNnOaUdRFBeLA8W1olHsv3r99Xfmnjp56cTlg+++cfTG2v0CAAAAsPn9LwAA//+1ThxH") r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0185879, &(0x7f0000000080)={@desc={0x4100, 0x0, @desc3}}) 2m31.969060371s ago: executing program 2 (id=1190): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x22004002, &(0x7f0000000140)={[{@jqfmt_vfsold}, {@nojournal_checksum}, {@noload}, {@noinit_itable}, {@usrjquota}, {@grpjquota, 0x2e}], [{@subj_type={'subj_type', 0x3d, '\xe1[]*:['}}]}, 0x81, 0x485, &(0x7f0000000780)="$eJzs3MtvG8UfAPDvrpP09ctD/ZVHH1BDQVQUkiYU6IELCKRekJDgAMeQhqo0bVETJFpVtCDUHhF/AXBE4i/gBBcEnEBc4Y6QKtQLhQNatPZu48R269g1Jvjzkdae2Z31zOzsxLM73gQwtKr5SxKRRcRPETFZj65NUK2/3bh+ceGP6xcXksiyl39Laul+v35xoUxa7rejiBxMI9IPktjbIt/l8xdOzS8tLZ4r4jMrp9+aWT5/4fGTp+dPLJ5YPDN39OiRJ2affmruyTtSz/G8rHvePbtv97HXPnpxIYvXv/08L+//iu2N9aib6jnPalTXHsuasdrrwz1/+r/LeEM4GRlgQdiQSkTkzTVa6/+TUYnVxpuMF94faOGAvsqyLNvStLZSBi5nwH9YEoMuATAY5Rd9fv1bLv/g8GPgrj1bvwDK632jWOpbRiLN37bWr9jH+5R/NSJevfznx/kSLe9DAADcWV/m45/HWo3/JpK7G9JNFHNDUxFxKCJ2RsT/I2JXRNwVEXnaeyLi3g3mX10Xbx7//LCtq4p1KB//PVPMba0d/6VlkqlKERuv1X80eePk0uLh4pgcjNEteXz2Fnl89fyPH7bb1jj+y5c8/3IsWJTj15F1N+iOz6/M91LnRtfei9gz0qr+yc2ZgCQidkfEni4+Pz9mJx/9bF8entjRvH3fbevf3mQX5Vkv+zTikXr7X4519S8l9SmSdvOTM1tjafHwTHlWNPvu+ysvNcZHG8K3b//+ytt/e8vzv6h/2Q3K+drljedx5eerba9puj3/x5JXauGxYt078ysr52YjxooVa9bPre5bxsv0ef0PHmhV/4lkZ8RfnxT77S3O1fsi4v6I2F+U/YGIeDAiDtyi/t8899Cbtz5Cg23/4y3aP1k9/aeSxvn6LgKVU19/0S7/ztr/yNWsYVaik79/eeaX8vfbFLDHwwcAAACbQlr7DXySTt8Mp+n0dP03/Ltie7p0dnnlUDXePnO8/lv5qRhNyztdkw33Q2eLe8NlfG5dvLznlWXbavHphbNL/ZpTBzqzo03/z/1SGXTpgL7r5Hmtm2man2gDNjHPa8Lw0v9heOn/MLz0fxherfr/pYgbDdG+PoQBDI7vfxhe+j8ML/0fhpf+D0Op+ZH48k5fN0/6rwZ2Hutp9yEKVFptKh+X6OGTu9p9W3ScONKBH7ruA+nG9tra43/AaB3YXwS2RESne13q5ZTY8PkDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACw+f0dAAD//wFL2Tw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) 2m31.767949836s ago: executing program 2 (id=1193): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r4, &(0x7f0000000040)={0xa, 0x0, 0xbf, @empty, 0x4, 0x100}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$l2tp6(r4, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c0000000406010800000000000000000200000205000100070000008d19e0da1eab44795dee96d502b9dd1c0facca66750302e07ad5035f33ea1709268fc24f1c6db1613898b0be3c12717a4c67"], 0x1c}, 0x1, 0x0, 0x0, 0x20000810}, 0x80d0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c000280140003002000000000000000030007116b61979e0c000100636c75737465720008000240000000000900010073797a30000000000900020073"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_open_dev$loop(0x0, 0x3, 0x2000) ioctl$LOOP_SET_CAPACITY(r7, 0x4c07) sendmmsg$inet6(r4, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0, 0x0, 0x0, 0x0, 0xc0fe}}], 0x17fd147c801ae9af, 0xff14) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000040)) 2m14.98807103s ago: executing program 36 (id=1193): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r4, &(0x7f0000000040)={0xa, 0x0, 0xbf, @empty, 0x4, 0x100}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$l2tp6(r4, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c0000000406010800000000000000000200000205000100070000008d19e0da1eab44795dee96d502b9dd1c0facca66750302e07ad5035f33ea1709268fc24f1c6db1613898b0be3c12717a4c67"], 0x1c}, 0x1, 0x0, 0x0, 0x20000810}, 0x80d0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c000280140003002000000000000000030007116b61979e0c000100636c75737465720008000240000000000900010073797a30000000000900020073"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_open_dev$loop(0x0, 0x3, 0x2000) ioctl$LOOP_SET_CAPACITY(r7, 0x4c07) sendmmsg$inet6(r4, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0, 0x0, 0x0, 0x0, 0xc0fe}}], 0x17fd147c801ae9af, 0xff14) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000040)) 1m40.285072005s ago: executing program 8 (id=1388): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) 1m39.974735684s ago: executing program 8 (id=1391): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000580)='syzkaller\x00', 0x8001000d, 0x0, 0x0, 0x40f00}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x8b2a, &(0x7f0000000040)) 1m39.538920895s ago: executing program 8 (id=1394): r0 = io_uring_setup(0x1694, &(0x7f0000000080)={0x0, 0xfac7}) r1 = syz_io_uring_setup(0x48ce, &(0x7f0000000400)={0x0, 0xd353, 0x3221, 0x0, 0x19a, 0x0, r0}, &(0x7f0000000140)=0x0, &(0x7f0000000900)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000340)={0x2e, 0xb, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x1, 0x3b7, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x1c0}}}, &(0x7f00000003c0)) 1m39.281980911s ago: executing program 8 (id=1395): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000c80)={[{@init_itable}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@quota}, {@sysvgroups}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x11}}, {@bh}, {@debug}]}, 0xfc, 0x57d, &(0x7f0000001500)="$eJzs3d9rW1UcAPDvTX/sp66DMfRFBntwMpeurT8mCM5H0eFA32doszKaLqNJx1oHrg/uxRcZgogD8Q/w3cfhP+BfMdDBkFH0QYTITW+2tE2atkuXbPl84G7n5N6bc7+593t6Tm5CAhhYJ9J/chGvRsS3ScSRpnXDka08sbbd6qOb0+mSRK322V9JJNljje2T7P9DWeWViPjt64jTuc3tVpaW5wqlUnEhq49X56+NV5aWz1yZL8wWZ4tXJ6emzr09Nfneu+90LdY3Lv7zw6f3Pjr3zcnV7395cPROEufjcLauOY6ncKu5cqLwX1YaifMbNpzoQmP9JOn1AbArQ1mej0TaBxyJoSzrgRffVxFRAwZUIv9hQDXGAY25fZfmwc+Nhx+uTYDqsY82xz+89t5I7K/PjQ6uJutmRul8d6wL7adt/Prn3TvpElu/D3GgQx1gR26tRMTZ4eHN/X+S9X+7d7b+5vHWNrYxaH9/oJfupeOfN1uN/3KPxz/RYvxzqEXu7kbn/M896EIzbaXjv/dbjn8fd11jQ1ntpfqYbyS5fKVUPBsRL0fEqah1vPVxbvV+rd265vFfuqTtN8aC2XE8GN63fp+ZQrUQEaO7DHmdhyv14W2qTf+/vz7W3Xj+09fj4jbbOF68+1q7dZ3j31u1nyNeb3n+n5zWZOv7k+P162G8cVVs9vft47+3a7/X8T9ciTi4dfxjSfP92srO2/hp/7/Fdut2e/2PJp/Xy40kuFGoVhcmIkaTTzY/Pvlk30a9sX0a/6mTW/d/ra7/dPL1xTbjv33sdttN++H8z+zo/O+8cP/jL39s1/72zv9b9dKp7JGs/2stu1a2e4BP+/oBAAAAAABAP8lFxOFIcvnH5Vwun1/7fMexOJgrlSvV05fLi1dnov5d2bEYyTXudB9p+jzERPZ52EZ9ckN9KiKORsR3Qwfq9fx0uTTT6+ABAAAAAAAAAAAAAAAAAACgTxxq8/3/1B9DvT46YM/Vf9hgX6+PAuiFjj/5341fegL6Usf8B15Y8h8Gl/yHwSX/YXDJfxhc8h8Gl/yHwSX/AQAAAAAAAAAAAAAAAAAAAAAAAAAAoKsuXriQLrXVRzen0/rM9aXFufL1MzPFylx+fnE6P11euJafLZdnS8X8dHm+0/OVyuVrE5OxeGO8WqxUxytLy5fmy4tXq5euzBdmi5eKI88kKgAAAAAAAAAAAAAAAAAAAHi+VJaW5wqlUnGhC4UkIrrxPP1W+CD64jD2MsA1u9p9uF+i2OvCyB6kzDMprGQHvrO9etQhAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAL/wcAAP//eBcqGw==") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 1m37.742865749s ago: executing program 8 (id=1397): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010027bd7000fbd3df2502000000050004000100000005000400010000001400020076657468315f746f5f7465616d0000000900030073797a32000000000900010073797a31000000000900010073797a3000004100090003"], 0x68}, 0x1, 0x0, 0x0, 0x4000145}, 0x0) 1m31.70693405s ago: executing program 8 (id=1418): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_LLC_SET_PARAMS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2c, r1, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0xff}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0xb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c005}, 0x14080) 1m31.200499372s ago: executing program 37 (id=1418): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_LLC_SET_PARAMS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2c, r1, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0xff}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0xb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c005}, 0x14080) 10.623702055s ago: executing program 7 (id=1785): syz_open_dev$vim2m(&(0x7f0000000000), 0xc619, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x2, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$inet6_buf(r2, 0x29, 0x3e, &(0x7f00002cef88), 0x0) sendto$inet6(r2, &(0x7f0000001100)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f", 0x2d0, 0x10000800, &(0x7f0000000080)={0xa, 0x5e1f, 0x3, @mcast2}, 0x1c) setsockopt$sock_int(r2, 0x1, 0x23, &(0x7f0000000000)=0xffffffff, 0x4) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000100)=0x10000, 0x4) recvmmsg(r2, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0xa248}], 0x1, 0x40000000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$isdn_base(0x22, 0x3, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) truncate(0x0, 0x2fffffd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xb, 0xc, 0x492f, 0x7f, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r5, &(0x7f00000001c0), 0x0}, 0x20) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 7.944474902s ago: executing program 5 (id=1804): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000000440)=[{0x5, 0x0, 0x0, 0x0}, {0x1000, 0x2000, 0x0, 0x0}], 0x2}) 6.732902792s ago: executing program 7 (id=1810): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[], 0x1, 0x14fe, &(0x7f0000002a80)="$eJzs3AuYjlXXOPC99t43Y5r0NMlh2GuvmycNtkmSHBJySJIkSXJKSJokSUgMOSUNSchxkhyGkBymMWmcz4eckyavNEkSEhL2/9J78L5v7/f1ff/e/993fbN+17Wv2WvuZ61n3bPmmue+n+ua57ueo+q1qF+7GRGJPwT+/CVFCBEjhBgmhLhOCBEIISrFV4q/fLyAgpQ/9iTs3+vh9KvdAbuaeP55G88/b+P55208/7yN55+38fzzNp5/3sbzZywv2z6n2PW88u7i9//zMn79/18kt/zkrzaWv7HXfyOF55+38fzzNp5/3sbzz9t4/nkbz/9/v1r/yTGef97G82csL9sOWoj/Ae9D87o662r//jHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYyxvO+Su0EOKv+6vdF2OMMcYYY4wxxv59fP6r3QFjjDHGGGOMMcb+3wMhhRJaBCKfyC9iRAERK64RceJaUVBcJyLiehEvbhCFxI2isCgiiopiIkEUFyWEESisIBGKkqKUiIqbRGlxs0gUZURZUU44UV4kiVtEBXGrqChuE5XE7aKyuENUEVVFNVFd3ClqiLtETVFL1BZ3izqirqgn6ot7RANxr2go7hONxP2isXhANBEPiqbiIdFMPCyai0dEC/GoaCkeE61Ea9FGtBXt/q/yXxJ9xcuin+gvUsQAMVC8IgaJwWKIGCqGiVfFcPGaGCFeF6lipBgl3hCjxZtijHhLjBXjxHjxtpggJopJYrKYIqaKNPGOmCbeFdPFe2KGmClmidkiXcwRc8X7Yp6YLxaID8RC8aFYJBaLJWKpyBAfiUyxTGSJj8Vy8YnIFivESrFKrBZrxFqxTqwXG8RGsUlsFlvEVrFNbBefih1ip9gldos9Yq/YJz4T+8Xn4oD4QuSIL/+b+Wf/Kb8XCBAgQYIGDfkgH8RADMRCLMRBHBSEghCBCMRDPBSCQlAYCkNRKAoJkAAloAQgIBAQlISSEIUolIbSkAiJUBbKggMHSZAEFeBWqAgVoRJUgspQGapAVagK1aE61IAaUBNqQm2oDXWgDtSDenAP3AP3QkNoCI2gETSGxtAEmkBTaArNoBk0h+bQAlpAS2gJraAVtIE20A7aQXtoDx2gA3SCTtAZOkMX6ALJkAxdoSt0g27QHbpDD+gBPaEn9ILe0BtegpfgZXgZ+kMdOQAGwkAYBINgCAyFofAqDIfX4DV4HVJhJIyCN+ANeBPGwBkYC+NgPIyHGnIiTILJQHIqpEEaTINpMB2mwwyYCTNhNqTDHJgLc2EezIf58AEshA/hQ1gMi2EpZEAGZMIyyIIsWA5nIRtWwEpYBathDayGdbAe1sFG2AQbYQtsgW2wDT6FT2En7ITdsBv2wl74DD6Dz+FzSIUcyIGDcBAOwSE4DIchF3LhCByBo3AUjsExOA7H4QSchFNwEk7DaTgDZ+EcnIPzcB4uwAsJ3zTfW2ZDqpCXaallPplPxsgYGStjZZyMkwVlQRmRERkv42UhWUgWloVlUVlUJsgEWUKWkChRkgxlSVlSRmVUlpalZaJMlGVlWemkk0kySVaQFWRFWVFWkrfLyvIOWUVWlR1ddVld1pCdXE1ZS9aWtWUdWVfWk/VlfdlANpANZUPZSDaSjWVj2UQ+KJvKATAEHpaXJ9NCjoSWchS0kq1lG9lWvgmPy/ZyDHSQHWUn+aQcB2Ohi2zvkuUzsqucBN3kc3IyPC97yKnQU74oe8neso98SfaVHVw/2V/OgAFyoJwNg+RgOUQOlfOgrrw8sXrydZkqR8pR8g25FN6UY+RbcqwcJ8fLt+UEOVFOkpPlFDlVpsl35DT5rpwu35Mz5Ew5S86W6XKOnCvfl/PkfLlAfiAXyg/lIrlYLpFLZYb8SGbKZTJLfiyXy09ktlwhV8pVcrVcI9fKdXK93CA3yk1ys9wit8ptcrv8VO6QO+UuuVvukXvlPvmZ3C8/lwfkFzJHfikPyj/JQ/IreVh+LXPlN/KI/FYeld/JY/J7eVz+IE/Ik/KU/FGelj/JM/KsPCd/luflL/KCvCgvSS+FAiWVUloFKp/Kr2JUARWrrlFx6lpVUF2nIup6Fa9uUIXUjaqwKqKKqmIqQRVXJZRRqKwiFaqSqpSKqptUaXWzSlRlVFlVTjlVXiWpW1QFdauqqG5TldTtqrK6Q1VRVVU1VV3dqWqou1RNVUvVVnerOqquqqfqq3tUA3WvaqjuU43U/aqxekA1UQ+qpuoh1Uw9rJqrR1QL9ahqqR5TrVRr1Ua1Ve3U46q9ekJ1UB1VJ/Wk6qyeUl3U0ypZPaO6qmdVN/Wc6q6eVz3UC6qnelH1Ur1VH3VRXVJe9VP9VYoaoAaqV9QgNVgNUUPVMPWqGq5eUyPU6ypVjVSj1BtqtHpTjVFvqbFqnBqv3lYT1EQ1SU1WU9RUlabeUdPUu2q6ek/NUDPVLDVbpas5ashfKi34L+S/+y/yR/z67NvUdvWp2qF2ql1qt9qj9qp9ap/ar/arA+qAylE56qA6qA6pQ+qwOqxyVa46oo6oo+qoOqaOqePquDqhTqqf1Y/qtPpJnVFn1Vn1szqvzqsLf/kZCA1aaqW1DnQ+nV/H6AI6Vl+j4/S1uqC+Tkf09Tpe36AL6Rt1YV1EF9XFdIIurktoo1FbTTrUJXUpHdU36dL6Zp2oy+iyupx2urxO0rf84fzf66+dbqfb6/a6g+6gO+lOurPurLvoLjpZJ+uuuqvuprvp7rq77qF76J66p+6le+k+uo/uq/vqfrqfTtEpeqB+RQ/Sg/UQPVQP06/q4Xq4HqFH6FSdqkfpUXq0Hq3H6DF6rB6rx+vxeoKeoCfpSXqKnqLTdJqepqfp6Xq6nqFn6Fl6lk7X6Xqunqvn6Xl6gV6gF+qFepFepJfoJTpDZ+hMnamzdJZerpfrbL1Cr9Cr9Cq9Rq/R6/Q6vUFv0Jv0Jr1Fb9HZervernfoHXqX3qX36D16n96n9+v9+oA+oHN0jj6oD+pD+pA+rA/rXJ2rj+gj+qg+qo/pY/q4Pq5P6BP6lD6lT+vT+ow+o8/pc/q8Pq8v6Av6kr50+bIvkIEMdKCDfEG+ICaICWKD2CAuiAsKBgWDSBAJ4oP4oFBwY1A4KBIUDYoFCUHxoERgAgxsQEEYlAxKBdHgpqB0cHOQGJQJygblAheUD5KCW4IKwa1BxeC2oFJwe1A5uCOoUkAE1YLqwZ1BjeCuoGZQK6gd3B3UCeoG9YL6wT1Bg+DeoGFwX9AouD9oHDwQNAkeDJoGDwXNgoeD5sEjQYvg0aBl8FjQKmgdtAnaBu3+uX5Q9Q/U9/5MkSdcP9PfpJgBZqB5xQwyg80QM9QMM6+a4eY1M8K8blLNSDPKvGFGmzfNGPOWGWvGmfHmbTPBTDSTzGQzxUw1aeYdM828a6ab98wMM9PMMrNNuplj5pr3zTwz3ywwH5iF5kOzyCw2S8xSk2E+MplmmckyH5vl5hOTbVaYlWaVWW3WmLVmnVlvNpiNZpPZbLaYrWab2W4+NTvMTrPL7DZ7zF6zz3xm9pvPzQHzhckxX5qD5k/mkPnKHDZfm1zzjTlivjVHzXfmmPneHDc/mBPmpDllfjSnzU/mjDlrzpmfzXnzi7lgLppLxl++uL/88o4aNebDfBiDMRiLsRiHcVgQC2IEIxiP8VgIC2FhLIxFsSgmYAKWwBJ4GSFhSSyJUYxiaSyNiZiIZbEsOnSYhElYAStgRayIlbASVsbKWAWrYDWshnfinXgX3oW1sBbejXdjXayL9bE+NsAG2BAbYiNshI2xMTbBJtgUm2IzbIbNsTm2wBbYEltiK2yFbbANtsN22B7bYwfsgJ2wE3bGztgFu2AyJmNX7IrdsBt2x+7YA3tgT+yJvbAX9sE+2Bf7Yj/shymYggNxIA7CQTgEh+AwHIbDcTiOwBGYiqk4CkfhaByNY3AMjsVxOB7fxgk4ESfhZJyCUzEN03AaTsPpOB1n4AychbMwHdNxLs7FeTgPF+ACXIgLcREuwiW4BDMwAzMxE7MwC5fjcszGbFyJK3E1rsa1uBbX43rciBtxM27GrbgVt+N23IE7cBfuwj24B/fhPtyP+/EAHsAczMGDeBAP4SE8jIcxF3PxCB7Bo3gUj+ExPI7H8QSewFN4Ck/jaTyDZ/AcnsPz+AtewIt4CT3GWCli7TU2zl5rC9rrbIwtYP8+LmqL2QRb3Jawxha2Rf4hRmttoi1jy9py1tnyNsne8pu4iq1qq9nq9k5bw95la/4mbmDvtQ3tfbaRvd/Wt/f8Q9zYPmCb2EdtU/uYbWZb2+a2rW1hH7Ut7WO2lW1t29i2trN9ynaxT9tk+4ztap/9TZxpl9n1doPdaDfZ/fZze87+bI/a7+x5+4vtZ/vbYfZVO9y+ZkfY122qHfmbeLx9206wE+0kO9lOsVN/E8+ys226nWPn2vftPDv/N3GG/cgutFl2kV1sl9ilv8aXe8qyH9vl9hObbVfYlXaVXW3X2LV23d96XWW32K12m91nP7M77E67y+62e+zeX+PL53HAfmFz7Jf2iP3WHrJf2cP2mM213/waXz6/Y/Z7e9z+YE/Yk/aU/dGetj/ZM/bsr+d/+dx/tBftJeutICBJijQFlI/yUwwVoFi6huLoWipI11GErqd4uoEK0Y1UmIpQUSpGCVScSpAhJEtEIZWkUhSlm6g03UyJVIbKUjlyVJ6S6BaqQLdSRbqNKtHtVJnuoCpUlapRdbqTatBdVJNqUW26m+pQXapH9ekeakD3UkO6jxrR/dSYHqAm9CA1pYeoGT1MzekRakGPUkt6jFpRa2pDbakdPU7t6QnqQB2pEz1Jnekp6kJPUzI9Q13pWepGz1F3ep560AvUk16kXtSb+tBL1Jdepn7Un1JoAA2kV2gQDaYhNJSG0as0nF6jEfQ6pdJIGkVv0Gh6k8bQWzSWxtF4epsm0ESaRJNpCk2lNHqHptG7NJ3eoxk0k2bRbEqnOTSX3qd5NJ8W0Ae0kD6kRbSYltBSyqCPKJOWURZ9TMvpE8qmFbSSVtFqWkNraR2tpw20kTbRZtpCW2kbbadPaQftpF20m/bQXtpHn9F++pwO0BeUQ1/SQfoTHaKv6DB9Tbn0DR2hb+kofUfH6Hs6Tj/QCTpJp+hHOk0/0Rk6S+foZzpPv9AFukiXyJMIIZShCnUYhPnC/GFMWCCMDa8J48Jrw4LhdWEkvD6MD28IC4U3hoXDImHRsFiYEBYPS4QmxNCGFIZhybBUGA1vCkuHN4eJYZmwbFgudGH5MCm8JawQ3hpWDG8LK4W3h5XDO8IqYdXw0furh3eGNcK7wpphrbB2eHdYJ6wb1gvrh/eEDcJ7w4bhfWGj8P6wYvhA2CR8MGwaPhQ2Cx8Om4ePhC3CR8OW4WNhq7B12CZsG7YLHw/bh0+EHcKOYafwybBz+FTYJXw6TA6fCbuGz/7u8ZRwQDgwfCV8JfT+PrUkujSaEf0omhldFs2KfhxdHv0kmh1dEV0ZXRVdHV0TXRtdF10f3RDdGN0U3RzdEt0a3Rb1vn5+4cBJp5x2gcvn8rsYV8DFumtcnLvWFXTXuYi73sW7G1whd6Mr7Iq4oq6YS3DFXQlnHDrryIWupCvlou4mV9rd7BJdGVfWlXPOlXdJrq1r59q59u4J18F1dJ3ck+5J95R7yj3tnnbPuK7uWdfNPee6u+ddD/eCe8G96Hq53q6Pe8n1dS+7fq6/S3EpbqAb6Aa5QW6IG+KGuWFuuBvuRrgRLtWlulFulBvtRrsxbowb68a68W68m+AmuElukpviprg0l+amuWluupvuZrgZbpab5dJdupvr5rp5bp5b4Ba4hYkL3SK3yC1xS1yGy3CZLtNluSy33C132S7brXQr3Wq32q11a916t95tdBvdZrfZbXVb3Xa33e1wO9wut8vtcXvcPrfP7Xf73QF3wOW4HHfQHXSH3CF32H3tct037oj71h1137lj7nt33P3gTriT7pT70Z12P7kz7qw75352590v7oK76C4579Ii70SmRd6NTI+8F5kRmRmZFZkdSY/MicyNvB+ZF5kfWRD5ILIw8mFkUWRxZElkaSQj8lEkM7IskhX5OLI88kkkO7IisjKyKrI6sibiffEdoS/pS/mov8mX9jf7RF/Gl/XlvPPlfZK/xVfwt/qK/jZfyd/uK/s7fBVf1Vfzj/lWvrVv49v6dv5x394/4Tv4jr6Tf9J39k/5Lv5pn+yf8V39s76bf85398/7Hv4F39O/6Hv53r6Pf8n39S/7fr6/T/ED/ED/ih/kB/shfqgf5l/1w/1rfoR/3af6kX6Uf8OP9m/6Mf4tP9aP8+P9236Cn+gn+cl+ip/q0/w7fpp/10/37/kZfqaf5Wf7dD/Hz/Xv+3l+vl/gP/AL/Yd+kV/sl/ilPsN/5DP9Mp/lP/bL/Sc+26/wK/0qv9qv8Wv9Or/eb/Ab/Sa/2W/xW/02v91/6nf4nX6X3+33+L1+n//M7/ef+wP+C5/jv/QH/Z/8If+VP+y/9rn+G3/Ef+uP+u/8Mf+9P+5/8Cf8SX/K/+hP+5/8GX/Wn/M/+/P+F3/BX/SX+H/WGGOMMcb+S9TvHB/wL74n/7IuGyiEuHZnsdx/rrm58J/3g2VC54gQ4pn+PR/+66pTJyUl5S+PzVYiKLVYCBG5kp9PXIlXiE7iKZEsOooK/7K/wbL3efqd+tHbhYj9W+dCxIi/xn9f/9b/oP7jT47PrByei/9P6i8WIrHUlZwC4kp8pX7F/6B+kfa/03+Br9KE6PB3OXHiSnylfpJ4Qjwrkv/hkYwxxhhjjDHG2J8NltW6/9798+X78wR9JSe/uBL/3v05Y4wxxhhjjDHGrr7ne/d5+vHk5I7decMb3vDmb5ur/ZeJMcYYY4wx9u925aL/anfCGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4zlXf8/Pk7sap8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrX9nwAAAP//JhA6YA==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) ftruncate(r0, 0x0) 6.00185803s ago: executing program 7 (id=1815): syz_mount_image$hfs(&(0x7f0000000180), &(0x7f00000000c0)='./file1\x00', 0x1000812, &(0x7f0000001800)=ANY=[@ANYBLOB="71756965742c636f6465706167653d63703836302c696f636861727365743d63703836312c00808fead042bd35dc78f7f06333a5e7165b8271e41aee85e59cbb6c2df3d4e4c16b06c73f2e3b34ac8d4813c9c3d9cee1ddb95d1bbcf504e065b3749a1cbd841e685a558598cf0db10b55885946e678d0a71877037a090000000700848879ef1604cadc1faca3aa22a576750d559c4e124d4cb7293e7393b77286fa8c6dc449eda0a03d342382e84d6d3c29ab95cc923fbe25e134d1c421320a3bffaa17fcd6b5178e322cc47133b3811e3d3bc34998dc7ed029834ad591d9d56c41063d8de2d50a2398e73ff2913a9fe8e954a4e4ca99ceb5737e57193c5f47fd63b16c8b34f256dbac0e5ebd009078df2cb1ca0151ad091adbfee5126d8a59fa5438734bc3e8cc7b7edc10716a0a9b711952cdf96586e06fbace21dc04bdb4a1a2072ce5f72cf02e5256ff74be5e07a5f8d6ec2fa867b2a353bf6ea1b533377803804a49a499d51f1cb71e1cea551598939afe8ff8e8472352e2d5193bc866c000"/396, @ANYRESOCT, @ANYRES8=0x0, @ANYBLOB="eb4df9aa36400f1596263ee4e2ba950c3777a4ec31bc2dc78cd48b646ae82f0508a43d2064587fb0b58769e71fc7b7c8e93fa8ec644b9889e92afb0c6a178d5f85790c4047947250a43c67c7b897debc120c19d2b9c218c8a1205fae81bb140f9e9a69c60fd20d07ac3643e470a4bbe559f8b777749dd02b1336813ff11343d09bebc37a1ed9bb9ced4e3264a2ead14b4350c271", @ANYRESHEX=0x0, @ANYBLOB="0affd5ece651e2a4648f9b279d8dc44bc4bd6acc0aa01a3ab56e469d3c338a26ff996b57afbe65c4eb94f6fd4cfbda2af6c85c6e135955ca0640546a2aac7bb02432e45e6d333181ee921f9f26a8ef000000000800000000000000000000000000000000000000000000000000004de9f91aeab66cc8b2197d3c00068324c7b7bd"], 0x1, 0x305, &(0x7f0000000340)="$eJzs3U1rE1scx/HfmaRNepvbmz5cLtxltaAb0boRNxHJWxDEhWjbCMVQUSuoG1NxJaJ7974FX4QbxTegKxfiC2g3jpwzD8kkk5k0JB2D3w+Ik8n85/zPPP5PoBwB+GNdbX55d/Gb/WekkkrSy8uSJ6kqlSX9q/+qj/b2d/fbrZ2sHZVchI58GQWRZmCb7b2W+/8gudrGuYhQ3X4qq9a7DtPh+/6Vr33rvnsFJYPCuLs/hSdVwrvTfV898cyyHYwZ15lwHrPGHOpQj7VUdB4AgGLZ9/9BUPjb93wtrN89T9oIX/u/5ft/XIdFJzB1fua3Pe9/N8ryjT2//7ivuuM9N4Sz33vRKHGUluf6Ps8rKCQTBaZJH1V2h3wuF2/hzm67dW77XnvH03M1Qj0Ba3ELIXuF5mS7njI2zTBC301qRRmk5c3ZPmwOyX91zBYzDAzfEifEfDCfzE1T11vtxPVf2Tc2W5dwve9MBfmfH97eoouyWyl8bDQaDc/tKLLsGvk/eaZyellNH5EoOrDLSv5AUM/L00Wt9EUFvbuQGlCJo1ZTozajT0PaWktE2d7EV/PwLKfNvDbXzbp+6L2aPfW/Z/Pb0PA7M/GLjtkIbjR3xIP+zKc3V3b7rA+8OTq6UUuuiY9iZVjqR9nPNIwgOoevtKVLWnr45OndUrvdemAXbqcs3K/Fa+ZeSKnbFLygTndNRb4zsHH0DEyEL4Qrp5TY2Ynu0D4/cje2d9mJHPneKyG6YSfWhLziL62sa6P5se9CmtiCX5nwDn/6Y0T9fcIPJRSle9KLzgQFsXWXCcZ/rpIP631Xr9lq4VpleJ0eFWRpJZur3sM9+rbGjkdA1UT8ilv6K1lG54wNFsM6JmUc19FoY65TZ6TTo7dYD/OcDf6znA1MU591i9//AQAAAAAAAAAAAAAAAAAAZs3x/65g4dhRRfcRAAAAAAAAAAAAAAAAAAAAAIBZF8//q2j+X402/2//VCzh/L9V5cz/uzWYw8D8v2/2ZDoS8/8C0/UrAAD///8sd7M=") r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) getdents(r0, 0x0, 0x58) 5.955520051s ago: executing program 5 (id=1816): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='Te', 0x2) 5.461024313s ago: executing program 9 (id=1818): syz_mount_image$btrfs(&(0x7f00000055c0), &(0x7f0000005600)='./file0\x00', 0x8010, &(0x7f0000000040)={[{@compress_algo={'compress', 0x3d, 'zlib'}}]}, 0x1, 0x559a, &(0x7f0000005680)="$eJzs3X2QVWUdB/Bzd1lYZGI3BMGBFShfQEIhpVRS7kBBuDJtkjU2GQtioaAwzBI1ii04WLgam1kz5QxCiwjDUmszGmXlygyQk9PWjIPIgjLThjG9SMXEFjU2e+99Lveey+5eyVxfPh9m99zn/s7znOeeOX/c72WfcyMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIoujgjtr/rB1ZV75+06hFt199cPSq0RNWVDWdHHWg+rzdl/absWjovuntdw6b0bH6SPX65tsu6IyiRKpfItN/3vSPX/+FufPmlIcBaz+Z3lZWdnfIdNfD6Ub/vCe7+uX/zI+iqCw2QGlmu7s0p52IHyBaXjhgj8pmbVsycEGyduvmp+ouX7J1XOFLp0t5X0+gr2Suq45T11Iy9bsktke2nXPpJfIu0XT/+AX3prwIAOB1mVST2mTfjmbe4mbb9fF6rJ2MtRtj7fAOoTG3cSbS4/bvbp5j4vU+mmcyHRUGdDvPWD1z/rPtmnj/WDsWNV7HPPN3zUSa8u7muSxW76t5AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALyVvFa3Ys34z714sOyX549bvfLk4WvLL3zoq/8uWXrzS68dqlnzl7ah+6a33zlsRsfqI9Xrm2+7oDOKKlP9EunuiWknXr1kYvWcUeuf+N7ETc+OP16aGTds++XsHO0PD66siKIFOZWOMOzRwVFUk19INaPvFhZuTT2YHQoAAAC8k5yb+l2SbafjYFleO5FKk4nUvyAdFstmbVsycEGyduvmp+ouX7J13JmPV9PNeMnTjpdtV576SeQE4xB/4+OdqoddlxeM07P4iPE8P+X5l1+oGHHtT5+pOu+mlde/NPKax9tmfnP48UX7K+8YtGrc2CsK8n9lz/k/nDn5HwAAgP+F/B8fp2e95f/PzK+75Y5HvnJszD2HVw66+8H9G4eVH7nplsn7/jj8hosvvqz2xoL8PybvkAX5P8w45P+S6MzyPwAAALyV/b/zf7JgnJ71lv/bhzff/MB7Di2sbOt4evtlK/b0X3j1RUMOPHTR3In3XjdozPkNBfl/UnH5v1/utMOTz4UJL66IoknFn1QAAAAgT/h/91MfLYS8nv7kIJ7XW+dtGd3y6swvTxj78KH6P1Vtnvj5jUMe37lh5jd2PXf3/RPbzi7I/8ni8n/Zm/NyAQAAgCI0HTpnxNBPJ38e3X/01vnf/+yuR+9b+sWrLtnbOWvC2l9UP72jviD/1xSX/wf0zcsBAAAATuPE+GsW/mPnkd9e1/yJ+5qO/v5Lq0p/NaNp9/62hqZ/bh81e/XkgvxfW1z+Pyuzzax8SHfaE/4K4VsVUVTe9WBZurA3apyWLQAAAABvkJDT75ryfMm9A6edu2Xub06Me+KFPZ/aN3vxhnPWTGp69n2tiz9y4WMF+X9Zz/f/D3c6COv/8+7/V7D+P6eQvuvfVDcGAAAA4N2ocD1/uD1++psLuvv+/WLX///w6xv+mqiqf/ID8342q/P9zT/Z2zr1wZNVf5hz/OGW5MgnL32xIP/XF5f/S3O3b+T3/wEAAMAZeLt9/9+NBeP0rLf7/7c980j1o1d+6GtXza2buuN3H77iz68Mn9qwPXpl+UfbFx342K5fF+T/xuLyf9gOyn15reH83FMRRSO6HmTuJrgtTHdxrNBSllNIn/hYj7mhR6bQMiCnkLIs1uODFVE0tutBfazw3lBojBWODc4UNsYKbaGQuR6yhR/ECq3hSvvO4Mx044Ufh0JmgUVLWEExKLskItbj79316Cqctkd79uAAAADvKiE8Z7JsWX4zikfZlkRvO5zV2w4lve1Q2tsO/WI7xHfs7vmoNr8Qnv/Rt294ecBdD2yom7Jl04KqhrPX/euxyZNuX7Z2Z93SziF/W7euIP9vLC7/h1PRP73pbv1/FNb/Z77XMLv+vzYUKmOFllCoid8xoCYcIx12G8IxKmsyPY6NyBYAAADgHS18LlDax/MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/7J373FW1nXiwL8zzIUZhplRMS+RISaKwTCMKYaZID/TnwQOq6WFJgSDjgxCXEzQTUTd1VzB2+ZtE0jdtIwoNbVUeGnekspLsKl5SfHSK41lS5Js133NnPM9nPOcOc5BQBn3/f5jzvecz/f6nMuc7/M85/sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/N2z85GVfeHmfj/xg3cKBi1eP+krfI4cMn3DMNTceu/jhb0/e777f//8+aw575sydR60955XRi245de+3QmjuKFeSKl5y6F/XNQwePabvotuvGbz0kYF/qUjXm46HXu1/StN3zoutru0dwh0lIZQlA4NrUoHy9P2aWF/fmhB2CJsCmRIt1akSyYbDA1UhLAmbApmq7qoKoSYrcOwT9624uD1xRVUIe4cQKpNtPFuZaqMqGRhQkQpUJwPTy1KBv76TkgncWZoKwBaLb4bMi355c26G+s7LFXj9lW+1jn2wksPrERP1hfO9MXIbdypLRfKB5i162vKqY5vIe3us9G7rBu+2vO18iact+4tU+hvKO5tClaF0csuUiXPaZsdHSkNDQ49CNW2j5/np9WdN2px0t3kdxg7Ub5XX4aoLe49d/OhRw2+tG35Dn0ELN25pNwtt3m2tMqRfc93meYxG+DzpBm+/vG9J/XzpCiHsf9v42798wcs3L7h87K4HPbHTsDc+u/vdLT+75YTxxx++fsVXf//jvPl//bvP/+PLOd6W5uSOrb5dm5qbx0dqYmJdbWpuDgAAAN1Gd9hr+srq/5722X3HDX185OrqW2+659SL7/v8tT9r3a/t4bE77fj8vvN+lDf/71fc8f94yL8me7QrQxjRkTi3LoRdOx5PBW6O3flqXQh7dqSacwMjE4GVIezWkRiYqSpRomcs0S8ReLU2HRiRCDwYA82JwI0xcEkicF4MLE8EJsXAykTgsBgIrbnj2K82PY6iA1UxMCG1EZfHsxD+XBtbS2yrZzJVAQAAbCXp2WF57t2scx22NEOcXi6v6ipDPAO7YIbKRA3JGWxmWlWwhrKuaijtqobMuOe/+/Dzai7pqua80zBKcjNcWXXLpT8aNumNu2e8tOG0Iz7x2quP1S/96afXXfPGU9Mr79/j8ofz5v+N7z7/r+ykIyV5x/9DGNfxN+YuTUfaMvEJzTkZAAAAgC3w1sADvvydsq/NfeH3jwz75K+vfez1lQ9/dO8zb1v7/Bk/+NZ3au4fnTf/H1Hc+f9xn0iPrMxhVdwNMbUuhMbcQKrag/MDqaPevdIBAAAA6A4yx+Mzx8Jb07epU7ST8+n8/M2bmT8e+B/Raf7131p2/Y6feGT2Q7W3zXhqw+NfWTl64bEz3xh05dmP7HvoQU+N/Gze/L+5uPP/q3NvU514MPbi8roQemYFHoq9bA906BcDLxyaG0iP/8G4AS6KVaVPTMhUdVEsMSEGGhOBJYVKPJYpsWtuIP1kZRo/NzOO1nSJrAAAAAC87+LugHhcPp7/v2LBXZf9x41/umzVgUtnnzz98de+V1H5zknL7zyxzwX39li008hJefP/CZt3/n/HPDjv9P62XiEMKQuhR/KHAauqUwsDxkBNSTpxT3Wqrh7JqhZUh3Bw+8CSVb2YXv+/LLnG4JNVqapiYNf+N60f0J64oSqEIdmBNeOXHtCemJMIZBr/YlUIH28fbbLxn/RMNV6ebPyqniHskRXIVDWpZwjtjVUkq7q/Mn0dg2RVyytD2CkrkKlqWGUIcwMA3VX8Xzo5+8FZc+dNndjW1jJzGybiTvyqMKW1raVh0vS2yZUF+jQ50eecdYzOyR9TsZe++V16jaLVx0ytKyad+aFgY3Zb6R35eWcOpu/HL0PlHeNsKs+5u39yyPvuld9EyPoqVWjIpdt4yNXZlWx6EvPqj/krQq/Qc86slpkNZ0ycPXvm0NTfYrM3pf7G40ypbTU0ua2qO+tbES+PgstlJbzXbTUgu5Ihs6fNGDJr7rzBrdMmntxycstpwz7VNKxp6P5NjUPaB5X+28VIB3RWc2Kk7ywtclhbcaS7l2VV8n58aEhISHS3xE2Xj39m0UcXV3538UmXPHH++WefcvrOt1057ft9p48fdOXnlkz9et78f8a7z//jp0784E+vz1Do+H99PMyfenzTYf4JMbCk2OP/9YWO5mdODOiXCMyPgfkO8wMAAPDhEHdHxr2Zcad07SvfOP1/Tjii9NA/HP2LpqGDdrnw1qkDbnx94+kf23vekmvLKvKv/ze/uN//b6X1/zNL1x9VaJn/gbFEY6H1/5PL/GfW/59faP3/5DL/mfX/l3wA6//PyQQSm+TP1v8HAAA+DN6/9f+7XN4/eYGAvAxdLu+fvEBAXoYul/Ev9gIBm73+/89/XrbDx47YrW/ZF56YuNedB/7mpGkP7vKjUVev+3RT/TfPWPPzZXnz/0uKm/9buB8AAAC2Hyfs+6UBC14a8vVzpj/ww8Ezdn7purOfH3HPL4/75MYxfddVr+v76bz5/5Li5v/v//p/odD5//0KBZoLLQxo/T8AAAC6qULr//3t42d987p+O24Y1O/M29+6emrJ8L2fO/XXbRc9NOrwj435xyWTrs2b/y8vbv4fT7sozckde/N2bWpNu5Bc025dbeYnAwAAANA9lIaGhvIi8+YsjDryvbf5dHop0HdLZ9vtE6vWnHvvdX8fcvP5C9Ydf3rtQUf+oeyQOydf99KCU/boX/Pc2rz5/8ri5v85v8tYdWHvsYsfPWr427fWDb+hz6CFGzcd/wcAAAC2nWL3SwAAAAAAAAAAAAAAAB+8Y1b95Kz/+uWY4+4cNu/qR3d+/OT//PqsM1on/aLtiHUHPLv0hk/tk/f7/zCuo1yh3//H6/7F3xf0yckdW+16/b/0/WNHL5vbsWThqtoQ9soOTF0wdYeQvjb/PtmBFScO3KU9sSBZ4u7nDnu5PXFSMnDk4B03tCc+kwhMiIsk7pYMxKsqbuidCMTlFZ9MBuL2WJ4MVKQDF/ZOjaMkua3+UJPaViXJbfV0TQh1WYHMtrqjJtVGSXKAVyQCmQF+LRmIAxybDpQme7WsV6pXMVATiy7uleoVAADbrfgtsDxMaW1raYxf4ePt7mW5t1HOkmXn5FdbUmTzv0svTbb6mKl1xaR7JL+LbrrWeHmobB/C0Lyvq9lZSjpGuXVq6WLT9Skw5K5WeystUC5pczddReERVaVG1DBpetvk8i4Hvn/XWZrKuswyNG+yk52ltGOTFlFLEX0pYkRFbpsiuhzvl4aGhh6JXMNjsD7k6OoVUezv9bPX+Sv0KsjOs3zUQQOOW/bcgRMWPXnQtKnhI5e9M2Li5FmHXPHiU0vnjxw0oUfe/L++uPl/Zfa4NqQvBjA/Xlnv4LoQJhQ5IgAAAPjwO+W05y674P5LX32hecDL04dcuuK3c6+aV1Z783mHP3336W+OX3jSlsYHDHtj6Kl3/ebcjU2jHrqy99X3X7PTkXU//H/Vvea+tWLQmy/cvVfe/L9fcfP/uAcrfSg4tbdjZbz+/7l1IXRcWr8+Fbg5DverdSHs2ZFqjiVSF9Q/KpZoTAVujjtMBsYSE5pzq+oZA8sTgVdr04GVicCDMZDeS3FTSO/KubQ2hAM6UuNyS8yIJeoTgaNjoF8i0BADjYlA7xgYkQi83jsdaE4EHo2B0Jq7rW7tnd5WAAAAmyM9zyrPvRuS87zlZV1lKOkqQ3VXGUq7ylDZVYZCo4j3fxwzlCdOXinJylSerLUqUUtehngx/M3uV16G8FhuzmTBvKbj+QeZ8w1KcjNccWbF9Dc/33/R8UPGrB/ftPhzc38a/uHtOW9d8OYvz6977pqNJXnz/8bi5v/Vubep1h+M8/9N1/9LBR6K3bs8njreLwZeODQ3kN4x8GCc7F6Uqao5XSI9ab8olhgRA/0SgRkxMCIRmDAuHViyS24gPdPONH5upvHWdImsAAAAALzv4g6CuJsmzv+fXTv+iWnjf3vQZX1nLzx/+VFffvrXx736i3t73v3d/osebitZuzpv/j+iuPl/bK9XdmPnxd6s7R3CHSWbepMJDK5JBeJ+jJr48/i+NSHskLWDI1OipTpVoiLRcHigKvUL9YpkVXdVpdYYiPePfeK+FRe3J66oCmHvrL0vmTaerUy1UZUMDKhIBaqTgellqUDc85MJ3FmaCsAWy+wVjC+o9KkuGfWdlyvw+vuwXBM0Oby8faCd5OvsN1fbSmXygfQ+1YzNe9ryqmObyHt7rPRu647vtnrvtuwvUulvKO9sClWG0sktUybOaZsdH8n+JWuebfQ8Z/9KtZj0Vngdzn/vve1aZbIDjYmPj8bOy3X+OiyJ1a26sPfYxY8eNfzWuuE39Bm0cGPR3Sgg/lB45rCr6rM377ZWGdKvuW73edLs86Q7/hvo52kLIYy7d+xFjYfcuHDSiP7X73xH7fDLvzT4lkMbnx1XM2eXw8e89sV5efP/5uLm/2WJ2w4b48acVRfCvlkbd1Xc/KPqUp+DWYHUp+RO+YHUIfeXagt+cgIAAMDWltndkdlf0Jq+TZ0Qnpwn5+dv3sz8cX/FiE7zF9vv/lecsnL0hAN/23f8XoccvM9Zdy04er+/Tbz+tT9Wj5z0wPd+tfr6vPn/hHef//dMdNPxf8f/2UYc/+/U9r4rumfygflbtCs6rzq2Ccf/O7W9v9sc/++U4/+O/3fG8f8uOP7fqe39acv7ljTDl64Qwr9f/vm/vX3Pbv02LC393pQH5vU//rLvL1r2k52f+efH/mn69H33/FXe/H9GcfN/6/91vmhfZv2/CYXW/5tRaP2/+db/AwAAtqkCC80l53l5q/flZUiu3peXocsFArtcYtD6f5u9/t+L/3Lpgr2mjv3GiWc9dnDvR+tHrRkz6O8nvbrnmuuevHLoIyf8/dt58//5xc3/48uhV3br3WX9v37jClR1SQzMsDAgAAAA26NCOwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4YJ31xynnjVjw+J+ap39l/fLx32nd8fGHprzefMQPRy87es0pu5xyb581hz1z5s6j1p7zyuhFt5y691shtHaUK0kVLzn0r+saBo8e03fR7dcMXvrIwL9UpustT99+NCd3bPXt2hCWZD1SExPratvvbAocO3rZ3LL2xKraEPbKDkxdMHWH9sSNtSHskx1YceLAXdoTC5Il7n7usJfbEyclA0cO3nFDe+Iz6UBJsrv/1jvV3ZJkdy/uHUJdViDT3VN751aVaeOIdKA02cZ3a1JtxEBNLHpVTaqNGGiLJVp7hjCkLIQeyaoeqUxV1SNZ1U8rU1X1SFZ1dmUIB4cQypJVPV+RqqosOfLHKlJVxcCu/W9aP6A9sbQihCHZgTXjlx7QnpiZCGQaP6YihI+3v2SSjd9anmq8PNn4v5aHsEcIoSJZ4s2yVImKZIkXy0LYKSuwaSOWhTA38OEQP30mZz84a+68qRPb2lpmbsNERbqtqjClta2lYdL0tsmViT4VUpKVfuec9z72360/a1L77epjptYVky5Llyvv6HJTec7d/bf33sd+VWdXsun5yKs/5q8IvULPObNaZjacMXH27JlDU3+Lzd6U+tsjHU1tq6HdZVsNyK5kyOxpM4bMmjtvcOu0iSe3nNxy2rBPNQ1rGrp/U+OQ9kGl/26NkS59/0e6e1lWJe/H+19CQqK7JUpzPt0at/fP8bwv+ps6Wh4qOz6g86YV2VlKOka5NQY98j2O+L18TelyREPzJg55WZq6zrJ/3mRiU5aqVJaOr3V5k8Psmko7Nmm8XxoaGnoU2g71uXezN+8bW7B5n05vumLTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwv+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwLAAAAAAgzN86jJ4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAD//+GI8JI=") syz_mount_image$fuse(0x0, &(0x7f0000000400)='./file4\x00', 0x1018000, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file4'}}], [], 0x2c}) creat(&(0x7f0000000240)='./file1\x00', 0xd) 5.421038914s ago: executing program 7 (id=1819): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x6180, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) 5.420950464s ago: executing program 5 (id=1820): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40482, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4005}, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000400)=0x2) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd06000040", 0x27}], 0x2, 0x0, 0x4) 5.009118624s ago: executing program 5 (id=1821): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 4.991662995s ago: executing program 7 (id=1822): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_mount_image$f2fs(&(0x7f0000000100), &(0x7f0000010600)='./file0\x00', 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="6163746976655f6c6f67733d342c66617374626f6f742c746573745f64756d6d795f656e6372797074696f6e2c6673796e635f6d6f64653d7374726963742c00200da779e57c52e33a83fdbd563a5b7c6b958cb6e49387a5ba5a89b0887c0292eb888cc8efa81040100d83ba748033542625bc334eaf793332891541000f3c63c0a5f0af254a5bd1f4b81d0c5188ddcadf07eff7b49004e0b243a8a4d93632fbe9ab868d88310829d8e04a3c0572143a3d3d1472cc5da6f72bb097f5f7b95a09e442c0a1463aaa90db7dcbc542dc5bced278eda11583f810469b706968e793db32300c41ec42421e326f0f3d24478d7f472cf86b66accda698e56ae96dc33ced02f8e6601ed0a758a9f6b0712af45bc138adb9217e31e309a3039a15f4f323957b2824eb068440a8e9c31857f52472347e7560aa15cb70c902000000326a7321796b653e49bbde9213cfcd77871a61e6daf5deab0eea", @ANYRES32=0x0], 0x1, 0x105d6, &(0x7f0000010640)="$eJzs3E1rY1UYB/AnU+fVcRxkXnTlBREaMKFpO0VBpOoMOmCH4svClaZJGjKT5JYmfXHWuho/gltBxJ2fwY1fY3AhiAvB3YiSe29lqrNwOmlT298Pbv/nnpz75JxLNie3JIBj62Ly+2+luBBnI2IqIs5HZO1ScWQW83g+Il6MiBMPHaWi/++OUxFxLiIujIrnNUvFSwt/3H/w9Qs3X7/37f1y7edvvprcqoFJezkiemt5e6uXZ9rO83bRX9/sZNmb3ywyf6F3pzhP89xqrWQVtuo74+pZzrXz8enaxmCUq916Y5TtzmrWv9bP33Cw2d6pk11wu76enTdbK1l2BmmW7bv5vLaLvDsY5nWaRb3PsvIxHO5k3t/abuXrWbuTZaM/LPrzummztT3KzSKLt4tG2m1m81jZ820+9N7r9De2k83W+qCT9pNr1dqr1dpCpbaeNlvD1nyl3msuzCfT7e5oWGXYqvcW22na7raqjbRXTqbbjUalVkumr7dWOvV+UqtV56ozlWvlovVK8s6tj5JuM5ke5Vud/saw0x0kq+l6kl9RTmarc6+Vk5dqyQdLy8ny+zduLC1/+Mn1j2+9uXTz7WLQv6aVTM/OzM5WajOV2Vr5cK7/VFF/jOufin1Yf+nJLue48wECeGz2/8Ak2P8/zv4/2fN9PuyOyP7/13vHe/17ZvvGE/EBAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4tn46+f27WeNifv500f9M0fVcRFyNiCsRcTki/nyEqTi1q+aliCgV7UeNP/mPOfxQiqzC6JrTxXEuIhaL48Gz+30XAAAA4Oj67sfPv4iYGjWzP29MekIcpOJLmzPjqpd95fPUuKpdyoptj6na5Z2SY3ElIk5e/GVM1a5GxInzn46p2n8ytSvOPBSlPE4c5GwAAICDsXsnMLbdGwAAAIfOl5OeAJORPa8t/he/eBZ8Oo/igeDZXWcAAADA/1Bp0hMAAAAA9l22//f7fwAAAHC05b//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwF/s3E+uEjEcB/Af4Aj4JxLDn6uwMi5ZcAiP4NID6G3ccQYTwjlw5xEMGDqVAOLmTXlM3vt8kplOJ/Bth4RFWygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAt/axWi++br9+a5uz2zZR5GgAAAOCabbVapItRXX+d77/Nt95HxCwiphExiYhrY/devDxJ7MQ4nWvXXl9d9OFHREo4vKefj1cR8TEfv9/d/nMAAACAp2qzni8jeofLdPpwvOIZyJM2g1J5acrnRam0cQr7Uiht8jeyiGlEVKNfhdJmEdF98ynX/vv9GxZq7qSRXAxOik5ddAs2BgAAtMT5SKDY6A0AAIDW+XzvDnAfab02/xY/rwX36yIvCA7PagAAAEB7Xf7b/qjzuP0AAAAA7iCN///Z/y/PCjx8/7+w/x8AAAC0SL3/HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALe0rVaLzXq+bJqz2zdT5mkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4w/68o0AIhEEY7F3fdxq8/7GkQVNTkyoQPv7GYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDe/+8v/ialxJpl7bSw9jyRrp8bWqbF3bhz9YXz9GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgYn/uTiAEgiAM9p3/OS3mH5Y0aAwiVMHCxwzzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX/S7X/5PTI0zydxpY+l4JFm7amxdNfYeNI4ejLd/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdife9uEgTCOw6+dRInbZIT0Fh8z0FAhGIEPCcmSZ2AAFqKhorVYBFYAAQctnSl4nub/0+mKOwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgPZ2e3viIiOzzkXnkw9Xf4XLwFfm6aQbf18w2x339c8vJdjdK+Rvj/yIiisha+A0AQPvK+6ZYLKt5J203bS9tP205ravZKx8NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwZucOWqJ4wwCAv7s6699/p44qRNChLrmpWQZeOgjeg6BuoptIa4XuQcWLnyDqtNe+Qt7qK/QFgg4leOjgoaBLEMXuzuq7pKIEM4P7+8Ez8+jCzPvuwrDPPO8sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAuBzvhUjcvhRBGB4/ylo/ftheP279/+Wm0G1/vv7sSH7N1iCSE8GSlXruV4VyKbn1z6+lCvV5bk/RDMpR+7EUZj6SwSXyVKOVzcQIA4EJJ0mh9u/yS7M63/leaDeH3m976/3qUh1Pq//3mSBKaI2P7zZGxXxsfGvG54vp/IrMZFsbQSS9UG6svquubWzdXVheWa8u1Z1NTk9N3pm/fuztZbd8rqbpjAgAAwL+ppBHX/+XZv/v//0d5OL3+H+vGw7nHj+JzDfR3/X+io6Zf3iMBAADob5ev/vh+3OrLUqUSNhYajbWJzvbw78nONoehnttQGnH9PzCb96gAAACALBzslHr6/0tRHs7Y/x9/u70XH3MghDCc9v/HF5/Xl7KbTqFl8Thx3nMEAAAgX8NpxP3/pL3+v3y45KEcQrhxrZOnPwN4pvr/8+sHPQ+tx+v/p7KbYiGVZzrvR3s/E8LgTN4jAgAA4CL7L41Wsb+X7M6v/Xw1V7H+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4w44dozQQRGEA3uxmtRIDVmrlBUQvELEQxMZDiILgCUQQDyC2lt7B0jukVrCxsEzhDeTN7qikCVjsKvk+mLxHGDIvkyb/AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNd0/7uv4mXU9GX73vPH1UnUl5ka3u/XN2NFP+hy6H9nr+8BAAAAWBBVzvdFUbzVj4dRy3HK/3XeE5n/YaXpc56fzf25Pt29buT8f328dfl10Kg5Jz707PzidKezb/j3rc7dMUw3n569VOkHKY9u1qZ1us/B7WRysJTa5S6mBQB+YzvXtsn/h6Lu9jkYAAtj2K7iR/6vxv3OBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCFzwAAAP//9JxdmQ==") mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) 4.327580741s ago: executing program 1 (id=1825): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000140)={[{@jqfmt_vfsv0}, {@auto_da_alloc}, {@noblock_validity}, {@grpquota}, {@inlinecrypt}, {@delalloc}, {@nomblk_io_submit}, {@errors_remount}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x141442, 0x40) fallocate(r0, 0x0, 0xfff, 0x9) write$uinput_user_dev(r0, &(0x7f0000000300)={'syz0\x00', {0x8001, 0x2, 0x9}, 0x26, [0x2, 0x79, 0x2, 0x8, 0x0, 0x4, 0x8, 0x800, 0x4, 0x2, 0x9, 0x8, 0x7, 0x4, 0x5, 0x0, 0x3, 0x1, 0x3, 0x0, 0xe, 0x1200, 0x9, 0x9, 0x1, 0x5dcf10b0, 0xfffff075, 0x1, 0xe16, 0x6, 0xe, 0x7, 0x7fffffff, 0x7c, 0x0, 0x4, 0x9, 0x1d49cc9e, 0x5, 0xffff, 0xa93, 0xc, 0x2, 0xfffffff9, 0x5, 0x0, 0x0, 0x54, 0x100, 0x7, 0x1, 0x4000009, 0x1, 0xf, 0x62c4, 0xffff8001, 0x3, 0x6, 0x1, 0x9, 0x80, 0xc, 0x3ff3, 0x5], [0x5, 0x4, 0x0, 0x5, 0x8000, 0x4, 0x21, 0x8, 0xff, 0x4, 0x100000, 0x1200000, 0x71, 0x3, 0xa, 0xffff, 0xffff, 0x3, 0x9, 0x7, 0xfffffff7, 0x0, 0x6, 0xfffffffb, 0x5, 0x145, 0x8, 0x0, 0x6, 0x3ff, 0x7, 0x7, 0xe366, 0x2000000, 0x1, 0x7fffffff, 0x2, 0x0, 0x3, 0x8, 0x6, 0x5, 0x7, 0x5, 0x4, 0x7, 0x0, 0xa4, 0x5, 0xc, 0xfffc, 0x5, 0x1, 0xbf, 0x4, 0x4, 0x6, 0x8, 0x3, 0xfffffff0, 0x5, 0x6, 0x5, 0x4], [0x6, 0x2, 0x2, 0x1000, 0x81, 0x9, 0xa887, 0xf085, 0xa, 0xffffefff, 0x9, 0x897, 0xfffffff9, 0x7, 0x6cad, 0x8, 0x8, 0x99a, 0x8, 0x3, 0xffff, 0xb6c2, 0x8, 0x8, 0x10001, 0x2, 0x7, 0x3, 0x2, 0x3, 0x6c, 0x9, 0xf, 0x401, 0x6, 0x0, 0x8, 0x6, 0x1, 0x3, 0x2, 0x1, 0x2, 0x2e3e1caa, 0x3, 0x800, 0x7fff, 0x0, 0x8001, 0x0, 0xee33, 0x3, 0x1, 0xa9e, 0xfffffffb, 0x7, 0xc, 0x0, 0x4, 0x5, 0xa, 0x1, 0x400], [0x4, 0x7, 0x7, 0xfffffff6, 0x6, 0x9, 0x0, 0x6, 0x10001, 0x7, 0x2, 0x44, 0x10, 0x7, 0x8, 0xfc, 0x5e, 0x8, 0xef, 0x4, 0x1, 0x9, 0xd, 0x3, 0x3, 0x3, 0x5, 0x24, 0x1, 0x6, 0x4, 0x81, 0x288, 0xfffffff8, 0x9, 0xacb, 0x8, 0xff, 0x2, 0xb5, 0x10, 0x11, 0x9, 0x8, 0x9cf, 0x0, 0x1, 0x8, 0xfffffc94, 0x3, 0x1e0d, 0x2a, 0x8, 0x8001, 0x447d, 0x9, 0x5, 0xa1d1, 0x8, 0x6, 0x7ff, 0xfff, 0x6, 0x3f6]}, 0x45c) 3.801414775s ago: executing program 1 (id=1826): sched_setscheduler(0x0, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000180)={[{@acl}, {@noblock_validity}, {@bh}, {@max_batch_time={'max_batch_time', 0x3d, 0x8c9}}, {@inlinecrypt}, {@errors_remount}]}, 0x7, 0x60a, &(0x7f00000027c0)="$eJzs3c9rHGUfAPDvzCZ5kzTvm/ZFxBbFgIcWpGlSi1Uv1nqwh4IFexDx0NAkNXT7gyYFWwum4EFBQcSrSC/+A96ld28iqDfPQhWpKKh0ZXZn2+1mN13T7E6b+Xxgknmemc3zfHfyZJ5nJs9OAKU1lX1JI3ZG3DqRREy2bJuIxsapfL+bv145mS1J1Gqv/ZJEkuc190/y79vyxGhEfHM44v+VteUuX7p8eq5aa3g3Yt/KmfP7li9d3rt0Zu7UwqmFs7P7nztwcOb52QOzmxLntvz7kaOvPv7Re289u/htdW8Sh+L48Dvz0RbHZpmKqbiVh9iaPxQRB7OVDu/Lw2YLhFBqlfz3cTgiHo3JqNRTDZOx9GGhlQP6qlaJqAEllWj/UFLNfkBzbN/bOPh4n3slg3PjpcYAaG38Q41rIzFaHxuN30xaRkaNaxvbN6H8rIy/r+z6LFvirusQf9w+OkObUE43q1cj4rFO8Sf1um2vR5rFn95Vj2Q1YiYiRvL6vXwfdUha1vtxHWY9G40/jYhD+fcs//AGy59qSw86fgDK6XrW/8lO5KtZ6s75L+t7NPs/0aH/M9Hh3LURRZ//uvf/muf70fo18rStH5b1WY51/pHD7Rk/fnDkk27lt/b/siUrv9kXHIQbVyN2tcX/fhZs3v/J4k86HP9slxOHeivjle9+PtJtW9Hx165F7O44/rnTK83W1rk/uW9xqbow0/jasYyvvn7zi27lFx1/dvzHu8TfcvzT9tdl78n5Hsv48ti1M922TXSMf7VldJr+NJI0xpsj+WvenltZuTAbMZIcbWSkLfn7169Lc5/mz8ji3/NU5/bf+vvf/gaMNf9k9uD866dvdtu2kePfcjP5Vq3HOnSTxT9/7+O/pv1neR/3WMbvb1x8otu29eIfu5/AAAAAAAAAoITS+j3YJJ2+vZ6m09ON+bKPxHhaPbe88vTiuYtn5yP21P8fcjht3umebKSTLD2b/z9sM72/Lf1MROyIiE8rY/X09Mlz1fmigwcAAAAAAAAAAAAAAAAAAIAHxLZ8/n/zOdW/VRrz/4GS6OcD5oAHm/YP5VRptv81j3gCysD5H8pL+4fy0v6hvLR/KC/tH8pL+4fy0v6hvLR/AAAAANiSdjx5/YckIlZfGKsvmZF8mxlBsLUNF10BoDCVoisAFOb2rX+dfSidnvr/f+YfDtj/6gAFSDpl1jsHtfUb//WOrwQAAAAAAAAAAAAA+mD3zu7z/80Nhq3NtD8or/uY/++jA+Ah56P/obyM8YF7zeIf7bbB/H8AAAAAAAAAAAAAGJiJ+pKk0/lc4IlI0+npiP9GxPYYThaXqgszEfG/iPi+MvyfLD1bdKUBAAAAAAAAAAAAAAAAAABgi1m+dPn0XLW6cKF15a81OVt7pfkU1PX2GY9779PDyovxL18VyeDflrGIKPyg9G1lqCUniVjNjuoDUbELy9GSM1TwISjwjxIAAAAAAAAAAAAAAAAAAJRUy9zjznZ9PuAaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDg3Xn+f/9Wio4RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg4/RMAAP//RM5Cug==") mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) 3.506297042s ago: executing program 9 (id=1827): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001080)={0x3, 0x0, 0xfec00000}) 3.330841797s ago: executing program 1 (id=1828): syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x200000, &(0x7f0000000380)=ANY=[], 0x2, 0x5519, &(0x7f0000012340)="$eJzs3EtvG1UbB/DHSdP72zdCLNh1pAopkWqrTi+CXYFWXESrqsCCFTi2Y7m1PVHsOCErFiwRC74JAokVSz4DC9bsEAsQOySQ50yggSKB4sQk+f2k8X/m+PiZM1ZV6ZmJHMCJtZj9/GMlLsW5iJiPiIsRxX6l3Aq3UzwXEZcjYu6JrVKO/z5wOiLOR8SlSfFUs1K+9enV8ZWbP7zx01ffnDl14bMvv53dVQOz9nxE9NfT/lY/Zd5J+agcb4y7RfZvjMtMb/Qfp+OFPOVWe7WosNXYndco8nonzc/XN4eTXOs1mpPsdNeK8fVBOuFw3NmtU3zgUWOjOG61V4vsDvMiOztpXds76f+2neEo1WmV9T4oysdotJtpvL3dTtez/rjI5mBUjqe6eau9PclxmeXpopn3WsU6VvfzTf+3vdkdbG5n4/bGsJsPspu1+gu1+q1qfSNvtUftG9VGv3XrRrbU6U2mVUftRv92J887vXatmfeXs6VOs1mt17OlO+3VbmOQ1eu167Vr1ZvL5d7V7NX772S9VrY0yZe7g81RtzfM1vKNLH1iOVupXX9xObtSz9669yB78PDu3XsP3n7vzrv3X7r3+ivlpL8sK1taubayUq1fq67Ul0/Q9X9ULnqK1w/7Upn1AgCOHv0/MAvT6P/7T+3/Nx5GHHz/H/r/qThS/e9J7/8P4PphX/T/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAn1ncLn79W7Cym4wvl+P/KoWfK40pEzEXEr08xH6f31Jwv6yz8zfyFP63h60oUFSbnOFNu5yPidrn98v+D/hYAAADg+Priw8ufpG49vSzOekEcpnTTZu7i+1OqdzYiFha/n1K1ucnLs1MqVvz7PhXbU6pW3MA6O6Vi6ZbbqWlV+0fm98TZJ6KSYu5QlwMAAByKvZ3A4XYhAAAAHKaP/8Vc/eExUondR5m7z4KLv7z/44HguT1HAAAAwBFUmfUCAAAAgANX9P9+/w8AAACOt/T7fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwG/s3E1uGjEcB9D/DEyhXyqquu9VuoNj9AhddllxgF6CA3RBr9ALcAa6yxEiiBhPCEOyCXhmlOg9aeLYsn7YCBa2kQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBL/6v14u+vr7/ryvjynN3+OvlmBAAAAJzbVutF/c8s1d837R+bps9NvYiIMiKeWruP4k0rc9TkVA/9/5z2r87G8C+iTji8xqR53kXEt+a5/dT1uwAAAACv12a5mqfVevozG3pA9Clt2pQfvmfKKyKimt1kSisPeV8yhdWf73H8zJRWb2BNM4WlLbcrfnpzgfrrfty1m54URSrKVvfxWZlv7gAAQI9GraLfVQgAAAB9+jH0ABhGEfdHmcejwEkqmuO9t60aAAAA8AIVQw8AAAAA6Fy9/u/p/r+9+/8AAABgGOn+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALq0rdaLzXI1vzZnt3+G4nFTntkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHfszzsKhEAYhMHe9Z3J3P+w0qCpqUkVCB9/YzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvPndX/5PTI0zydxrY+l5JFk7NbZOjb1z4+gP4+vXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLE/LykQAkEQBXPG/076/oeVBD2DCBHQ8KiiFg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf9Ltf/k9MjTPJ3Glj6XgkWbtqbF019h40jh6Mt38DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLFv/75xU3EAwJ/t85UWEEdANwQhkBhgoddraemGGEARA38CUpReS+iVH20GWlWILGwocxcEIwIkUNj6P3RupCxhy3BDkJhB9tk554fgSJB9JJ+P9Py+tiy/7/NJUb5+NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAafT2JE6yTWccx8Wxxzv3l7J+Y1+febi2OZ+1LI6OMPaPreNkPvNerO5E3eYSAQAA4PRIyvo+hLCVri9kfdzJ6/+0PCer+b99ehyX9fz+ur/sy9o/a7/+sv387kCd8TjZRa8vDwcXDqZysqv+v/HMP57Ryu98/uwlyX+Q+L3V50Zpfj+jrx89eqedh2fqyBYAOIrzZV8E5f9DWd9vMjEATo1WpfAu6/+k02xOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHUYrYYnyzgKIcy3JnFmY+f+0mH9w7XN+bJdefBgLXw5uWZ2iTSEcH15OLhQ62xm2527924uDoeD2/UHL4UQmhr9rWL6Nz+Y4uQQGrk/gv8oiIsfe1by+X8EDf5RAgDgREqLltX1W+n6QnYsmgvhz+/21v+vVuIwZf2//eGVx9WxqvV/v7YZzqLWnr3eyq1Pe3fu3nt9+dbijcGNwcdvXOy/2b909fLlq738WUnPExMAAACOp120av0fzx1c/z9XicOU9f9n3/S/qI6VqP8PNVn0azoTAACA0+3Zl//4PTrkeNRuh88XV1Zu98fb3f2L420Dqf5rZ4pWrf+TuaazAgAAAOowWo32rP9fq8RhyvX/p75/4afqNZMQwtli/f/80ifDa/VNZ6bV8Tlx03MEAACgWWeLVl3/T/P3/+PdVx7iEMJrr4zj8sv1aer/5N2vfqiOVX3//1J9U5xJcXd8P/K+G0Kr23RGAAAAnGRPFC0r9n9L1xc++vnc+23v/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADU7a8AAAD//+jZPfM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x103341, 0x0) setreuid(0xee01, 0xee01) ioctl$F2FS_IOC_RESIZE_FS(r0, 0x4008f510, 0x0) 3.17056049s ago: executing program 7 (id=1829): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000001040)=@arm64={0xf8, 0x2, 0x6, '\x00', 0x8000000000000001}) 3.120493982s ago: executing program 9 (id=1830): r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) syz_emit_ethernet(0x48, &(0x7f0000000480)={@local, @empty, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x3a, 0x0, 0x0, 0x0, 0x84, 0x0, @loopback, @loopback}, "1122334400000000000000000a00004000"/38}}}}, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) 2.926904576s ago: executing program 3 (id=1831): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$dvb_demux(&(0x7f0000000040), 0x57, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="18000000"], 0x18}, 0x2}, 0x0) 2.635692614s ago: executing program 9 (id=1832): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x3, &(0x7f0000002480)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) set_mempolicy_home_node(&(0x7f00005d0000/0x4000)=nil, 0x4000, 0x0, 0x0) 1.812064964s ago: executing program 5 (id=1833): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$dvb_demux(&(0x7f0000000040), 0x57, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="18000000131411"], 0x18}, 0x2}, 0x0) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000f00), 0x2, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x8000) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r5, 0xc058534b, &(0x7f0000000180)={0x101, 0x7, 0xf8a, 0xca29c56, 0x2630, 0x9}) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000, 0x13, r4, 0x4a028000) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r7, 0xc100565c, &(0x7f0000000c00)={0x0, 0x5, 0x1, {0xa, @pix_mp={0x10, 0x81, 0x33565348, 0x8, 0xa, [{0x10, 0x7}, {0x3, 0x8000}, {0xa64a80ed, 0x7fffffff}, {0x202, 0x3fd}, {0x5, 0x1}, {0x4ce, 0x8}, {0x8007ff, 0xd}, {0x6, 0x1}], 0x5, 0xff, 0x6, 0x0, 0x5}}}) 1.735885296s ago: executing program 3 (id=1834): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./proc\x00', &(0x7f00000004c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/net/ipv4/conf/all/accept_local\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 1.307365147s ago: executing program 3 (id=1835): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@private0, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast1, 0x4d4, 0x6c}, @in6=@local, {0x0, 0x9, 0x7, 0xffff, 0x8251c, 0x4, 0xfffffffffffffff8, 0xea9}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075d, 0xfffffffe}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001d80)=ANY=[@ANYBLOB="380100001000010027bd700000010000fe880000000000010000000000000001ac14143d00000000000e000000000000000107144e230405000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000000000000000000000000000000000000000000000000000004000000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000fbffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd7000043500000a0001002000000000000000480003006465666c617465"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 1.036603194s ago: executing program 3 (id=1836): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, 0x0) 670.985043ms ago: executing program 3 (id=1837): syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000840)='./file0\x00', 0x8d0, &(0x7f0000000080)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c00a99176bffea999ec4947785a4b3392b470a878b010acc5fde3f7c39533b111d92aa1e3cd9504b4aec083a038cd1b944d504716e6b8463de9dc9743fbe9e0ef9396a932024b904283205650ea735ae7adac50b5efe5244d737dc9515a51775b2fafbc85c9c1c8f62872a466192aae714a90990e0b07aa2b92e463ad98"], 0x1, 0x275, &(0x7f0000000ac0)="$eJzs3c9qE10YB+C3kzTJ183XtbgYcOOqqHcQJIIYECJZ6MpAddOKkG5GV7kML0G8JBdeRFbdjbQzNG36h6JJj808D4R5mV8O855FZiZwJnn/8NPB/uejj+XPb9HL8mhHzOI4YjeyaEVlq95mp3UnzpsFAHDfjEaTfuoeWKH6Zu37r9bZrum0P9mOiO6lN49/3GVrAAAAAAAAAAAArM6F9f896/8BoAms/99802l/slPfv11k/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQznFZ/l/e8ErdHwCweifX/8z1HwAaxfd/AGie213/s9RtAgAr9Obtu1f9LAajPO9FzGfFuBhX2yp/8XI4eJKf6ixGzYtivF3Xw8HTKs+X8516/LMr8048flTlJ9nz18OlvBv76548AAAAAAAAAAAAAAAAAAAA/CP28jO7i73zohi3qnzvuryqzv0+wNLz++140L6zaQAAAAAAAAAAAAAAAAAAAMC9dvTl68Hk8PDDdAOLTkQkOXqZfu5/V/wXfzCqF2turBux7kNsZtG55mO+1b7hDJD6zAQAAAAAAAAAAAAAAAAAAM2zeOg3dScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkM7i//+vLFqXo1uMWipSzxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoht8BAAD//2ueic4=") mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4008054}}, {{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x400400c0}}], 0x2, 0x0) 609.204465ms ago: executing program 5 (id=1838): r0 = socket(0xa, 0x5, 0x0) listen(r0, 0x100) r1 = dup(r0) sendmsg$inet_sctp(r1, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000400)="cb", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="18"], 0x18}, 0x8050) 589.580805ms ago: executing program 1 (id=1839): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x10000}) 321.795552ms ago: executing program 9 (id=1840): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e27, 0xcb, @dev={0xfe, 0x80, '\x00', 0x2f}, 0xd25}, 0xf) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x8b2c, &(0x7f0000000040)) 270.939413ms ago: executing program 1 (id=1841): syz_mount_image$hfsplus(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x3a00014, &(0x7f0000005800)=ANY=[@ANYBLOB="666f72636500006961e38c8000000000000000303035303030073f411036b030c3e5c51949cec546392c637265613699bb3d25f4ea8321f02c64b3d4c4b956f4c9c24cf91302006f72712402a9c8023a1ceb6cff75724acdc6bf741701005345d303007fb7829750340644608ba87292d3e1821a704e46584fb946cf3b277b74f3d94d7f3f3b27b1b953c928a63d7786e23b2dcf98f4bbb4903a06ab8c627b7bb93295be12b82c458f84c3ae25bcf2d853e98b8725d8aebabb359657997a1939b79f37ab02810bde52e8c3d1e3a07f5116b544b9f372663913ffa789b243bd3ee1780c061fdfed191df07d52d68db92963efbe8511ae0ce4abceb6516b9873787883ad7974dbecb645be4a0f566675ca9e56f4cccc8de78f7ca803d7c0f266c3b5ce9b120dd6e926a5b8cc435331a9a75bb9f9ca0f4d0056a114daeb4c5e3171de79f904f801c5c24d0617f5d83051dbb6fcb25b8d09967293855e13c0d4bb8eec9bf81b53f9ffffffed05b5b60cb8cdf158f18dede7224c4655ed010c60315b9645a78767a5ca8ebf01eba918ae9706f00ae9d597e9000062897e9a389d9143e6eb069e037c29b97568c59065c293a513bcd7fe7880f6675464cbaa3b7d660cffffffffffffffff72b6fa8a579221c6776cc015b26e66f61551069b4b16dfdc1f6e725bc75aa9870bf6c85a78179518c6f1ec9a1fbba7b11cbe385859972f41ba4c2dd6303fdb36d9829c007cba31a150c0f05d0aa83faf5336e00b07000000000000005e5f9912fa11394a7d340100000000d42328e075d22ca6e0f2f1de326c5b968693c44320067b81ae9c93af2f992209565d76aaa1447c343e11387d691903f3410a3c31e4f13fcaf3f0b9572bea2c76c7001b062abd8cb38a986e3d51d5005180762e4ff3e73f255e9b2ca5f6b76b38c6c8e1f1deaa0e5afc201d596f66f4b238c79f77b6e3b7d16341e3cb9aa8d2b2bcd077be1fd0b86548a838363b561c08e139765c52bf0590b08398266c8a414d5669f300075c87e9d3f9efb6bfbd59b12a2e0c0de44b19c10eeb9d96b3ab7387bb09f94bdb6c5898c07d43fb9732af8e7aa1965b1b7dcd1bd3ec59fe27af9efa7af350f337af57ec608a8dc913cef60101d45ccb6ee5af09f857c0681be54bb1cf9f963cec8b9313d04f72a0b19cd504215c9777f5a7a7bd7ef55cc3e1aa338da966235ba67e5cf31e27b13ea06f3e3ea43b9e49e9b014afe174005046ac5db758fc17fdf79f101824bd40c0d599b87b455e7d990e831fceb037157ffea6b9b7b32968cc4b730bf28d5b5be32be17dacb7c6273ec1acef44c9cd812c81416df90a84bdccf41fd6c9cc83a31c6827123f2827699387b1440ab1847be5713549b60926508d00000000000084beb7f245e243146d9a3156386e5b82ade505d8da00a1d3038c3b98e71f78308ef835f00b41806172205fca3fda4782bfaf55e97942f7fd393244ceda1f95627e075941470488066905b96beb0edd6bd2cf0155d162910a03df05909b50311a6058e8409d000000000000000000000000000094f7748e403f8d23f64e2d2ed07b0cf5ac6a24574a0ebcd82498252a7cbd2e5450116c30273a2f5ad5079d0300d11b334f1e00ff0476a8468407392ef81712931ad7628f7d0df98f0fedbe22b752c5a23a111fc00a0411fd85399c2438032944a3de85837537d3a652a24d760d6863a3dd08abe4160ba9c517b3ade3064f955b3166e513145d88b9b4a3f734f5245ccfc703688f0604b109000000000000000b12ccde50d0900dded7328dbde895e79326042cf9a970000075da00320516f2878879a20068af04002bc9598c472bfc35ee7c774860dd65d0d6b9cdb2581c19ee3ab249f5232cf9069de2a919d099e933dafb0b7926277d87bd09d8fe7900000000000000000000000000000000eb0799773ae040c7be9a37b86db244387f5fc8df8205ffd21105368500cd7a87d271269608df20341c4f3c685fffaa65a0883107d045706c0130b3706ae090577006a6ea840753fa61108c9b973eec9f3469bcc27ebe2c1a188ad730cd0d543688689fdf11ff53e3ce60071134ef20aa32870787f7ac762b58c686f859fb76bd967a8b19209c0760d6f17d8d9696c930db8d2f8c08bc0f74129a137b967dc51e9289420a9e647f07d3f3f9c087826b161da96b041585683e36de3e558397db9ef424efe4e6770dee5d63ceb21f4a49f7893e53fd6e572eb76f4caa4d27fd896d9e20b9513126ca438272c506f7e82aa42037f8540e721be8e5a962f95fd4a6ca24c44ec3e3bcd2b3091698fe9bc5bef5be68000f01ecb45d89d52704c49d7833d94f6e5b42b755b8e117b9f7a45468d8dad15e9c25134f63c6eb96531d6ab783deb3327db3b42c90c65b3efe62922f630b17efcf356be378450e7c43f16c7efc6f34198d6c3042a450c1389df042ea0085144322f1fef6d1f822895cb85146bf7163afde735ed6dea772b13c5c75ebf900fc723817295f62bfd52178a7d644aeac1051a0af0678f3ea4837cfa2693607eec06a95536f888efee5134a83b70d00e61a0fec986297eaecd7ebc7b2e7a7f7d16b7c666a1987df125d32859ad0eff488191be2df4d1d06c4d9645d0317128469ca36deb70838ed1207f46d4acefb49341ececb91f8ee98550eb397e842b1e50000000000000000", @ANYRES32, @ANYRESOCT], 0x1, 0x615, &(0x7f0000000a00)="$eJzs3U9oHNcdB/DvrFay5IKjOHZqSqAihrRU1NYflFa91C2l6BBKSA89C1uOhddKkDZFCaUo/XvtIddCevCtp0Lvhvbc3HLVMVDoJSdBDyozOyutpJW6thVplXw+5u17b968P/ubmZ3dFWYDfGUtTaf5JEWWpt/YLOvbjy/1NreSlBsaSbOTpVhLmn9O7qSTMtqzf3HcPB+tLr716efbn3VqzTpV+zcODvEstuqUqSQjdX7UCdPs7h473t1jxxtUsReZMmA3y3zruQaE07F7RPfM/O8g3Y+93oGLo+jcN4+YTC4nGa/fB6R+dWic7epOn/svAAAAXwUv7GQnm7ly3usAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAi6T+/f+iTo1ueSpF9/f/x+ptqcsXTHGg9uTc1gEAAAAAAAAAp+ebO9nJZq5067tF9Tf/V6vKterxa3kvG1nJem5lM8tpp531zCaZ7BlobHO53V6fHaDnXN+ec2fzfAEAAAAAAADgS+o3Wdr/+z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyDIhnpZFW61i1PptFMMp5krNxvK/mkW77Inpz3AgAAAOAMvLCTnWzmSre+W1Sf+V+uPveP572spZ3VtNPKSu5V3wV0PvU3th/Pt7Yfzz8q09Fxf/Sfp1pGNWI63z30n/lGkmYmcj+r1ZZbuZt30sq9NKqepRvd9fRf14flmoofdhQDruxenZf7/6nOh8NkFbPRvYjM1Gsro/HiyZF4yqNzeKbZNPa++bk2SMxH0gn6gPNdrvPy+fxhqGM+V599n5TXzMmRSL7197/+4kFr7eGD+xvTw/OUnlEdia1mHYn5nuvw608ViQ/PfvGnaqaKxPW9+lJ+mp9nOlN5M+tZzS+znHZWMpWfVKXl+nwuHydPjtSdA7U3/99Kxurj0nkVfbo1vVr1vZLV/Czv5F5W8nr1by6z+V4WspDFniN8fYCrvlG/0g541d/8dl2YSPLHOh8OZVxf7Ilr72vuZNXWu6WRq3W/q8dHqTh8PzopSpf2i81v1IXySPy2zofD4UjM9pwvL518vvxlt3zcaK09XH+w/O6A871W52Uofz9Ud4nyfLlavV/JkbOjbHupb9ts1XZtr61xpO36XlvfK3W9O/9itffLfUeay9iBSPW2zVf9bvT06/d+C4Chd/k7l8cm/j3xr4mPJ3438WDijfEfX/r+pVfGMvrP0R80Z0Zea7xS/C0f59f7n/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBnt/H+Bw+XW62V9XMuFPUP+QzLehS++ELGD23JkCxMoTw6wJfc7fajd29vvP/Bd1cfLb+98vbK2ujCwuLM4sLr87fvr7ZWZjqP571K4Iuwf9M/75UAAAAAAAAAAAAAgzqL/05w3NyTZ/tUAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAtqaTrNJykyO3NrpqxvP55vlalb3t+zmaSRpPhVUvwjuZNOymTPcMVx83y0uvjWp59vf7Y/VrO7f+Okfn2NHt6wVadMJRmp8+dwYLy7zz1esfcMy4Dd7AYOztv/AgAA//9rZAoZ") mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./config\x00', &(0x7f0000001080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001180)='./config/usb_gadget/g1/strings/file0\x00', 0x1ff) 95.519707ms ago: executing program 3 (id=1842): r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x400, 0x0, 0x3c9}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000300)=@IORING_OP_FADVISE={0x18, 0x50, 0x0, @fd_index, 0x3, 0x0, 0x9, 0x4, 0x1, {0x0, r4}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 34.543439ms ago: executing program 9 (id=1843): mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000060)='./sys\x00', &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000100)='usbip-vudc\x00', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='pcspkr\x00', 0x6) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='0x1d6b\x00', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='0x0102\x00', 0x6) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000002100)='usbip-vudc.0\x00', 0xc) close(r4) 0s ago: executing program 1 (id=1844): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$dvb_demux(&(0x7f0000000040), 0x57, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="18000000"], 0x18}, 0x2}, 0x0) kernel console output (not intermixed with test programs): sing ep0 maxpacket: 16 [ 621.851882][ T4360] usb 8-1: config 0 has an invalid interface number: 8 but max is 0 [ 621.909405][ T4360] usb 8-1: config 0 has no interface number 0 [ 621.929195][ T4360] usb 8-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 621.995214][ T4360] usb 8-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 622.065081][ T4360] usb 8-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 622.113673][ T4360] usb 8-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 622.137387][ T4360] usb 8-1: Product: syz [ 622.141796][ T4360] usb 8-1: SerialNumber: syz [ 622.170522][ T4360] usb 8-1: config 0 descriptor?? [ 622.175006][ T4621] usb 6-1: USB disconnect, device number 8 [ 622.198351][ T4360] cm109 8-1:0.8: invalid payload size 0, expected 4 [ 622.241934][ T4360] input: CM109 USB driver as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.8/input/input14 [ 622.290573][ T8889] loop8: detected capacity change from 0 to 1024 [ 622.462813][ T8889] EXT4-fs (loop8): warning: mounting unchecked fs, running e2fsck is recommended [ 622.476727][ C0] cm109 8-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 622.527563][ T8889] EXT4-fs (loop8): Errors on filesystem, clearing orphan list. [ 622.535304][ T8889] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 622.798627][ T4369] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 622.847401][ T4369] ath9k_htc: Failed to initialize the device [ 623.084941][ T4621] usb 6-1: ath9k_htc: USB layer deinitialized [ 623.225449][ T4320] usb 8-1: USB disconnect, device number 7 [ 623.280929][ T4320] cm109 8-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 623.484668][ T7422] EXT4-fs (loop8): unmounting filesystem. [ 624.479222][ T8914] netlink: 'syz.8.868': attribute type 4 has an invalid length. [ 624.553913][ T8914] device veth1_macvtap left promiscuous mode [ 624.603685][ T8919] tmpfs: Bad value for 'mpol' [ 625.419094][ T8946] netlink: 24 bytes leftover after parsing attributes in process `syz.8.880'. [ 627.684377][ T8925] loop7: detected capacity change from 0 to 32768 [ 627.777445][ T8925] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by syz.7.875 (8925) [ 627.793116][ T8961] loop8: detected capacity change from 0 to 8192 [ 627.845910][ T8961] FAT-fs (loop8): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 628.017113][ T8925] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 628.080472][ T8925] BTRFS info (device loop7): using sha256 (sha256-avx2) checksum algorithm [ 628.137855][ T8925] BTRFS info (device loop7): using free space tree [ 628.603545][ T8925] BTRFS error (device loop7): open_ctree failed: -12 [ 628.611195][ T7686] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 scanned by udevd (7686) [ 628.814491][ T9000] netlink: 8 bytes leftover after parsing attributes in process `syz.8.891'. [ 629.166841][ T9008] netlink: 24 bytes leftover after parsing attributes in process `syz.5.892'. [ 630.923780][ T9017] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 630.970490][ T9017] udc usbip-vudc.0: failed to start g1: -19 [ 631.658853][ T9017] UDC core: g1: couldn't find an available UDC or it's busy [ 631.781441][ T9026] xt_l2tp: invalid flags combination: 4 [ 632.149120][ T9041] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 632.191479][ T9041] udc usbip-vudc.0: failed to start g1: -19 [ 632.226515][ T9041] UDC core: g1: couldn't find an available UDC or it's busy [ 632.517715][ T9052] netlink: 24 bytes leftover after parsing attributes in process `syz.8.907'. [ 633.322356][ T4369] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 633.405877][ T9059] netlink: 8 bytes leftover after parsing attributes in process `syz.7.911'. [ 633.576795][ T4369] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 633.674713][ T4369] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 633.856137][ T4369] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 634.670966][ T4369] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 634.685463][ T4369] usb 3-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 634.702773][ T4369] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.713214][ T4369] usb 3-1: Product: syz [ 634.717470][ T4369] usb 3-1: Manufacturer: syz [ 634.723214][ T4369] usb 3-1: SerialNumber: syz [ 634.729767][ T4369] usb 3-1: config 0 descriptor?? [ 634.742720][ T4369] ums-isd200 3-1:0.0: USB Mass Storage device detected [ 634.836564][ T9072] loop7: detected capacity change from 0 to 164 [ 634.952614][ T9071] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 634.984920][ T4369] scsi host1: usb-storage 3-1:0.0 [ 635.008458][ T9071] udc usbip-vudc.0: failed to start g1: -19 [ 635.020664][ T4369] usb 3-1: USB disconnect, device number 10 [ 635.037464][ T9071] UDC core: g1: couldn't find an available UDC or it's busy [ 635.505155][ T9088] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 635.535967][ T9088] udc usbip-vudc.0: failed to start g1: -19 [ 635.568972][ T9088] UDC core: g1: couldn't find an available UDC or it's busy [ 636.256371][ T9098] netlink: 12 bytes leftover after parsing attributes in process `syz.5.920'. [ 637.343560][ T9118] vivid-007: ================= START STATUS ================= [ 637.677759][ T9118] vivid-007: Enable Output Cropping: true grabbed [ 637.903362][ T9118] vivid-007: Enable Output Composing: true grabbed [ 638.076233][ T9118] vivid-007: Enable Output Scaler: true grabbed [ 638.179017][ T9118] vivid-007: Tx RGB Quantization Range: Automatic grabbed [ 638.186355][ T9118] vivid-007: Transmit Mode: HDMI grabbed [ 638.192381][ T9118] vivid-007: Display Present: true inactive [ 638.198982][ T9118] vivid-007: Hotplug Present: 0x00000001 [ 638.205074][ T9118] vivid-007: RxSense Present: 0x00000001 [ 638.210852][ T9118] vivid-007: EDID Present: 0x00000001 [ 638.216303][ T9118] vivid-007: ================== END STATUS ================== [ 638.899444][ T9127] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 639.143735][ T9127] udc usbip-vudc.0: failed to start g1: -19 [ 639.275807][ T9127] UDC core: g1: couldn't find an available UDC or it's busy [ 639.481957][ T9138] loop7: detected capacity change from 0 to 512 [ 639.569503][ T9133] netlink: 72 bytes leftover after parsing attributes in process `syz.1.931'. [ 639.587676][ T9138] EXT4-fs (loop7): mounting ext2 file system using the ext4 subsystem [ 639.702027][ T9138] EXT4-fs error (device loop7): ext4_orphan_get:1431: comm syz.7.932: bad orphan inode 15 [ 639.839943][ T9138] ext4_test_bit(bit=14, block=18) = 1 [ 639.845511][ T9138] is_bad_inode(inode)=0 [ 640.063033][ T4289] Bluetooth: hci1: command 0x0406 tx timeout [ 640.087025][ T9153] netlink: 12 bytes leftover after parsing attributes in process `syz.8.935'. [ 640.452827][ T9138] NEXT_ORPHAN(inode)=1023 [ 640.493729][ T9138] max_ino=32 [ 640.511930][ T9138] i_nlink=0 [ 640.568859][ T9138] EXT4-fs error (device loop7): ext4_do_update_inode:5279: inode #15: comm syz.7.932: corrupted inode contents [ 640.770358][ T9138] EXT4-fs error (device loop7): ext4_dirty_inode:6156: inode #15: comm syz.7.932: mark_inode_dirty error [ 640.851488][ T9138] EXT4-fs error (device loop7): ext4_do_update_inode:5279: inode #15: comm syz.7.932: corrupted inode contents [ 640.894902][ T9138] EXT4-fs error (device loop7): ext4_xattr_delete_inode:2947: inode #15: comm syz.7.932: mark_inode_dirty error [ 641.017873][ T9138] EXT4-fs error (device loop7): ext4_xattr_delete_inode:2950: inode #15: comm syz.7.932: mark inode dirty (error -117) [ 641.230210][ T9138] EXT4-fs warning (device loop7): ext4_evict_inode:301: xattr delete (err -117) [ 641.359957][ T9138] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 641.502014][ T9138] ext2 filesystem being mounted at /63/éq‰Y’3aK supports timestamps until 2038-01-19 (0x7fffffff) [ 642.075761][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 643.698120][ T9192] loop8: detected capacity change from 0 to 512 [ 643.879472][ T9192] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 643.982723][ T9192] EXT4-fs error (device loop8): mb_free_blocks:1839: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 644.002670][ T9192] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #11: comm syz.8.947: corrupted inode contents [ 644.066275][ T9192] EXT4-fs error (device loop8): ext4_dirty_inode:6156: inode #11: comm syz.8.947: mark_inode_dirty error [ 644.102690][ T9192] EXT4-fs error (device loop8): ext4_free_branches:1030: inode #11: comm syz.8.947: invalid indirect mapped block 1 (level 1) [ 644.138758][ T9192] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #11: comm syz.8.947: corrupted inode contents [ 644.192193][ T9192] EXT4-fs error (device loop8) in ext4_orphan_del:303: Corrupt filesystem [ 644.320434][ T9192] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #11: comm syz.8.947: corrupted inode contents [ 644.382952][ T9192] EXT4-fs error (device loop8): ext4_truncate:4325: inode #11: comm syz.8.947: mark_inode_dirty error [ 644.438429][ T9192] EXT4-fs error (device loop8) in ext4_process_orphan:345: Corrupt filesystem [ 644.900209][ T9214] netlink: 12 bytes leftover after parsing attributes in process `syz.7.950'. [ 644.957843][ T9192] EXT4-fs (loop8): 1 truncate cleaned up [ 645.041360][ T9192] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 645.315438][ T9192] EXT4-fs error (device loop8): ext4_find_dest_de:2115: inode #2: block 13: comm syz.8.947: bad entry in directory: directory entry too close to block end - offset=76, inode=16, rec_len=940, size=1024 fake=0 [ 645.563293][ T7422] EXT4-fs (loop8): unmounting filesystem. [ 647.782036][ T9240] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 647.956312][ T9240] udc usbip-vudc.0: failed to start g1: -19 [ 648.049890][ T9240] UDC core: g1: couldn't find an available UDC or it's busy [ 648.888194][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 648.905088][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 651.894723][ T9288] device syz_tun entered promiscuous mode [ 652.645982][ T8997] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 652.957009][ T8997] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 653.081289][ T8997] usb 9-1: config 0 has no interfaces? [ 653.208319][ T8997] usb 9-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 653.301267][ T8997] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.365001][ T8997] usb 9-1: config 0 descriptor?? [ 653.955626][ T4320] usb 9-1: USB disconnect, device number 3 [ 654.583919][ T9327] netlink: 40 bytes leftover after parsing attributes in process `syz.5.990'. [ 655.531860][ T9338] scsi_nl_rcv_msg: discarding partial skb [ 655.871454][ T9348] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 655.910303][ T9348] udc usbip-vudc.0: failed to start g1: -19 [ 655.932325][ T9348] UDC core: g1: couldn't find an available UDC or it's busy [ 657.990868][ T9371] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 658.051751][ T9371] udc usbip-vudc.0: failed to start g1: -19 [ 658.059417][ T9371] UDC core: g1: couldn't find an available UDC or it's busy [ 658.259688][ T14] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 658.750699][ T4323] usb 2-1: new low-speed USB device number 7 using dummy_hcd [ 658.991153][ T4323] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 659.100876][ T4323] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 659.236447][ T4323] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 659.271963][ T4323] usb 2-1: config 0 interface 0 has no altsetting 0 [ 659.289397][ T4323] usb 2-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00 [ 659.313965][ T4323] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.342804][ T14] usb 6-1: unable to get BOS descriptor or descriptor too short [ 659.347509][ T4323] usb 2-1: config 0 descriptor?? [ 659.358574][ T14] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 659.385786][ T9386] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 659.393712][ T14] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 659.426988][ T14] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 659.443947][ T14] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.462994][ T14] usb 6-1: Product: syz [ 659.519436][ T14] usb 6-1: Manufacturer: syz [ 659.524156][ T14] usb 6-1: SerialNumber: syz [ 659.552875][ T14] usb 6-1: selecting invalid altsetting 1 [ 659.559658][ T14] usb 6-1: unit 6 not found! [ 659.577142][ T9398] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 659.625833][ T9398] udc usbip-vudc.0: failed to start g1: -19 [ 659.670298][ T9398] UDC core: g1: couldn't find an available UDC or it's busy [ 659.730357][ T9403] loop7: detected capacity change from 0 to 512 [ 659.776159][ T14] usb 6-1: 2:0: cannot get min/max values for control 1 (id 2) [ 659.821131][ T9403] EXT4-fs (loop7): Test dummy encryption mode enabled [ 659.893071][ T4323] logitech 0003:046D:C298.0002: unknown main item tag 0x2 [ 659.902988][ T9403] EXT4-fs error (device loop7): ext4_xattr_inode_iget:401: comm syz.7.1012: inode #1: comm syz.7.1012: iget: illegal inode # [ 659.903384][ T4323] logitech 0003:046D:C298.0002: unknown global tag 0xe [ 659.924949][ T4323] logitech 0003:046D:C298.0002: item 0 0 1 14 parsing failed [ 659.930926][ T14] snd-usb-audio: probe of 6-1:1.0 failed with error -22 [ 659.935137][ T4323] logitech 0003:046D:C298.0002: parse failed [ 659.947596][ T4323] logitech: probe of 0003:046D:C298.0002 failed with error -22 [ 660.040507][ T4323] usb 6-1: USB disconnect, device number 9 [ 660.101592][ T9403] EXT4-fs error (device loop7): ext4_xattr_inode_iget:406: comm syz.7.1012: error while reading EA inode 1 err=-117 [ 660.196661][ T9403] EXT4-fs (loop7): 1 orphan inode deleted [ 660.203076][ T9403] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 660.217695][ T130] usb 2-1: USB disconnect, device number 7 [ 660.266925][ T9417] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 660.317963][ T7686] udevd[7686]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 660.392237][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 661.931173][ T9438] netlink: 'syz.7.1022': attribute type 21 has an invalid length. [ 662.906142][ T9444] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 662.947004][ T9444] udc usbip-vudc.0: failed to start g1: -19 [ 662.974979][ T9444] UDC core: g1: couldn't find an available UDC or it's busy [ 663.526789][ T26] audit: type=1800 audit(1786340418.110:140): pid=9466 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.1031" name="b_vendor_code" dev="configfs" ino=53504 res=0 errno=0 [ 663.721398][ T14] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 663.940741][ T14] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 663.948957][ T14] usb 2-1: config 0 has no interface number 0 [ 663.975454][ T14] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 664.011063][ T14] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 664.035277][ T14] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.101193][ T14] usb 2-1: Product: syz [ 664.105941][ T14] usb 2-1: Manufacturer: syz [ 664.110595][ T14] usb 2-1: SerialNumber: syz [ 664.193368][ T14] usb 2-1: config 0 descriptor?? [ 664.419460][ T14] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 665.144745][ T130] usb 2-1: USB disconnect, device number 8 [ 665.287947][ T130] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 665.453565][ T9492] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 665.475515][ T9492] udc usbip-vudc.0: failed to start g1: -19 [ 665.488021][ T9492] UDC core: g1: couldn't find an available UDC or it's busy [ 667.146546][ T130] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 668.172871][ T130] usb 8-1: too many endpoints for config 0 interface 0 altsetting 6: 223, using maximum allowed: 30 [ 668.843633][ T130] usb 8-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 223 [ 668.857222][ T130] usb 8-1: config 0 interface 0 has no altsetting 0 [ 668.864257][ T130] usb 8-1: New USB device found, idVendor=056a, idProduct=0057, bcdDevice= 0.00 [ 668.873684][ T130] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.884265][ T130] usb 8-1: config 0 descriptor?? [ 669.128463][ T9527] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 669.180335][ T9527] udc usbip-vudc.0: failed to start g1: -19 [ 669.214442][ T9527] UDC core: g1: couldn't find an available UDC or it's busy [ 670.128430][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.135422][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.142453][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.149438][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.156376][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.163373][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.170354][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.177300][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.202966][ T4321] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 670.215403][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.222363][ T130] wacom 0003:056A:0057.0003: unknown main item tag 0x0 [ 670.424452][ T130] wacom 0003:056A:0057.0003: hidraw0: USB HID v0.81 Device [HID 056a:0057] on usb-dummy_hcd.7-1/input0 [ 670.452877][ T130] usb 8-1: USB disconnect, device number 8 [ 671.285624][ T4321] usb 2-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 671.380302][ T4321] usb 2-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 671.547830][ T9545] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 671.554977][ T4321] usb 2-1: Product: syz [ 671.563950][ T9545] udc usbip-vudc.0: failed to start g1: -19 [ 671.572887][ T9545] UDC core: g1: couldn't find an available UDC or it's busy [ 671.622543][ T4321] usb 2-1: Manufacturer: syz [ 671.638354][ T4321] usb 2-1: SerialNumber: syz [ 672.610378][ T4321] usb 2-1: config 0 descriptor?? [ 672.721421][ T9543] fido_id[9543]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 672.806706][ T4321] usb 2-1: can't set config #0, error -71 [ 672.815430][ T4321] usb 2-1: USB disconnect, device number 9 [ 673.130511][ T9566] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 673.160620][ T9566] udc usbip-vudc.0: failed to start g1: -19 [ 673.186614][ T9566] UDC core: g1: couldn't find an available UDC or it's busy [ 674.565189][ T9559] loop8: detected capacity change from 0 to 32768 [ 674.630607][ T9559] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop8 scanned by syz.8.1060 (9559) [ 674.739871][ T9559] BTRFS info (device loop8): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 674.765948][ T9590] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 674.788368][ T9590] udc usbip-vudc.0: failed to start g1: -19 [ 674.797205][ T9559] BTRFS info (device loop8): using blake2b (blake2b-256-generic) checksum algorithm [ 674.827368][ T9590] UDC core: g1: couldn't find an available UDC or it's busy [ 674.847796][ T9559] BTRFS info (device loop8): using free space tree [ 674.971599][ T4321] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 675.155996][ T9559] BTRFS info (device loop8): enabling ssd optimizations [ 675.166951][ T4321] usb 6-1: Using ep0 maxpacket: 32 [ 675.174024][ T4321] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 675.261491][ T4321] usb 6-1: config 0 has no interface number 0 [ 675.296899][ T4321] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 675.337928][ T4321] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.368141][ T4321] usb 6-1: Product: syz [ 675.390035][ T4321] usb 6-1: Manufacturer: syz [ 675.400992][ T4321] usb 6-1: SerialNumber: syz [ 675.433829][ T4321] usb 6-1: config 0 descriptor?? [ 675.462222][ T4321] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 675.957312][ T7422] BTRFS info (device loop8): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 676.012338][ T9632] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 676.035807][ T9632] udc usbip-vudc.0: failed to start g1: -19 [ 676.120947][ T9632] UDC core: g1: couldn't find an available UDC or it's busy [ 676.412258][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 676.420530][ T4321] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 676.432969][ T4321] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 676.447708][ T4321] usb 6-1: USB disconnect, device number 10 [ 676.513102][ T4321] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 676.578678][ T4321] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 676.655550][ T4321] quatech2 6-1:0.51: device disconnected [ 678.059031][ T9673] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1085'. [ 678.955275][ T9683] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 678.998256][ T9683] udc usbip-vudc.0: failed to start g1: -19 [ 679.039069][ T9683] UDC core: g1: couldn't find an available UDC or it's busy [ 679.245719][ T9657] loop7: detected capacity change from 0 to 32768 [ 679.541137][ T9661] loop8: detected capacity change from 0 to 40427 [ 679.614455][ T9661] F2FS-fs (loop8): Invalid log_blocksize (268), supports only 12 [ 679.688102][ T9661] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 679.940796][ T9661] F2FS-fs (loop8): Found nat_bits in checkpoint [ 680.291762][ T9661] F2FS-fs (loop8): Try to recover 1th superblock, ret: 0 [ 680.324582][ T9661] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e5 [ 680.683028][ T4319] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 680.912350][ T4319] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 680.940856][ T4319] usb 8-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 680.989150][ T4319] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 681.022050][ T4319] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 681.077753][ T4319] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 681.124098][ T4319] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 681.155431][ T4319] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 681.177480][ T4319] usb 8-1: Product: syz [ 681.196599][ T4319] usb 8-1: Manufacturer: syz [ 681.229174][ T4319] cdc_wdm 8-1:1.0: skipping garbage [ 681.246525][ T4319] cdc_wdm 8-1:1.0: skipping garbage [ 681.329120][ T4319] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 681.355004][ T4319] cdc_wdm 8-1:1.0: Unknown control protocol [ 681.717001][ C1] cdc_wdm 8-1:1.0: unknown notification 229 received: index 52084 len 0 [ 681.731722][ T4321] usb 8-1: USB disconnect, device number 9 [ 681.885655][ T9731] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 681.922189][ T9731] udc usbip-vudc.0: failed to start g1: -19 [ 681.946163][ T9731] UDC core: g1: couldn't find an available UDC or it's busy [ 682.682654][ T9747] loop8: detected capacity change from 0 to 64 [ 682.909983][ T9752] loop7: detected capacity change from 0 to 1024 [ 683.132613][ T9752] EXT4-fs error (device loop7): ext4_map_blocks:747: inode #3: block 1: comm syz.7.1108: lblock 1 mapped to illegal pblock 1 (length 1) [ 683.250566][ T9760] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 683.336859][ T9760] udc usbip-vudc.0: failed to start g1: -19 [ 683.359124][ T9760] UDC core: g1: couldn't find an available UDC or it's busy [ 683.382845][ T9752] Quota error (device loop7): write_blk: dquota write failed [ 683.390348][ T9752] Quota error (device loop7): qtree_write_dquot: Error -117 occurred while creating quota [ 683.464690][ T9763] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1109'. [ 683.980216][ T9752] EXT4-fs error (device loop7): ext4_acquire_dquot:6841: comm syz.7.1108: Failed to acquire dquot type 0 [ 684.077528][ T9752] EXT4-fs error (device loop7): ext4_free_blocks:6220: comm syz.7.1108: Freeing blocks not in datazone - block = 0, count = 4096 [ 684.134588][ T9752] EXT4-fs error (device loop7): ext4_read_inode_bitmap:140: comm syz.7.1108: Invalid inode bitmap blk 0 in block_group 0 [ 684.140926][ T4442] EXT4-fs error (device loop7): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:17: lblock 1 mapped to illegal pblock 1 (length 1) [ 684.144289][ T4442] Quota error (device loop7): remove_tree: Can't read quota data block 1 [ 684.144534][ T4442] EXT4-fs error (device loop7): ext4_release_dquot:6877: comm kworker/u4:17: Failed to release dquot type 0 [ 684.227481][ T9752] EXT4-fs error (device loop7) in ext4_free_inode:362: Corrupt filesystem [ 684.228697][ T9752] EXT4-fs (loop7): 1 orphan inode deleted [ 684.228734][ T9752] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 684.594219][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 685.106257][ T9781] loop8: detected capacity change from 0 to 128 [ 685.159853][ T9781] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 685.573497][ T7422] EXT4-fs (loop8): unmounting filesystem. [ 686.572225][ T9818] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1123'. [ 687.397135][ T9821] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1125'. [ 687.439508][ T9821] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 688.521065][ T9805] loop8: detected capacity change from 0 to 40427 [ 688.601590][ T9805] F2FS-fs (loop8): invalid crc value [ 688.696970][ T9805] F2FS-fs (loop8): Found nat_bits in checkpoint [ 688.892351][ T9805] F2FS-fs (loop8): Cannot turn on quotas: -2 on 0 [ 688.973385][ T9805] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e4 [ 689.248009][ T8996] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 689.468314][ T9850] loop8: detected capacity change from 0 to 512 [ 689.484998][ T8996] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 689.518316][ T8996] usb 3-1: config 0 interface 0 has no altsetting 0 [ 689.525021][ T8996] usb 3-1: New USB device found, idVendor=056a, idProduct=0333, bcdDevice= 0.00 [ 689.584263][ T8996] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.609941][ T9850] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 689.654726][ T8996] usb 3-1: config 0 descriptor?? [ 689.689311][ T9850] ext4 filesystem being mounted at /113/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 689.763984][ T9831] loop7: detected capacity change from 0 to 32768 [ 690.087132][ T7422] EXT4-fs (loop8): unmounting filesystem. [ 690.156634][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.174955][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.196680][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.204100][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.222194][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.244748][ T9831] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode. [ 690.251683][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.307239][ T8996] wacom 0003:056A:0333.0004: unknown main item tag 0x0 [ 690.353710][ T8996] wacom 0003:056A:0333.0004: hidraw0: USB HID v0.00 Device [HID 056a:0333] on usb-dummy_hcd.2-1/input0 [ 690.402553][ T8996] usb 3-1: USB disconnect, device number 11 [ 690.799311][ T9865] fido_id[9865]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 690.927351][ T7332] ocfs2: Unmounting device (7,7) on (node local) [ 691.120414][ T9874] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1136'. [ 692.320266][ T9885] loop7: detected capacity change from 0 to 2048 [ 692.428389][ T9885] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 692.875640][ T9895] loop7: detected capacity change from 0 to 128 [ 693.189091][ T9903] loop7: detected capacity change from 0 to 1024 [ 693.337821][ T9903] EXT4-fs error (device loop7): ext4_map_blocks:637: inode #3: block 2: comm syz.7.1147: lblock 2 mapped to illegal pblock 2 (length 1) [ 693.438317][ T9903] Quota error (device loop7): qtree_write_dquot: dquota write failed [ 693.452361][ T9903] EXT4-fs error (device loop7): ext4_map_blocks:637: inode #3: block 48: comm syz.7.1147: lblock 0 mapped to illegal pblock 48 (length 1) [ 693.485482][ T9903] Quota error (device loop7): v2_write_file_info: Can't write info structure [ 693.529871][ T9903] EXT4-fs error (device loop7): ext4_acquire_dquot:6841: comm syz.7.1147: Failed to acquire dquot type 0 [ 693.585715][ T9903] EXT4-fs error (device loop7) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 693.634043][ T9903] EXT4-fs error (device loop7): ext4_evict_inode:281: inode #11: comm syz.7.1147: mark_inode_dirty error [ 693.853244][ T9903] EXT4-fs warning (device loop7): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 694.032094][ T9903] EXT4-fs (loop7): 1 orphan inode deleted [ 694.063826][ T5048] EXT4-fs error (device loop7): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:42: lblock 1 mapped to illegal pblock 1 (length 1) [ 694.160750][ T9903] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 694.254813][ T5048] Quota error (device loop7): remove_tree: Can't read quota data block 1 [ 694.462794][ T5048] EXT4-fs error (device loop7): ext4_release_dquot:6877: comm kworker/u4:42: Failed to release dquot type 0 [ 694.528869][ T9913] loop8: detected capacity change from 0 to 4096 [ 694.576708][ T9923] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 694.589706][ T9923] udc usbip-vudc.0: failed to start g1: -19 [ 694.598384][ T9923] UDC core: g1: couldn't find an available UDC or it's busy [ 694.754497][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 694.772118][ T4463] EXT4-fs error (device loop7): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:22: lblock 1 mapped to illegal pblock 1 (length 1) [ 694.809075][ T4463] Quota error (device loop7): remove_tree: Can't read quota data block 1 [ 694.825529][ T9925] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 694.869866][ T4463] EXT4-fs error (device loop7): ext4_release_dquot:6877: comm kworker/u4:22: Failed to release dquot type 0 [ 694.955632][ T7332] EXT4-fs error (device loop7): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 695.028175][ T7332] EXT4-fs error (device loop7) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 695.086292][ T7332] EXT4-fs error (device loop7): ext4_quota_off:7147: inode #3: comm syz-executor: mark_inode_dirty error [ 696.422428][ T9956] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 696.438460][ T9956] udc usbip-vudc.0: failed to start g1: -19 [ 696.615052][ T9956] UDC core: g1: couldn't find an available UDC or it's busy [ 697.378358][ T9964] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 697.585663][ T9964] udc usbip-vudc.0: failed to start g1: -19 [ 697.592399][ T9964] UDC core: g1: couldn't find an available UDC or it's busy [ 697.888816][ T9974] loop7: detected capacity change from 0 to 512 [ 697.932821][ T9974] EXT4-fs: Ignoring removed bh option [ 697.985421][ T9974] EXT4-fs (loop7): mounting ext3 file system using the ext4 subsystem [ 698.777325][ T9974] EXT4-fs (loop7): 1 truncate cleaned up [ 698.822927][ T9974] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 699.038674][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 701.537998][T10011] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 701.557121][T10011] udc usbip-vudc.0: failed to start g1: -19 [ 701.588502][T10011] UDC core: g1: couldn't find an available UDC or it's busy [ 702.109339][ T4321] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 702.385794][ T4321] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 702.605461][ T4321] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 702.927176][ T4321] usb 2-1: config 0 has no interface number 0 [ 703.044824][ T4321] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 703.065830][ T4321] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 703.274723][ T4321] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 703.285383][ T4321] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 703.293545][ T4321] usb 2-1: Product: syz [ 703.297856][ T4321] usb 2-1: Manufacturer: syz [ 703.302819][ T4321] usb 2-1: SerialNumber: syz [ 703.317649][ T4321] usb 2-1: config 0 descriptor?? [ 704.470107][T10047] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1188'. [ 704.797108][ T4321] usb 2-1: USB disconnect, device number 10 [ 704.962776][T10025] loop8: detected capacity change from 0 to 40427 [ 705.005866][T10025] F2FS-fs (loop8): invalid crc value [ 705.063899][T10025] F2FS-fs (loop8): Found nat_bits in checkpoint [ 705.195632][T10025] F2FS-fs (loop8): Cannot turn on quotas: -2 on 0 [ 705.249045][T10025] F2FS-fs (loop8): Mounted with checkpoint version = 48b305e4 [ 705.794632][T10073] loop8: detected capacity change from 0 to 4096 [ 707.297599][T10073] EXT4-fs (loop8): Test dummy encryption mode enabled [ 707.378300][T10073] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 707.593558][ T7422] EXT4-fs (loop8): unmounting filesystem. [ 707.886160][T10102] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1199'. [ 709.188088][T10125] netlink: 'syz.8.1208': attribute type 3 has an invalid length. [ 710.540557][T10140] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1210'. [ 711.491294][T10163] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 711.769039][T10163] udc usbip-vudc.0: failed to start g1: -19 [ 711.853695][T10163] UDC core: g1: couldn't find an available UDC or it's busy [ 713.609107][T10186] device ip6gretap0 entered promiscuous mode [ 714.124929][T10201] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1228'. [ 715.519333][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 715.525752][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 717.671426][T10234] loop7: detected capacity change from 0 to 2048 [ 717.768128][T10234] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 718.472304][T10248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1241'. [ 720.543056][T10267] device bridge_slave_1 entered promiscuous mode [ 721.188455][T10270] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1251'. [ 721.912135][T10281] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1254'. [ 724.144887][T10302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1262'. [ 724.654935][T10311] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1264'. [ 725.332237][T10316] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1265'. [ 725.785727][T10322] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1269'. [ 726.782825][ T4289] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 726.804411][ T4289] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 726.815398][ T4289] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 726.825473][ T4289] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 726.835285][ T4289] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 726.842741][ T4289] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 726.941300][T10336] loop7: detected capacity change from 0 to 512 [ 726.976034][ T4331] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.105605][T10336] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 727.191670][T10336] ext4 filesystem being mounted at /140/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 727.330811][T10345] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1273'. [ 727.378912][ T4331] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.517831][T10331] wlan0 speed is unknown, defaulting to 1000 [ 727.608522][T10358] rdma_op ffff888053e2f1f0 conn xmit_rdma 0000000000000000 [ 727.659589][ T4331] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.679714][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 728.272588][ T4331] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.606921][T10365] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1279'. [ 729.084709][ T4282] Bluetooth: hci3: command 0x0409 tx timeout [ 729.795415][T10372] loop8: detected capacity change from 0 to 4096 [ 730.030210][T10380] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 730.051747][T10381] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 730.066512][T10372] NILFS error (device loop8): nilfs_bmap_lookup_at_level: broken bmap (inode number=6) [ 730.102080][T10380] udc usbip-vudc.0: failed to start g1: -19 [ 730.137130][T10380] UDC core: g1: couldn't find an available UDC or it's busy [ 730.155863][T10372] NILFS (loop8): mounting fs with errors [ 730.169647][ T4331] netdevsim netdevsim10 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.267683][T10331] chnl_net:caif_netlink_parms(): no params data found [ 730.588763][T10389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1285'. [ 730.858772][T10331] bridge0: port 1(bridge_slave_0) entered blocking state [ 730.872894][T10331] bridge0: port 1(bridge_slave_0) entered disabled state [ 730.880964][T10403] Driver unsupported XDP return value 0 on prog (id 39) dev N/A, expect packet loss! [ 730.914474][T10331] device bridge_slave_0 entered promiscuous mode [ 730.928074][T10406] netlink: 240 bytes leftover after parsing attributes in process `syz.5.1290'. [ 730.948069][T10331] bridge0: port 2(bridge_slave_1) entered blocking state [ 730.959743][T10331] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.004499][T10331] device bridge_slave_1 entered promiscuous mode [ 731.121657][T10331] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 731.163895][T10331] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 731.266123][T10331] team0: Port device team_slave_0 added [ 731.304143][T10331] team0: Port device team_slave_1 added [ 731.338893][ T4289] Bluetooth: hci3: command 0x041b tx timeout [ 731.449719][T10331] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 731.502586][T10331] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 731.632541][T10331] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 732.236392][T10331] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 732.259831][T10331] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 732.366786][T10421] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 732.375853][T10331] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 732.451528][T10421] udc usbip-vudc.0: failed to start g1: -19 [ 732.605130][T10421] UDC core: g1: couldn't find an available UDC or it's busy [ 733.159447][ T4289] Bluetooth: hci1: command 0x0406 tx timeout [ 733.380409][T10430] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 733.411858][ T4331] tipc: Left network mode [ 733.528746][T10430] udc usbip-vudc.0: failed to start g1: -19 [ 733.557398][T10430] UDC core: g1: couldn't find an available UDC or it's busy [ 733.593210][ T4289] Bluetooth: hci3: command 0x040f tx timeout [ 733.609150][T10331] device hsr_slave_0 entered promiscuous mode [ 733.681684][T10441] loop7: detected capacity change from 0 to 1024 [ 733.720450][T10331] device hsr_slave_1 entered promiscuous mode [ 733.760561][T10441] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 733.782052][T10331] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 733.802626][T10331] Cannot create hsr debugfs directory [ 733.822974][T10445] netlink: 260 bytes leftover after parsing attributes in process `syz.1.1299'. [ 733.851744][T10441] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 734.061698][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 734.269168][T10451] loop7: detected capacity change from 0 to 4096 [ 734.365219][T10451] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 734.411799][T10452] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1302'. [ 734.701124][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 734.751468][T10461] loop8: detected capacity change from 0 to 1024 [ 735.847571][ T4289] Bluetooth: hci3: command 0x0419 tx timeout [ 736.075425][T10480] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 736.121969][T10480] udc usbip-vudc.0: failed to start g1: -19 [ 736.148276][T10480] UDC core: g1: couldn't find an available UDC or it's busy [ 736.656015][T10331] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 736.761869][T10496] netlink: 'syz.7.1318': attribute type 62 has an invalid length. [ 737.682407][T10331] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 737.795722][T10331] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 738.015588][T10501] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1320'. [ 738.204155][T10331] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 738.423399][ T4331] device hsr_slave_0 left promiscuous mode [ 738.442292][ T4331] device hsr_slave_1 left promiscuous mode [ 738.469874][ T4331] batman_adv: batadv0: Interface deactivated: dummy0 [ 738.476689][ T4331] batman_adv: batadv0: Removing interface: dummy0 [ 738.506610][ T4331] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 738.524458][ T4331] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 738.532622][ T4331] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 738.567530][ T4331] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 738.696293][ T4331] device veth1_macvtap left promiscuous mode [ 738.719710][ T4331] device veth0_macvtap left promiscuous mode [ 738.725959][ T4331] device veth1_vlan left promiscuous mode [ 738.773646][ T4331] device veth0_vlan left promiscuous mode [ 739.210127][T10524] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1328'. [ 740.013218][T10529] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1330'. [ 741.679681][ T4319] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 741.906128][ T4319] usb 8-1: Using ep0 maxpacket: 8 [ 741.924220][ T4319] usb 8-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 742.013841][ T4319] usb 8-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 742.116590][ T4319] usb 8-1: config 0 interface 0 has no altsetting 0 [ 742.174059][ T4319] usb 8-1: New USB device found, idVendor=17ef, idProduct=6009, bcdDevice= 0.00 [ 742.261430][ T4319] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 742.419597][ T4319] usb 8-1: config 0 descriptor?? [ 743.055460][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 743.129366][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 743.185568][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 743.308684][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 743.533012][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 743.620155][T10554] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1339'. [ 744.304187][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 744.312795][ T4319] lenovo 0003:17EF:6009.0005: unknown main item tag 0x0 [ 744.368422][T10556] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 744.376067][T10556] udc usbip-vudc.0: failed to start g1: -19 [ 744.425587][ T4319] lenovo 0003:17EF:6009.0005: hidraw0: USB HID v0.05 Device [HID 17ef:6009] on usb-dummy_hcd.7-1/input0 [ 744.449878][T10556] UDC core: g1: couldn't find an available UDC or it's busy [ 744.479037][ T4319] usb 8-1: USB disconnect, device number 10 [ 745.321544][T10559] fido_id[10559]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 746.956327][T10582] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1345'. [ 747.567346][ T4331] team0 (unregistering): Port device team_slave_1 removed [ 747.735405][ T4331] team0 (unregistering): Port device team_slave_0 removed [ 747.896762][ T4331] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 748.093902][ T4331] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 749.042664][T10595] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 749.064461][T10595] udc usbip-vudc.0: failed to start g1: -19 [ 749.087774][T10595] UDC core: g1: couldn't find an available UDC or it's busy [ 749.264312][T10600] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(3) [ 749.264532][T10600] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 749.270140][T10600] vhci_hcd vhci_hcd.0: Device attached [ 749.522916][ T4319] vhci_hcd: vhci_device speed not set [ 749.589339][ T4403] usb 9-1: new low-speed USB device number 4 using dummy_hcd [ 749.655385][ T4319] usb 49-1: new full-speed USB device number 2 using vhci_hcd [ 749.799080][ T4331] bond0 (unregistering): Released all slaves [ 749.811054][ T4403] usb 9-1: config 0 has no interfaces? [ 749.817081][ T4403] usb 9-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 749.836911][ T4403] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 749.855106][ T4403] usb 9-1: config 0 descriptor?? [ 749.986642][T10611] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1358'. [ 750.647236][ T4321] usb 9-1: USB disconnect, device number 4 [ 750.673198][T10601] usbip_core: unknown command [ 750.678412][T10601] vhci_hcd: unknown pdu 0 [ 750.760912][T10601] usbip_core: unknown command [ 750.975058][ T4499] vhci_hcd: stop threads [ 751.032619][ T4499] vhci_hcd: release socket [ 751.046100][T10331] 8021q: adding VLAN 0 to HW filter on device bond0 [ 751.061884][ T4499] vhci_hcd: disconnect device [ 751.131300][T10331] 8021q: adding VLAN 0 to HW filter on device team0 [ 751.146122][ T4499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 751.169240][ T4499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 751.389662][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 751.886627][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 751.980137][ T5048] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.987434][ T5048] bridge0: port 1(bridge_slave_0) entered forwarding state [ 752.148438][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 752.213413][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 752.222484][ T5048] bridge0: port 2(bridge_slave_1) entered blocking state [ 752.229690][ T5048] bridge0: port 2(bridge_slave_1) entered forwarding state [ 752.239268][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 752.252648][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 752.261882][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 752.292239][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 752.325439][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 752.340196][T10637] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1365'. [ 752.380539][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 752.430973][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 752.468487][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 752.502225][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 752.527327][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 752.609221][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 752.633604][ T5048] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 752.641946][ T4622] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 752.660757][T10331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 752.842690][ T4622] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 752.883349][ T4622] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 752.975035][ T4622] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 753.055485][ T4622] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 753.087967][ T4622] usb 8-1: SerialNumber: syz [ 753.154996][T10646] netlink: 72 bytes leftover after parsing attributes in process `syz.8.1368'. [ 753.734685][ T4622] usb 8-1: 0:2 : does not exist [ 753.739788][ T4622] usb 8-1: unit 120 not found! [ 753.807714][ T4622] usb 8-1: unit 48 not found! [ 753.878297][T10647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1363'. [ 753.899861][ T4622] usb 8-1: unit 52 not found! [ 753.993601][ T4622] usb 8-1: USB disconnect, device number 11 [ 754.338979][ T7686] udevd[7686]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 754.558911][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 754.574599][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 754.608563][T10331] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 755.181965][ T4319] vhci_hcd: vhci_device speed not set [ 755.513478][T10678] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1378'. [ 755.593998][T10684] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1380'. [ 755.804370][T10687] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1381'. [ 755.863890][T10692] netlink: 'syz.5.1383': attribute type 49 has an invalid length. [ 756.197556][T10697] loop7: detected capacity change from 0 to 4096 [ 756.278270][T10704] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 756.358663][ T26] audit: type=1800 audit(1786340503.774:141): pid=10708 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.1388" name="idProduct" dev="configfs" ino=57474 res=0 errno=0 [ 756.527106][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 756.590336][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 756.723520][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 756.750065][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 756.770129][T10719] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1389'. [ 756.786526][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 756.849709][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 756.911540][T10331] device veth0_vlan entered promiscuous mode [ 756.949071][ T9645] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 756.977116][T10331] device veth1_vlan entered promiscuous mode [ 757.156237][ T9645] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 757.207512][ T9645] usb 2-1: config 0 has no interface number 0 [ 757.259770][ T9645] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 757.286384][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 757.604636][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 757.890694][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 758.007104][T10729] loop8: detected capacity change from 0 to 1024 [ 758.025214][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 758.072024][T10331] device veth0_macvtap entered promiscuous mode [ 758.096039][ T9645] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 758.113104][ T9645] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.121406][ T9645] usb 2-1: Product: syz [ 758.125628][ T9645] usb 2-1: Manufacturer: syz [ 758.128886][T10729] EXT4-fs: Ignoring removed bh option [ 758.132539][ T9645] usb 2-1: SerialNumber: syz [ 758.143497][ T9645] usb 2-1: config 0 descriptor?? [ 758.153611][T10331] device veth1_macvtap entered promiscuous mode [ 758.172983][ T9645] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 758.180988][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 758.197676][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 758.271950][T10729] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a80ec028, mo2=0002] [ 758.318729][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 758.335519][T10729] System zones: 0-1, 3-12 [ 758.364328][T10729] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 758.390026][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.411052][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 758.443850][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.488994][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 758.500405][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.510417][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 758.521841][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.552734][T10331] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 758.562896][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 758.585437][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 758.622164][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 758.643116][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.702288][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 758.743762][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.756550][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 758.774651][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.788010][T10331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 758.818577][T10331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 758.846582][T10331] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 758.861632][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 758.883809][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 758.905983][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 758.946329][T10331] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 758.964824][T10331] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 758.973646][T10331] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.022160][T10331] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.025698][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.105463][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 759.204602][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.242968][ T7422] EXT4-fs error (device loop8): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 759.341140][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.348253][ T4477] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 759.374762][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 759.408169][ T4477] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 759.428051][T10746] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1396'. [ 759.454292][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 759.464440][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 759.550675][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.564532][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 759.589928][ T4463] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 759.612356][ T4463] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 759.653024][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.660263][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 759.689876][ T7422] EXT4-fs error (device loop8): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 759.783213][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.841822][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 759.902937][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 759.961174][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 759.967931][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 760.082625][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 760.112154][ T9645] usb 2-1: USB disconnect, device number 11 [ 760.189512][ T9645] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 760.226860][ T7422] EXT4-fs error (device loop8): empty_inline_dir:1903: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 761.336294][ T7422] EXT4-fs (loop8): Remounting filesystem read-only [ 761.381361][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.484630][ T7422] EXT4-fs error (device loop8): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /170/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 761.585672][T10769] netlink: 'syz.5.1401': attribute type 5 has an invalid length. [ 761.661587][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.708760][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.759655][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.801274][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.832123][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.857572][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.884783][T10774] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 761.895403][ T7422] EXT4-fs warning (device loop8): empty_inline_dir:1910: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 761.947320][T10774] udc usbip-vudc.0: failed to start g1: -19 [ 762.009602][T10774] UDC core: g1: couldn't find an available UDC or it's busy [ 763.621678][T10803] loop9: detected capacity change from 0 to 164 [ 764.239826][T10803] rock: directory entry would overflow storage [ 764.296921][T10803] rock: sig=0x5252, size=5, remaining=3 [ 764.477507][T10811] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1414'. [ 764.612367][ T7422] EXT4-fs: 294 callbacks suppressed [ 764.612387][ T7422] EXT4-fs (loop8): unmounting filesystem. [ 764.916821][T10822] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 764.938943][ T4442] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.952680][T10822] udc usbip-vudc.0: failed to start g1: -19 [ 764.979741][T10822] UDC core: g1: couldn't find an available UDC or it's busy [ 765.166427][ T4442] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.329598][ T4442] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.524288][ T4442] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.592014][T10834] loop7: detected capacity change from 0 to 4096 [ 765.681070][T10834] NILFS (loop7): invalid segment: Checksum error in segment payload [ 765.716014][T10834] NILFS (loop7): trying rollback from an earlier position [ 765.809080][T10834] NILFS (loop7): recovery complete [ 765.937606][T10841] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 766.738856][T10847] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 766.812316][T10847] udc usbip-vudc.0: failed to start g1: -19 [ 766.841509][T10847] UDC core: g1: couldn't find an available UDC or it's busy [ 767.192209][ T4282] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 767.208161][ T4282] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 767.220001][ T4282] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 767.229022][ T4282] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 767.237602][ T4282] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 767.247497][ T4282] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 767.798482][T10874] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1427'. [ 768.235461][ T4622] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 768.429186][T10860] syz.1.1430 (10860): drop_caches: 2 [ 768.655090][ T4622] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 768.681502][ T4622] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 768.708374][ T4622] usb 6-1: config 0 has no interface number 0 [ 768.725709][ T4622] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 768.746828][ T4622] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 768.800597][ T4622] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 768.830069][ T4622] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.842633][T10878] bridge0: port 2(bridge_slave_1) entered listening state [ 768.865061][ T4622] usb 6-1: Product: syz [ 768.884761][T10878] bridge0: port 2(bridge_slave_1) entered disabled state [ 768.891173][ T4622] usb 6-1: Manufacturer: syz [ 768.908331][ T4622] usb 6-1: SerialNumber: syz [ 768.939182][ T4622] usb 6-1: config 0 descriptor?? [ 769.187227][T10886] loop7: detected capacity change from 0 to 512 [ 769.235884][T10886] EXT4-fs (loop7): Test dummy encryption mode enabled [ 769.312785][T10886] EXT4-fs error (device loop7): ext4_orphan_get:1405: inode #15: comm syz.7.1437: inode has both inline data and extents flags [ 769.381389][T10886] EXT4-fs error (device loop7): ext4_orphan_get:1410: comm syz.7.1437: couldn't read orphan inode 15 (err -117) [ 769.480464][T10886] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 769.490199][ T4289] Bluetooth: hci1: command 0x0409 tx timeout [ 769.578194][T10855] chnl_net:caif_netlink_parms(): no params data found [ 769.635912][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 769.663786][ T4621] usb 6-1: USB disconnect, device number 11 [ 769.801295][T10900] loop7: detected capacity change from 0 to 256 [ 769.864246][T10900] exfat: Deprecated parameter 'utf8' [ 769.910504][T10900] exfat: Deprecated parameter 'namecase' [ 769.916352][T10900] exfat: Deprecated parameter 'namecase' [ 769.953188][T10900] exfat: Deprecated parameter 'utf8' [ 769.988430][T10900] exFAT-fs (loop7): failed to load upcase table (idx : 0x00012153, chksum : 0x6a70c931, utbl_chksum : 0xe619d30d) [ 770.203684][T10855] bridge0: port 1(bridge_slave_0) entered blocking state [ 770.242105][T10855] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.289345][T10855] device bridge_slave_0 entered promiscuous mode [ 770.417665][T10909] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 770.454751][T10909] udc usbip-vudc.0: failed to start g1: -19 [ 770.461252][T10909] UDC core: g1: couldn't find an available UDC or it's busy [ 770.477040][T10914] loop9: detected capacity change from 0 to 256 [ 770.559794][T10918] loop7: detected capacity change from 0 to 512 [ 770.632868][T10918] fscrypt (loop7, inode 2): Error -61 getting encryption context [ 770.713699][T10918] EXT4-fs (loop7): Cannot turn on journaled quota: type 1: error -61 [ 770.722702][T10918] EXT4-fs error (device loop7): ext4_orphan_get:1405: inode #13: comm syz.7.1443: iget: bad i_size value: 12154757448730 [ 770.740987][T10918] EXT4-fs error (device loop7): ext4_orphan_get:1410: comm syz.7.1443: couldn't read orphan inode 13 (err -117) [ 770.814765][T10855] bridge0: port 2(bridge_slave_1) entered blocking state [ 770.830554][T10918] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 770.832861][T10855] bridge0: port 2(bridge_slave_1) entered disabled state [ 770.919810][T10855] device bridge_slave_1 entered promiscuous mode [ 771.097317][T10855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 771.144034][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 771.573091][T10944] loop9: detected capacity change from 0 to 4096 [ 771.621588][T10944] NILFS (loop9): invalid segment: Checksum error in segment payload [ 771.662534][T10944] NILFS (loop9): trying rollback from an earlier position [ 771.742021][ T4289] Bluetooth: hci1: command 0x041b tx timeout [ 771.759054][T10944] NILFS (loop9): recovery complete [ 771.794188][T10948] NILFS (loop9): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 771.929161][T10855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 772.209054][T10955] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1450'. [ 772.482490][T10855] team0: Port device team_slave_0 added [ 772.495487][ T4442] device hsr_slave_0 left promiscuous mode [ 772.545992][ T4442] device hsr_slave_1 left promiscuous mode [ 772.565801][ T4442] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 772.588812][ T4442] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 772.611445][ T4442] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 772.641001][ T4442] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 772.674391][ T4442] device bridge_slave_1 left promiscuous mode [ 772.680835][ T4442] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.696727][T10958] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 772.726901][T10958] udc usbip-vudc.0: failed to start g1: -19 [ 772.742896][T10958] UDC core: g1: couldn't find an available UDC or it's busy [ 772.759225][ T4442] device bridge_slave_0 left promiscuous mode [ 772.771892][ T4442] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.935758][ T4442] device veth0_macvtap left promiscuous mode [ 772.942046][ T4442] device veth1_vlan left promiscuous mode [ 772.966487][ T4442] device veth0_vlan left promiscuous mode [ 773.036681][T10954] loop9: detected capacity change from 0 to 32768 [ 773.182438][T10954] JBD2: Ignoring recovery information on journal [ 773.356668][ T4622] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 773.580379][ T4622] usb 6-1: unable to get BOS descriptor or descriptor too short [ 773.635073][T10954] ocfs2: Mounting device (7,9) on (node local, slot 0) with ordered data mode. [ 773.663788][ T4622] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 773.956883][ T4622] usb 6-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 774.061024][ T4289] Bluetooth: hci1: command 0x040f tx timeout [ 774.234656][ T4622] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.253138][ T4622] usb 6-1: Product: syz [ 774.277880][ T4622] usb 6-1: Manufacturer: syz [ 774.285599][ T4622] usb 6-1: SerialNumber: syz [ 774.294462][T10954] OCFS2: ERROR (device loop9): int ocfs2_xattr_find_entry(struct inode *, int, const char *, struct ocfs2_xattr_search *): corrupted xattr entries [ 774.294697][T10954] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 774.512850][T10954] OCFS2: Returning error to the calling process. [ 774.523851][T10954] (syz.9.1453,10954,1):ocfs2_setattr:1299 ERROR: status = -117 [ 774.540115][ T4442] bond1 (unregistering): Released all slaves [ 774.560931][ T4622] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 774.774419][ T4622] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 774.819825][ T4622] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 774.891995][T10331] ocfs2: Unmounting device (7,9) on (node local) [ 775.223289][ T4622] usb 6-1: parse_audio_format_rates_v2v3(): unable to retrieve sample rate range (clock 0) [ 775.306614][T10994] program syz.7.1466 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 775.340231][ T4622] usb 6-1: USB disconnect, device number 12 [ 775.593880][T11001] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 775.613448][T11001] udc usbip-vudc.0: failed to start g1: -19 [ 775.635986][T11001] UDC core: g1: couldn't find an available UDC or it's busy [ 775.687975][ T7686] udevd[7686]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 776.250736][ T4282] Bluetooth: hci1: command 0x0419 tx timeout [ 777.017281][T10996] loop9: detected capacity change from 0 to 40427 [ 777.048609][T10996] F2FS-fs (loop9): invalid crc value [ 777.145070][T10996] F2FS-fs (loop9): Found nat_bits in checkpoint [ 777.316272][T10996] F2FS-fs (loop9): Cannot turn on quotas: -2 on 0 [ 777.388569][T10996] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e4 [ 777.640807][T11015] loop7: detected capacity change from 0 to 32768 [ 777.772033][T11015] JBD2: Ignoring recovery information on journal [ 778.525751][T11015] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode. [ 778.623147][T11015] OCFS2: ERROR (device loop7): int ocfs2_xattr_find_entry(struct inode *, int, const char *, struct ocfs2_xattr_search *): corrupted xattr entries [ 778.623184][T11015] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 778.713564][T11015] OCFS2: Returning error to the calling process. [ 778.726674][T11015] (syz.7.1472,11015,1):ocfs2_setattr:1299 ERROR: status = -117 [ 778.860689][ T7332] ocfs2: Unmounting device (7,7) on (node local) [ 779.160501][T11038] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 779.168641][T11038] udc usbip-vudc.0: failed to start g1: -19 [ 779.175032][T11038] UDC core: g1: couldn't find an available UDC or it's busy [ 779.353953][ T4442] team0 (unregistering): Port device team_slave_1 removed [ 779.469983][ T4442] team0 (unregistering): Port device team_slave_0 removed [ 779.581257][ T4442] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 779.681196][ T4442] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 779.866549][T11042] loop9: detected capacity change from 0 to 32768 [ 780.090737][T11042] XFS (loop9): Mounting V5 Filesystem [ 780.302337][T11042] XFS (loop9): Ending clean mount [ 780.437742][T10331] XFS (loop9): Unmounting Filesystem [ 780.543228][ T4442] bond0 (unregistering): Released all slaves [ 780.904881][T10855] team0: Port device team_slave_1 added [ 780.962624][T11029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1476'. [ 781.035985][T10855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 781.094983][T10855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 781.357778][T10855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 781.427482][T10855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 781.435519][T10855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 781.461946][T10855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 782.146686][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 782.153212][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 782.271172][T10855] device hsr_slave_0 entered promiscuous mode [ 782.362095][T10855] device hsr_slave_1 entered promiscuous mode [ 782.374718][T10855] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 782.402730][T10855] Cannot create hsr debugfs directory [ 782.742841][T11072] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 782.811225][T11072] udc usbip-vudc.0: failed to start g1: -19 [ 782.829829][T11072] UDC core: g1: couldn't find an available UDC or it's busy [ 783.140582][T11082] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 783.184193][T11082] udc usbip-vudc.0: failed to start g1: -19 [ 783.210996][T11082] UDC core: g1: couldn't find an available UDC or it's busy [ 783.534818][T11093] syz.7.1492[11093] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 783.534947][T11093] syz.7.1492[11093] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 784.793179][T11119] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 785.302189][T11119] udc usbip-vudc.0: failed to start g1: -19 [ 785.308617][T11119] UDC core: g1: couldn't find an available UDC or it's busy [ 785.740601][T11128] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 785.770775][T11128] udc usbip-vudc.0: failed to start g1: -19 [ 785.798797][T11128] UDC core: g1: couldn't find an available UDC or it's busy [ 785.997860][T10855] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 786.055434][T10855] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 786.130887][T10855] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 786.183127][T10855] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 786.396661][T11155] netlink: 268 bytes leftover after parsing attributes in process `syz.7.1511'. [ 786.498553][T10855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 786.566637][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 786.590726][ T4331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 786.626248][T10855] 8021q: adding VLAN 0 to HW filter on device team0 [ 786.661744][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 786.678846][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 786.703119][ T4459] bridge0: port 1(bridge_slave_0) entered blocking state [ 786.710410][ T4459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 786.724743][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 786.830611][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 786.862603][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 786.915809][ T4459] bridge0: port 2(bridge_slave_1) entered blocking state [ 786.922946][ T4459] bridge0: port 2(bridge_slave_1) entered forwarding state [ 786.990592][ T4621] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 787.018453][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 787.055864][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 787.064855][T11169] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1513'. [ 787.104966][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 787.133846][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 787.176343][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 787.194404][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 787.227218][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 787.235938][ T4621] usb 10-1: Using ep0 maxpacket: 8 [ 787.243874][ T4621] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 787.282078][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 787.304518][ T4621] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 787.330391][ T4459] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 787.348188][ T4621] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 787.371498][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 787.391777][ T4621] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 787.422272][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 787.450526][T11172] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 787.460433][ T4621] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 787.477994][T10855] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 787.494806][T11172] udc usbip-vudc.0: failed to start g1: -19 [ 787.506981][ T4621] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 787.532891][T11172] UDC core: g1: couldn't find an available UDC or it's busy [ 787.780009][ T4621] usb 10-1: GET_CAPABILITIES returned 0 [ 787.786091][ T4621] usbtmc 10-1:16.0: can't read capabilities [ 788.013745][ C1] usbtmc 10-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 788.036459][T11161] usbtmc 10-1:16.0: Unable to send data, error -71 [ 788.053785][T11180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1518'. [ 788.073593][ T4621] usb 10-1: USB disconnect, device number 2 [ 788.437996][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 788.452724][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 788.489845][T10855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 788.552169][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 788.575134][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 788.652762][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 788.684890][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 788.806653][T10855] device veth0_vlan entered promiscuous mode [ 788.874045][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 788.887746][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 788.919971][T10855] device veth1_vlan entered promiscuous mode [ 788.978074][T11194] overlayfs: invalid origin (00000079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 789.047449][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 789.057600][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 789.107425][T10855] device veth0_macvtap entered promiscuous mode [ 789.152274][T10855] device veth1_macvtap entered promiscuous mode [ 789.243795][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 789.298905][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.319913][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 789.352825][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.363788][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 789.393536][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.457313][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 789.523197][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.655862][T10855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 789.718831][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 789.733000][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 789.836699][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 789.857460][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 789.921793][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 789.943807][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.989164][T11218] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 789.993410][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 790.017658][T11218] udc usbip-vudc.0: failed to start g1: -19 [ 790.029377][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 790.044019][T11218] UDC core: g1: couldn't find an available UDC or it's busy [ 790.057129][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 790.100853][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 790.125285][T10855] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 790.144329][T10855] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 790.184384][T10855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 790.191947][ T5339] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 790.216206][T10855] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.258845][T10855] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.286484][T10855] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.303854][T10855] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.334815][T11224] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 790.351240][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 790.360545][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 790.380076][T11224] udc usbip-vudc.0: failed to start g1: -19 [ 790.394448][ T5339] usb 2-1: Using ep0 maxpacket: 8 [ 790.427330][T11224] UDC core: g1: couldn't find an available UDC or it's busy [ 790.441717][ T5339] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 790.480505][ T5339] usb 2-1: config 0 has no interface number 0 [ 790.486691][ T5339] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 790.518202][ T5339] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 790.532505][ T5339] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 790.578966][ T5339] usb 2-1: config 0 descriptor?? [ 790.671724][ T5339] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 790.764712][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.788102][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.821116][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 790.961655][ T4477] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.977591][ T4477] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 791.162819][ T4442] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 792.044246][ T5339] usb 2-1: USB disconnect, device number 12 [ 794.132455][T11281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1539'. [ 795.801792][ T4320] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 796.029502][ T4320] usb 8-1: Using ep0 maxpacket: 8 [ 796.036513][ T4320] usb 8-1: config index 0 descriptor too short (expected 30, got 18) [ 796.095955][ T4320] usb 8-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 796.148414][ T4320] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.171446][ T4320] usb 8-1: Product: syz [ 796.175711][ T4320] usb 8-1: Manufacturer: syz [ 796.213337][ T4320] usb 8-1: SerialNumber: syz [ 796.229256][ T4320] usb 8-1: config 0 descriptor?? [ 796.263809][ T4320] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 796.306265][ T4320] usb 8-1: setting power ON [ 796.322596][ T4320] dvb-usb: bulk message failed: -22 (2/0) [ 796.412277][ T4320] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 796.465807][T11298] dvb-usb: bulk message failed: -22 (3/0) [ 796.475533][ T4320] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 796.495591][T11298] dvb-usb: bulk message failed: -22 (5/0) [ 796.524290][ T4320] usb 8-1: media controller created [ 796.539331][T11298] dvb-usb: bulk message failed: -22 (3/0) [ 796.639205][T11318] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1547'. [ 796.692328][ T4320] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 796.857871][ T4320] usb 8-1: selecting invalid altsetting 6 [ 796.872495][ T4320] usb 8-1: digital interface selection failed (-22) [ 796.895577][ T4320] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 796.928446][ T4320] usb 8-1: setting power OFF [ 796.934470][ T4320] dvb-usb: bulk message failed: -22 (2/0) [ 796.957258][ T4320] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 796.989344][ T4320] (NULL device *): no alternate interface [ 797.037226][ T5339] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 797.105301][ T4320] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 797.179638][ T4320] usb 8-1: USB disconnect, device number 12 [ 797.267004][ T5339] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 797.297323][ T5339] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.330848][ T5339] usb 4-1: config 0 descriptor?? [ 797.364987][ T5339] cp210x 4-1:0.0: cp210x converter detected [ 797.923175][T11328] loop9: detected capacity change from 0 to 4096 [ 798.271747][T11328] ntfs3: loop9: Different NTFS' sector size (1024) and media sector size (512) [ 798.314813][ T5339] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 798.346161][ T5339] usb 4-1: cp210x converter now attached to ttyUSB0 [ 798.436920][T11328] ntfs3: loop9: Failed to load $Extend. [ 798.562619][ T4321] usb 4-1: USB disconnect, device number 2 [ 798.587265][ T4321] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 798.687310][ T4321] cp210x 4-1:0.0: device disconnected [ 798.807866][ T4353] usb 8-1: new full-speed USB device number 13 using dummy_hcd [ 798.873336][ T4320] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 799.022264][ T4353] usb 8-1: config 0 interface 0 altsetting 255 endpoint 0x3 has invalid wMaxPacketSize 0 [ 799.043799][T11350] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 799.054368][ T4353] usb 8-1: config 0 interface 0 has no altsetting 0 [ 799.062592][T11350] udc usbip-vudc.0: failed to start g1: -19 [ 799.073701][T11350] UDC core: g1: couldn't find an available UDC or it's busy [ 799.107326][ T4320] usb 2-1: Using ep0 maxpacket: 8 [ 799.112799][ T4353] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 799.123248][ T4320] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 799.133030][ T4353] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 799.157926][ T4320] usb 2-1: config 179 has no interface number 0 [ 799.165861][ T4353] usb 8-1: Product: syz [ 799.170150][ T4353] usb 8-1: Manufacturer: syz [ 799.181928][ T4320] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 799.205354][ T4320] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 799.207012][ T4353] usb 8-1: SerialNumber: syz [ 799.222187][ T4320] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 799.244251][ T4320] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 799.262184][ T4353] usb 8-1: config 0 descriptor?? [ 799.302359][ T4320] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 799.325572][ T4353] usb 8-1: selecting invalid altsetting 0 [ 799.360440][ T4320] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 799.382260][ T4320] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 799.454577][T11343] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 799.540796][ T5339] usb 8-1: USB disconnect, device number 13 [ 799.772355][ T4621] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input23 [ 799.963661][ T14] usb 2-1: USB disconnect, device number 13 [ 799.963680][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 799.979675][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 799.990204][ T14] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 800.265134][T11366] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 800.288999][T11366] udc usbip-vudc.0: failed to start g1: -19 [ 800.329272][T11366] UDC core: g1: couldn't find an available UDC or it's busy [ 802.936081][T11398] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1568'. [ 803.431332][ T4622] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 803.556532][T11406] loop3: detected capacity change from 0 to 4096 [ 803.607182][T11406] ntfs3: loop3: Different NTFS' sector size (4096) and media sector size (512) [ 803.648129][ T4622] usb 2-1: Using ep0 maxpacket: 8 [ 803.655381][ T4622] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 803.691651][ T4622] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 803.740962][ T4622] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 803.768888][ T4622] usb 2-1: config 0 descriptor?? [ 803.778389][ T4621] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 803.819441][T11406] ntfs3: loop3: Inode r=19 is not in use! [ 803.848308][T11406] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 804.017011][ T4622] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 804.027836][ T4621] usb 6-1: Using ep0 maxpacket: 16 [ 804.035902][ T4621] usb 6-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 804.078498][ T4621] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.120955][ T4621] usb 6-1: Product: syz [ 804.133271][ T4621] usb 6-1: Manufacturer: syz [ 804.151012][ T4621] usb 6-1: SerialNumber: syz [ 804.166066][T11401] loop7: detected capacity change from 0 to 32768 [ 804.175451][ T4621] usb 6-1: config 0 descriptor?? [ 804.205066][ T4621] gspca_main: spca508-2.14.0 probing 041e:4018 [ 804.241932][ T4622] usb 2-1: USB disconnect, device number 14 [ 804.256411][ T8996] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 804.323642][T11401] XFS (loop7): Mounting V5 Filesystem [ 804.395047][T11401] XFS (loop7): Ending clean mount [ 804.425443][ T4621] gspca_spca508: reg_read err -32 [ 804.432435][ T4621] gspca_spca508: reg_read err -32 [ 804.460966][ T8996] usb 10-1: Using ep0 maxpacket: 8 [ 804.492253][ T8996] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 804.561631][ T8996] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 804.625256][ T8996] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 804.655398][ T4621] gspca_spca508: reg_read err -71 [ 804.667577][ T4621] gspca_spca508: reg_read err -71 [ 804.680129][ T7332] XFS (loop7): Unmounting Filesystem [ 804.688126][ T4621] gspca_spca508: reg write: error -71 [ 804.691907][ T8996] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 804.704276][ T4621] spca508: probe of 6-1:0.0 failed with error -71 [ 804.725379][ T4621] usb 6-1: USB disconnect, device number 13 [ 804.739712][ T8996] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 804.822160][ T8996] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 804.857938][ T8996] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 804.920243][ T8996] usbtmc: probe of 10-1:16.0 failed with error -22 [ 806.531071][ T14] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 806.956177][ T14] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 806.966168][ T14] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.978267][ T14] usb 2-1: config 0 descriptor?? [ 806.986242][ T14] cp210x 2-1:0.0: cp210x converter detected [ 807.345611][ T4321] usb 10-1: USB disconnect, device number 3 [ 808.065651][ T14] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 808.319174][ T14] cp210x 2-1:0.0: failed to get vendor val 0x370c size 15: -71 [ 808.326890][ T14] cp210x 2-1:0.0: GPIO initialisation failed: -71 [ 808.425864][ T14] usb 2-1: cp210x converter now attached to ttyUSB0 [ 808.627331][ T14] usb 2-1: USB disconnect, device number 15 [ 809.052534][T11473] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1585'. [ 809.111032][ T14] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 809.147107][ T14] cp210x 2-1:0.0: device disconnected [ 810.028321][T11468] loop7: detected capacity change from 0 to 32768 [ 810.072630][T11468] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop7 scanned by syz.7.1587 (11468) [ 810.150772][T11468] BTRFS info (device loop7): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 810.194588][T11468] BTRFS info (device loop7): using blake2b (blake2b-256-generic) checksum algorithm [ 810.293946][T11496] device syz_tun entered promiscuous mode [ 810.430924][T11468] BTRFS info (device loop7): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 810.834208][T11468] BTRFS info (device loop7): use zstd compression, level 3 [ 811.137284][T11468] BTRFS info (device loop7): using free space tree [ 811.431868][T11468] BTRFS info (device loop7): enabling ssd optimizations [ 811.668886][T11533] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1599'. [ 811.721582][ T7332] BTRFS info (device loop7): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 812.138173][T11543] loop9: detected capacity change from 0 to 4096 [ 812.242477][ T8996] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 812.254688][T11543] ntfs: (device loop9): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 812.297218][T11543] ntfs: (device loop9): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 812.351479][T11543] ntfs: (device loop9): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 812.404219][T11543] ntfs: (device loop9): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 812.448510][T11543] ntfs: (device loop9): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 812.470125][ T8996] usb 2-1: Using ep0 maxpacket: 32 [ 812.477634][ T8996] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 812.552839][ T8996] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.630164][ T8996] usb 2-1: config 0 descriptor?? [ 812.817542][T11543] ntfs: volume version 3.1. [ 812.851416][T11543] ntfs: (device loop9): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 812.870074][ T7686] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 9 /dev/loop7 scanned by udevd (7686) [ 812.875845][T11543] ntfs: (device loop9): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 812.924440][ T8996] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 812.958511][ T8996] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 812.968322][T11543] ntfs: (device loop9): ntfs_lookup_inode_by_name(): Index entry out of bounds in directory inode 0x5. [ 812.980222][ T8996] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 812.987454][ T8996] usb 2-1: media controller created [ 813.002537][T11543] ntfs: (device loop9): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 813.044711][T11543] ntfs: (device loop9): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 813.130357][ T8996] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 813.253060][ T8996] az6027: usb out operation failed. (-71) [ 813.302172][ T8996] az6027: usb out operation failed. (-71) [ 813.328668][ T8996] stb0899_attach: Driver disabled by Kconfig [ 813.358948][ T8996] az6027: no front-end attached [ 813.358948][ T8996] [ 813.441475][ T8996] az6027: usb out operation failed. (-71) [ 813.463351][ T8996] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 813.496392][ T8996] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input24 [ 813.570808][ T8996] dvb-usb: schedule remote query interval to 400 msecs. [ 813.604287][ T8996] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 814.486767][ T8996] usb 2-1: USB disconnect, device number 16 [ 814.759322][ T8996] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 814.983749][T11589] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1613'. [ 815.151968][T11593] using random self ethernet address [ 815.169326][T11593] using random host ethernet address [ 815.469421][T11601] netlink: 28 bytes leftover after parsing attributes in process `syz.9.1616'. [ 817.251091][T11626] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 817.259573][T11626] udc usbip-vudc.0: failed to start g1: -19 [ 817.296617][T11626] UDC core: g1: couldn't find an available UDC or it's busy [ 817.325851][ T8996] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 817.553235][ T8996] usb 8-1: Using ep0 maxpacket: 32 [ 817.564139][ T8996] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 817.573269][ T8996] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 817.651558][ T8996] usb 8-1: config 0 descriptor?? [ 817.828502][T11637] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1626'. [ 817.856725][T11637] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1626'. [ 817.882381][ T8996] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 817.900166][ T8996] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 817.901335][T11637] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1626'. [ 817.946783][ T8996] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 817.955316][T11637] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1626'. [ 817.993619][ T8996] usb 8-1: media controller created [ 818.067470][ T8996] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 818.189426][ T8996] az6027: usb out operation failed. (-71) [ 818.209221][T11643] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 818.213681][ T8996] az6027: usb out operation failed. (-71) [ 818.247012][T11643] udc usbip-vudc.0: failed to start g1: -19 [ 818.247429][T11643] UDC core: g1: couldn't find an available UDC or it's busy [ 818.265552][ T8996] stb0899_attach: Driver disabled by Kconfig [ 818.265569][ T8996] az6027: no front-end attached [ 818.265569][ T8996] [ 818.271200][ T8996] az6027: usb out operation failed. (-71) [ 818.271225][ T8996] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 818.282402][ T8996] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb8/8-1/input/input25 [ 818.284316][ T8996] dvb-usb: schedule remote query interval to 400 msecs. [ 818.284345][ T8996] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 818.306109][ T8996] usb 8-1: USB disconnect, device number 14 [ 818.435954][ T8996] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 818.595291][T11654] loop9: detected capacity change from 0 to 1024 [ 818.615712][T11654] EXT4-fs: Ignoring removed oldalloc option [ 818.621734][T11654] EXT4-fs: Ignoring removed oldalloc option [ 818.678856][T11654] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 818.757256][T11654] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 818.804371][T11659] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1624'. [ 818.837442][ T4353] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 819.012513][T10331] EXT4-fs (loop9): unmounting filesystem. [ 819.037919][ T4353] usb 2-1: Using ep0 maxpacket: 8 [ 819.045345][ T4353] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 819.074188][ T4353] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 819.108504][ T4353] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 819.146460][ T4353] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 819.179919][ T4353] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 819.211388][ T4353] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 819.239622][ T4353] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 819.492539][T11671] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 819.522628][T11671] udc usbip-vudc.0: failed to start g1: -19 [ 819.533331][ T4353] usb 2-1: GET_CAPABILITIES returned 0 [ 819.539092][ T4353] usbtmc 2-1:16.0: can't read capabilities [ 819.546883][T11671] UDC core: g1: couldn't find an available UDC or it's busy [ 819.766855][T11652] usb 2-1: usbtmc_ioctl_clear_in_halt returned -32 [ 819.797792][ T4353] usb 2-1: USB disconnect, device number 17 [ 820.585946][T11696] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 820.605559][T11696] udc usbip-vudc.0: failed to start g1: -19 [ 820.623770][T11696] UDC core: g1: couldn't find an available UDC or it's busy [ 820.998262][T11709] loop3: detected capacity change from 0 to 512 [ 821.060538][T11709] EXT4-fs (loop3): can't mount with both data=journal and delalloc [ 821.339141][T11714] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 821.359726][T11714] udc usbip-vudc.0: failed to start g1: -19 [ 821.382149][T11714] UDC core: g1: couldn't find an available UDC or it's busy [ 821.740501][T11732] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 821.786177][T11732] udc usbip-vudc.0: failed to start g1: -19 [ 821.808589][T11732] UDC core: g1: couldn't find an available UDC or it's busy [ 822.330680][T11753] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 822.362231][T11753] udc usbip-vudc.0: failed to start g1: -19 [ 822.392860][T11753] UDC core: g1: couldn't find an available UDC or it's busy [ 823.162226][T11765] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1652'. [ 823.639483][T11774] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 823.681849][T11774] udc usbip-vudc.0: failed to start g1: -19 [ 823.726033][T11774] UDC core: g1: couldn't find an available UDC or it's busy [ 823.871461][T11545] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 824.112217][T11545] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 824.142879][T11545] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 824.187138][T11545] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 824.217786][T11545] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 824.259888][T11545] usb 4-1: SerialNumber: syz [ 824.531242][T11545] usb 4-1: 0:2 : does not exist [ 824.565018][ T4353] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 824.595243][T11545] usb 4-1: USB disconnect, device number 3 [ 824.652890][ T7686] udevd[7686]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 824.788110][ T4353] usb 2-1: config 0 has no interfaces? [ 824.801297][ T4353] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 824.840127][ T4353] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 824.869560][ T4353] usb 2-1: config 0 descriptor?? [ 825.104231][ T4353] usb 2-1: USB disconnect, device number 18 [ 826.491292][T11830] loop7: detected capacity change from 0 to 512 [ 826.579950][T11830] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 826.704750][T11830] EXT4-fs warning (device loop7): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 826.737220][T11841] loop3: detected capacity change from 0 to 16 [ 826.770932][T11830] EXT4-fs (loop7): 1 truncate cleaned up [ 826.820525][T11830] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 826.856316][T11841] erofs: (device loop3): mounted with root inode @ nid 36. [ 826.935427][ T26] audit: type=1800 audit(1786340568.898:142): pid=11830 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1684" name="file2" dev="loop7" ino=16 res=0 errno=0 [ 826.980782][T11841] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 827.077614][T11841] syz.3.1687: attempt to access beyond end of device [ 827.077614][T11841] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 827.208110][T11841] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 827.249249][ T7332] EXT4-fs (loop7): unmounting filesystem. [ 827.308239][T11841] syz.3.1687: attempt to access beyond end of device [ 827.308239][T11841] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 827.383774][T11841] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -4082 in[4096, 0] out[8192] [ 827.459265][ T26] audit: type=1800 audit(1786340569.387:143): pid=11841 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1687" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 828.862835][T11885] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1688'. [ 828.974597][T11890] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 829.028542][T11890] udc usbip-vudc.0: failed to start g1: -19 [ 829.050852][T11890] UDC core: g1: couldn't find an available UDC or it's busy [ 829.523063][T11904] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1697'. [ 829.914001][T11911] loop3: detected capacity change from 0 to 512 [ 829.992738][T11911] EXT4-fs error (device loop3): ext4_orphan_get:1405: inode #15: comm syz.3.1702: inode has both inline data and extents flags [ 830.734306][T11911] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.1702: couldn't read orphan inode 15 (err -117) [ 830.796636][T11911] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 830.853204][T11911] fscrypt (loop3, inode 18): Unsupported encryption flags (0xae) [ 830.991167][T10855] EXT4-fs (loop3): unmounting filesystem. [ 832.878590][T11953] netlink: 8 bytes leftover after parsing attributes in process `syz.9.1713'. [ 833.934798][T11966] netlink: 'syz.1.1720': attribute type 10 has an invalid length. [ 834.070987][T11966] team0: Port device dummy0 added [ 834.120622][T11933] loop7: detected capacity change from 0 to 32768 [ 834.265039][T11933] ERROR: (device loop7): diAllocAG: numfree > numinos [ 834.265039][T11933] [ 834.298170][T11973] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1711'. [ 834.330693][T11933] ERROR: (device loop7): remounting filesystem as read-only [ 834.338184][T11933] ialloc: diAlloc returned -5! [ 834.370389][T11933] ERROR: (device loop7): diAllocAG: numfree > numinos [ 834.370389][T11933] [ 834.431487][T11933] ERROR: (device loop7): remounting filesystem as read-only [ 834.503604][T11933] ialloc: diAlloc returned -5! [ 834.740327][T11978] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1723'. [ 835.568627][T12004] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1730'. [ 836.570218][T12013] kvm [12012]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0xfe7 [ 838.334507][T11547] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 838.603366][T11547] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 838.641337][T11547] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.665145][T11547] usb 6-1: Product: syz [ 838.669404][T11547] usb 6-1: Manufacturer: syz [ 838.693139][T11547] usb 6-1: SerialNumber: syz [ 839.011917][T11547] rtl8150 6-1:1.0: couldn't reset the device [ 839.039699][T11547] rtl8150: probe of 6-1:1.0 failed with error -5 [ 839.120732][T11547] usb 6-1: USB disconnect, device number 14 [ 839.706272][T12093] device macvlan0 entered promiscuous mode [ 839.751340][T12093] netlink: 'syz.9.1753': attribute type 1 has an invalid length. [ 839.782157][T12093] netlink: 'syz.9.1753': attribute type 2 has an invalid length. [ 839.808482][T12094] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 839.853155][T12094] bridge0: port 1(bridge_slave_0) entered disabled state [ 840.017825][T12103] loop9: detected capacity change from 0 to 64 [ 840.304329][T12108] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1752'. [ 841.718588][T12131] loop7: detected capacity change from 0 to 512 [ 841.961835][T12131] EXT4-fs (loop7): mounting ext2 file system using the ext4 subsystem [ 842.625045][T12131] EXT4-fs (loop7): failed to open journal device unknown-block(0,0) -6 [ 842.859328][ T4622] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 843.044649][T12134] loop3: detected capacity change from 0 to 40427 [ 843.065038][ T4622] usb 10-1: Using ep0 maxpacket: 16 [ 843.083047][ T4622] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 843.086337][T12134] F2FS-fs (loop3): Insane cp_payload (553648128 >= 504) [ 843.133704][T12134] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 843.170419][ T4622] usb 10-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.00 [ 843.195839][T12134] F2FS-fs (loop3): invalid crc value [ 843.222432][ T4622] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.249285][T12134] F2FS-fs (loop3): Found nat_bits in checkpoint [ 843.280529][ T4622] usb 10-1: config 0 descriptor?? [ 843.298995][T12147] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 843.528969][T12134] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 843.557632][T12134] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 843.810282][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.832136][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.849460][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.872745][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.899883][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.922149][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.940293][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 843.957925][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 844.827794][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 844.835251][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 844.842224][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 844.849637][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 844.856943][ T4622] apple 0003:05AC:025B.0006: unknown main item tag 0x0 [ 844.864744][ T4622] apple 0003:05AC:025B.0006: unexpected long global item [ 844.872398][ T4622] apple 0003:05AC:025B.0006: parse failed [ 844.878961][ T4622] apple: probe of 0003:05AC:025B.0006 failed with error -22 [ 844.895468][ T4622] usb 10-1: USB disconnect, device number 4 [ 844.938926][T10855] syz-executor: attempt to access beyond end of device [ 844.938926][T10855] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 845.614105][T12201] loop9: detected capacity change from 0 to 512 [ 845.727714][T12201] EXT4-fs error (device loop9): ext4_xattr_inode_iget:401: comm syz.9.1782: inode #1: comm syz.9.1782: iget: illegal inode # [ 845.750099][T12201] EXT4-fs error (device loop9): ext4_xattr_inode_iget:406: comm syz.9.1782: error while reading EA inode 1 err=-117 [ 845.792586][T12201] EXT4-fs error (device loop9): ext4_xattr_inode_iget:401: comm syz.9.1782: inode #1: comm syz.9.1782: iget: illegal inode # [ 845.870738][T12201] EXT4-fs error (device loop9): ext4_xattr_inode_iget:406: comm syz.9.1782: error while reading EA inode 1 err=-117 [ 845.917121][T12201] EXT4-fs (loop9): 1 orphan inode deleted [ 845.922969][T12201] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 846.015971][T12201] EXT4-fs error (device loop9): ext4_free_branches:1030: inode #13: comm syz.9.1782: invalid indirect mapped block 234881024 (level 0) [ 846.224198][T10331] EXT4-fs (loop9): unmounting filesystem. [ 846.424496][T12222] Mass Storage Function, version: 2009/09/11 [ 846.445494][T12222] LUN: removable file: (no medium) [ 846.652498][T12226] Mass Storage Function, version: 2009/09/11 [ 846.658609][T12226] LUN: removable file: (no medium) [ 847.112715][T12245] loop9: detected capacity change from 0 to 512 [ 847.212347][T12245] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 847.302758][T12245] EXT4-fs (loop9): 1 truncate cleaned up [ 847.340198][T12245] EXT4-fs (loop9): mounted filesystem without journal. Quota mode: none. [ 847.420200][T11547] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 847.434660][T12245] EXT4-fs (loop9): shut down requested (2) [ 847.474659][T10331] EXT4-fs (loop9): unmounting filesystem. [ 847.628477][T11547] usb 2-1: Using ep0 maxpacket: 32 [ 847.640674][T11547] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 847.695377][T11547] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 847.749775][T11547] usb 2-1: config 0 descriptor?? [ 848.010550][T11547] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 848.039113][T11547] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 848.060525][T11547] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 848.074808][T11547] usb 2-1: media controller created [ 848.119496][T11547] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 848.225257][T12266] loop3: detected capacity change from 0 to 4096 [ 848.236373][T11547] az6027: usb out operation failed. (-71) [ 848.256369][T11547] az6027: usb out operation failed. (-71) [ 848.262246][T11547] stb0899_attach: Driver disabled by Kconfig [ 848.295444][T11547] az6027: no front-end attached [ 848.295444][T11547] [ 848.342978][T12272] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 848.366126][T11547] az6027: usb out operation failed. (-71) [ 848.371945][T11547] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 848.421055][ T26] audit: type=1800 audit(1786340588.726:144): pid=12266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1801" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 848.485024][T11547] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input26 [ 848.497955][T11547] dvb-usb: schedule remote query interval to 400 msecs. [ 848.504994][T11547] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 848.551461][T11547] usb 2-1: USB disconnect, device number 19 [ 848.582152][ T26] audit: type=1804 audit(1786340588.772:145): pid=12266 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1801" name="/newroot/47/file0/file1" dev="loop3" ino=15 res=1 errno=0 [ 848.650946][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 848.657437][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 848.695494][T11547] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 849.026091][T11549] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 849.234745][T11549] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 849.253539][T11549] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.323387][T11549] pvrusb2: Hardware description: Terratec Grabster AV400 [ 849.360124][T11549] pvrusb2: ********** [ 849.381093][T11549] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 849.435308][T11549] pvrusb2: Important functionality might not be entirely working. [ 849.464028][T11549] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 849.494082][T12292] zero sized request [ 849.518190][T11549] pvrusb2: ********** [ 849.559957][ T2312] pvrusb2: Invalid write control endpoint [ 849.571734][T12269] loop9: detected capacity change from 0 to 40427 [ 849.704929][T12269] F2FS-fs (loop9): Found nat_bits in checkpoint [ 849.833866][T11549] usb 6-1: USB disconnect, device number 15 [ 849.939561][T12303] loop7: detected capacity change from 0 to 256 [ 849.959135][T12269] F2FS-fs (loop9): Mounted with checkpoint version = 48b305e5 [ 850.039311][T12303] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 850.133499][ T2312] pvrusb2: Invalid write control endpoint [ 850.158412][ T2312] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 850.213326][ T2312] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 850.250670][ T2312] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 850.288960][ T2312] pvrusb2: Device being rendered inoperable [ 850.363324][ T2312] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 850.407757][ T2312] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 850.619426][ T2312] pvrusb2: Attached sub-driver cx25840 [ 850.625833][ T2312] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 850.704313][ T2312] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 850.779889][T12314] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1813'. [ 850.799014][T12317] loop7: detected capacity change from 0 to 64 [ 850.822729][ T26] audit: type=1800 audit(1786340590.931:146): pid=12318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.1814" name="p_srate" dev="configfs" ino=65743 res=0 errno=0 [ 851.247653][ T8996] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 851.543813][ T8996] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 851.560665][ T8996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 851.581363][ T8996] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 851.592385][ T8996] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 851.637695][ T8996] usb 4-1: Manufacturer: syz [ 851.680492][ T8996] usb 4-1: config 0 descriptor?? [ 851.919631][ T14] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 851.953075][T12341] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1824'. [ 852.145647][ T14] usb 6-1: Using ep0 maxpacket: 32 [ 852.156859][ T14] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 852.222900][ T8996] rc_core: IR keymap rc-hauppauge not found [ 852.228890][ T8996] Registered IR keymap rc-empty [ 852.257918][ T14] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.266098][ T14] usb 6-1: Product: syz [ 852.289070][ T8996] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 852.342137][ T14] usb 6-1: Manufacturer: syz [ 852.353415][ T8996] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input27 [ 852.395102][ T14] usb 6-1: SerialNumber: syz [ 852.485184][ T14] usb 6-1: config 0 descriptor?? [ 852.503057][ T14] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 852.585075][ C0] igorplugusb 4-1:0.0: receive overflow invalid: 163 [ 852.618526][T12328] loop9: detected capacity change from 0 to 32768 [ 852.636621][T12328] BTRFS error: device /dev/loop9 already registered with a higher generation, found 8 expect 9 [ 852.730348][T12338] loop7: detected capacity change from 0 to 131072 [ 852.749355][T12338] F2FS-fs (loop7): Test dummy encryption mode enabled [ 852.757662][T12338] F2FS-fs (loop7): invalid crc value [ 852.822135][ T8996] usb 4-1: USB disconnect, device number 4 [ 852.825285][T12338] F2FS-fs (loop7): Found nat_bits in checkpoint [ 852.895010][T12338] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 853.232728][ T8860] BTRFS error: device /dev/loop9 already registered with a higher generation, found 8 expect 9 [ 853.383893][ T14] gspca_ov534_9: reg_w failed -71 [ 854.715602][ T14] gspca_ov534_9: Unknown sensor 0000 [ 854.715682][ T14] ov534_9: probe of 6-1:0.0 failed with error -22 [ 854.738124][ T14] usb 6-1: USB disconnect, device number 16 [ 855.090930][T12382] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1833'. [ 855.919366][T12396] loop3: detected capacity change from 0 to 512 [ 856.560318][T12414] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 856.589785][T12414] ================================================================== [ 856.597931][T12414] BUG: KASAN: double-free in __kmem_cache_free+0xb6/0x200 [ 856.605219][T12414] Free of addr ffff8880567ff360 by task syz.9.1843/12414 [ 856.612293][T12414] [ 856.614693][T12414] CPU: 1 PID: 12414 Comm: syz.9.1843 Not tainted syzkaller #0 [ 856.622191][T12414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 856.632325][T12414] Call Trace: [ 856.635696][T12414] [ 856.638864][T12414] dump_stack_lvl+0x188/0x24e [ 856.643701][T12414] ? __lock_acquire+0x7c40/0x7c40 [ 856.648828][T12414] ? show_regs_print_info+0x12/0x12 [ 856.654099][T12414] ? load_image+0x410/0x410 [ 856.658687][T12414] ? __virt_addr_valid+0x467/0x540 [ 856.663887][T12414] print_report+0xa8/0x210 [ 856.668342][T12414] ? __kmem_cache_free+0xb6/0x200 [ 856.673436][T12414] kasan_report_invalid_free+0xdd/0x100 [ 856.679046][T12414] ? __kmem_cache_free+0xb6/0x200 [ 856.684135][T12414] ? __kmem_cache_free+0xb6/0x200 [ 856.689187][T12414] ____kasan_slab_free+0x149/0x1f0 [ 856.694371][T12414] slab_free_freelist_hook+0x133/0x1b0 [ 856.699873][T12414] ? rcu_is_watching+0x11/0xa0 [ 856.704816][T12414] ? ncm_unbind+0x7e/0x330 [ 856.709492][T12414] __kmem_cache_free+0xb6/0x200 [ 856.714388][T12414] ncm_unbind+0x7e/0x330 [ 856.718670][T12414] purge_configs_funcs+0x241/0x3a0 [ 856.723885][T12414] configfs_composite_bind+0xc78/0xf60 [ 856.729389][T12414] ? os_desc_qw_sign_store+0x100/0x100 [ 856.734886][T12414] gadget_bind_driver+0x2af/0x760 [ 856.739957][T12414] ? gadget_match_driver+0x130/0x130 [ 856.745282][T12414] really_probe+0x24a/0xb40 [ 856.749917][T12414] ? pm_runtime_barrier+0x147/0x1c0 [ 856.755240][T12414] __driver_probe_device+0x1f5/0x390 [ 856.760564][T12414] driver_probe_device+0x4f/0x420 [ 856.765624][T12414] __driver_attach+0x43d/0x6c0 [ 856.770420][T12414] ? driver_attach+0x40/0x40 [ 856.775042][T12414] bus_for_each_dev+0x182/0x1f0 [ 856.779929][T12414] ? __lock_acquire+0x7c40/0x7c40 [ 856.784997][T12414] ? bus_remove_file+0xd0/0xd0 [ 856.789799][T12414] ? do_raw_spin_unlock+0x11d/0x230 [ 856.795035][T12414] bus_add_driver+0x324/0x5d0 [ 856.799755][T12414] driver_register+0x32d/0x430 [ 856.804549][T12414] usb_gadget_register_driver_owner+0xf5/0x260 [ 856.810752][T12414] gadget_dev_desc_UDC_store+0x1c3/0x2e0 [ 856.816464][T12414] configfs_write_iter+0x30b/0x400 [ 856.821656][T12414] ? gadget_dev_desc_UDC_show+0x80/0x80 [ 856.827238][T12414] vfs_write+0x482/0x9a0 [ 856.831634][T12414] ? file_end_write+0x250/0x250 [ 856.836562][T12414] ? __fget_files+0x3fc/0x460 [ 856.841323][T12414] ? __fdget_pos+0x2ae/0x360 [ 856.845954][T12414] ? ksys_write+0x70/0x260 [ 856.850412][T12414] ksys_write+0x14d/0x260 [ 856.854788][T12414] ? __ia32_sys_read+0x80/0x80 [ 856.859587][T12414] ? lockdep_hardirqs_on+0x94/0x140 [ 856.864820][T12414] do_syscall_64+0x4c/0xa0 [ 856.869311][T12414] ? clear_bhb_loop+0x60/0xb0 [ 856.874143][T12414] ? clear_bhb_loop+0x60/0xb0 [ 856.878869][T12414] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 856.884834][T12414] RIP: 0033:0x7fb89f99e019 [ 856.889345][T12414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 856.909031][T12414] RSP: 002b:00007fb8a0878028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 856.917562][T12414] RAX: ffffffffffffffda RBX: 00007fb89fc25fa0 RCX: 00007fb89f99e019 [ 856.925573][T12414] RDX: 000000000000000c RSI: 0000200000002100 RDI: 0000000000000003 [ 856.933619][T12414] RBP: 00007fb89fa3500c R08: 0000000000000000 R09: 0000000000000000 [ 856.941625][T12414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 856.949630][T12414] R13: 00007fb89fc26038 R14: 00007fb89fc25fa0 R15: 00007ffc40804c58 [ 856.957637][T12414] [ 856.960682][T12414] [ 856.963026][T12414] Allocated by task 4275: [ 856.967455][T12414] kasan_set_track+0x4b/0x70 [ 856.972088][T12414] __kasan_kmalloc+0x8e/0xa0 [ 856.976708][T12414] __kmalloc_node+0xb2/0x240 [ 856.981425][T12414] kvmalloc_node+0x6c/0x180 [ 856.986022][T12414] xt_replace_table+0x176/0x790 [ 856.991006][T12414] __do_replace+0x16a/0x980 [ 856.995627][T12414] do_ip6t_set_ctl+0xb3d/0xe10 [ 857.000435][T12414] nf_setsockopt+0x25f/0x280 [ 857.005124][T12414] __sys_setsockopt+0x2bf/0x3d0 [ 857.010137][T12414] __x64_sys_setsockopt+0xb1/0xc0 [ 857.015204][T12414] do_syscall_64+0x4c/0xa0 [ 857.019653][T12414] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 857.025584][T12414] [ 857.027943][T12414] Freed by task 4275: [ 857.031947][T12414] kasan_set_track+0x4b/0x70 [ 857.036574][T12414] kasan_save_free_info+0x27/0x40 [ 857.041685][T12414] ____kasan_slab_free+0x126/0x1f0 [ 857.046852][T12414] slab_free_freelist_hook+0x133/0x1b0 [ 857.052358][T12414] __kmem_cache_free+0xb6/0x200 [ 857.057243][T12414] xt_free_table_info+0x67/0x160 [ 857.062243][T12414] __do_replace+0x7e2/0x980 [ 857.066824][T12414] do_ip6t_set_ctl+0xb3d/0xe10 [ 857.071628][T12414] nf_setsockopt+0x25f/0x280 [ 857.076289][T12414] __sys_setsockopt+0x2bf/0x3d0 [ 857.081180][T12414] __x64_sys_setsockopt+0xb1/0xc0 [ 857.086244][T12414] do_syscall_64+0x4c/0xa0 [ 857.090708][T12414] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 857.096664][T12414] [ 857.099015][T12414] The buggy address belongs to the object at ffff8880567ff360 [ 857.099015][T12414] which belongs to the cache kmalloc-16 of size 16 [ 857.113006][T12414] The buggy address is located 0 bytes inside of [ 857.113006][T12414] 16-byte region [ffff8880567ff360, ffff8880567ff370) [ 857.126056][T12414] [ 857.128433][T12414] The buggy address belongs to the physical page: [ 857.134884][T12414] page:ffffea000159ffc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x567ff [ 857.145070][T12414] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 857.152693][T12414] raw: 00fff00000000200 0000000000000000 dead000000000001 ffff8880174413c0 [ 857.161318][T12414] raw: 0000000000000000 0000000000800080 00000001ffffffff 0000000000000000 [ 857.169928][T12414] page dumped because: kasan: bad access detected [ 857.176371][T12414] page_owner tracks the page as allocated [ 857.182110][T12414] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4276, tgid 4276 (syz-executor), ts 132644268783, free_ts 132624325343 [ 857.200557][T12414] post_alloc_hook+0x173/0x1a0 [ 857.205498][T12414] get_page_from_freelist+0x206b/0x2180 [ 857.211086][T12414] __alloc_pages+0x1ec/0x4f0 [ 857.215724][T12414] alloc_slab_page+0x4f/0x180 [ 857.220440][T12414] new_slab+0x87/0x2d0 [ 857.224546][T12414] ___slab_alloc+0xbc5/0x1240 [ 857.229261][T12414] __kmem_cache_alloc_node+0x126/0x270 [ 857.234791][T12414] __kmalloc_node+0xa2/0x240 [ 857.239427][T12414] kvmalloc_node+0x6c/0x180 [ 857.244143][T12414] xt_replace_table+0x176/0x790 [ 857.249060][T12414] __do_replace+0x16a/0x980 [ 857.253602][T12414] do_ip6t_set_ctl+0xb3d/0xe10 [ 857.258406][T12414] nf_setsockopt+0x25f/0x280 [ 857.263037][T12414] __sys_setsockopt+0x2bf/0x3d0 [ 857.267954][T12414] __x64_sys_setsockopt+0xb1/0xc0 [ 857.273014][T12414] do_syscall_64+0x4c/0xa0 [ 857.277506][T12414] page last free stack trace: [ 857.282493][T12414] free_unref_page_prepare+0x8e5/0x9e0 [ 857.288009][T12414] free_unref_page_list+0xbb/0x8e0 [ 857.293188][T12414] release_pages+0x20d1/0x2340 [ 857.298077][T12414] tlb_flush_mmu+0x105/0x220 [ 857.302767][T12414] tlb_finish_mmu+0xf0/0x220 [ 857.307394][T12414] exit_mmap+0x388/0x970 [ 857.311673][T12414] __mmput+0x118/0x3a0 [ 857.315848][T12414] exec_mmap+0x4bc/0x580 [ 857.320174][T12414] begin_new_exec+0xaa5/0x1f40 [ 857.324976][T12414] load_elf_binary+0x9e7/0x2820 [ 857.329950][T12414] bprm_execve+0xaf7/0x17e0 [ 857.334492][T12414] do_execveat_common+0x501/0x6b0 [ 857.339559][T12414] __x64_sys_execve+0x8e/0xa0 [ 857.344272][T12414] do_syscall_64+0x4c/0xa0 [ 857.348783][T12414] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 857.354734][T12414] [ 857.357079][T12414] Memory state around the buggy address: [ 857.362733][T12414] ffff8880567ff200: 00 00 fc fc fa fb fc fc fa fb fc fc 00 00 fc fc [ 857.370824][T12414] ffff8880567ff280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 857.378958][T12414] >ffff8880567ff300: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 857.387049][T12414] ^ [ 857.394369][T12414] ffff8880567ff380: 00 00 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 857.402460][T12414] ffff8880567ff400: 00 03 fc fc fa fb fc fc 00 06 fc fc fa fb fc fc [ 857.410551][T12414] ================================================================== [ 857.430026][T12399] net_ratelimit: 10 callbacks suppressed [ 857.430046][T12399] sctp: failed to load transform for md5: -2 [ 858.492793][T12414] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 858.500080][T12414] CPU: 0 PID: 12414 Comm: syz.9.1843 Not tainted syzkaller #0 [ 858.507659][T12414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 858.517745][T12414] Call Trace: [ 858.521053][T12414] [ 858.524031][T12414] dump_stack_lvl+0x188/0x24e [ 858.528760][T12414] ? memcpy+0x3c/0x60 [ 858.532867][T12414] ? show_regs_print_info+0x12/0x12 [ 858.538104][T12414] ? load_image+0x410/0x410 [ 858.542687][T12414] panic+0x2d3/0x710 [ 858.546623][T12414] ? bpf_jit_dump+0xd0/0xd0 [ 858.551167][T12414] ? __kmem_cache_free+0xb6/0x200 [ 858.556466][T12414] ? check_panic_on_warn+0x6c/0xa0 [ 858.561624][T12414] ? __kmem_cache_free+0xb6/0x200 [ 858.566818][T12414] check_panic_on_warn+0x80/0xa0 [ 858.571823][T12414] ? __kmem_cache_free+0xb6/0x200 [ 858.576914][T12414] end_report+0x66/0x110 [ 858.581204][T12414] kasan_report_invalid_free+0xe8/0x100 [ 858.586800][T12414] ? __kmem_cache_free+0xb6/0x200 [ 858.591861][T12414] ? __kmem_cache_free+0xb6/0x200 [ 858.596921][T12414] ____kasan_slab_free+0x149/0x1f0 [ 858.602079][T12414] slab_free_freelist_hook+0x133/0x1b0 [ 858.607576][T12414] ? rcu_is_watching+0x11/0xa0 [ 858.612382][T12414] ? ncm_unbind+0x7e/0x330 [ 858.616836][T12414] __kmem_cache_free+0xb6/0x200 [ 858.621729][T12414] ncm_unbind+0x7e/0x330 [ 858.626022][T12414] purge_configs_funcs+0x241/0x3a0 [ 858.631383][T12414] configfs_composite_bind+0xc78/0xf60 [ 858.636886][T12414] ? os_desc_qw_sign_store+0x100/0x100 [ 858.642416][T12414] gadget_bind_driver+0x2af/0x760 [ 858.647490][T12414] ? gadget_match_driver+0x130/0x130 [ 858.652808][T12414] really_probe+0x24a/0xb40 [ 858.657348][T12414] ? pm_runtime_barrier+0x147/0x1c0 [ 858.662582][T12414] __driver_probe_device+0x1f5/0x390 [ 858.667904][T12414] driver_probe_device+0x4f/0x420 [ 858.672963][T12414] __driver_attach+0x43d/0x6c0 [ 858.677763][T12414] ? driver_attach+0x40/0x40 [ 858.682387][T12414] bus_for_each_dev+0x182/0x1f0 [ 858.687286][T12414] ? __lock_acquire+0x7c40/0x7c40 [ 858.692402][T12414] ? bus_remove_file+0xd0/0xd0 [ 858.697205][T12414] ? do_raw_spin_unlock+0x11d/0x230 [ 858.702449][T12414] bus_add_driver+0x324/0x5d0 [ 858.707164][T12414] driver_register+0x32d/0x430 [ 858.711974][T12414] usb_gadget_register_driver_owner+0xf5/0x260 [ 858.718170][T12414] gadget_dev_desc_UDC_store+0x1c3/0x2e0 [ 858.723833][T12414] configfs_write_iter+0x30b/0x400 [ 858.729011][T12414] ? gadget_dev_desc_UDC_show+0x80/0x80 [ 858.734600][T12414] vfs_write+0x482/0x9a0 [ 858.738887][T12414] ? file_end_write+0x250/0x250 [ 858.743781][T12414] ? __fget_files+0x3fc/0x460 [ 858.748498][T12414] ? __fdget_pos+0x2ae/0x360 [ 858.753130][T12414] ? ksys_write+0x70/0x260 [ 858.757592][T12414] ksys_write+0x14d/0x260 [ 858.761957][T12414] ? __ia32_sys_read+0x80/0x80 [ 858.766757][T12414] ? lockdep_hardirqs_on+0x94/0x140 [ 858.771988][T12414] do_syscall_64+0x4c/0xa0 [ 858.776449][T12414] ? clear_bhb_loop+0x60/0xb0 [ 858.781162][T12414] ? clear_bhb_loop+0x60/0xb0 [ 858.785903][T12414] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 858.791828][T12414] RIP: 0033:0x7fb89f99e019 [ 858.796275][T12414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 858.815913][T12414] RSP: 002b:00007fb8a0878028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 858.824358][T12414] RAX: ffffffffffffffda RBX: 00007fb89fc25fa0 RCX: 00007fb89f99e019 [ 858.832399][T12414] RDX: 000000000000000c RSI: 0000200000002100 RDI: 0000000000000003 [ 858.840409][T12414] RBP: 00007fb89fa3500c R08: 0000000000000000 R09: 0000000000000000 [ 858.848409][T12414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 858.856416][T12414] R13: 00007fb89fc26038 R14: 00007fb89fc25fa0 R15: 00007ffc40804c58 [ 858.864461][T12414] [ 858.867687][T12414] Kernel Offset: disabled [ 858.872033][T12414] Rebooting in 86400 seconds..