BUG: kernel NULL pointer dereference, address: 0000000000000010
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 800000016b558067 P4D 800000016b558067 PUD 0 
Oops: Oops: 0000 [#1] SMP PTI
CPU: 1 UID: 0 PID: 3187 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:exfat_convert_ucs2_to_char fs/exfat/nls.c:441 [inline]
RIP: 0010:__exfat_utf16_to_nls fs/exfat/nls.c:554 [inline]
RIP: 0010:exfat_utf16_to_nls+0xcf/0x230 fs/exfat/nls.c:638
Code: 00 00 31 f6 81 fa 00 dc 00 00 40 0f 94 c6 4c 0f 44 e1 41 01 f5 eb 35 c6 44 24 08 00 66 83 ff 7f 77 04 89 f8 eb 26 48 8b 04 24 <4c> 8b 58 10 48 8d 74 24 08 ba 06 00 00 00 2e e8 d5 93 8a 1e 85 c0
RSP: 0018:ffffc90001db7b00 EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff888103a89004 RCX: 0000000000000001
RDX: 0000000000000004 RSI: ffffc90001db7bc0 RDI: 00000000000000e1
RBP: 00000000000005ff R08: 0000000000000000 R09: ffff88817c1ba000
R10: 0000000000000100 R11: 0000000000000000 R12: ffffc90001db7bc8
R13: 0000000000000004 R14: 0000000000000004 R15: 0000000000000600
FS:  0000555573a19500(0000) GS:ffff8882b37b9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 0000000102740000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 exfat_readdir fs/exfat/dir.c:143 [inline]
 exfat_iterate+0x69c/0x8f0 fs/exfat/dir.c:243
 wrap_directory_iterator+0x4a/0x70 fs/readdir.c:65
 iterate_dir+0xd8/0x140 fs/readdir.c:108
 __do_sys_getdents64 fs/readdir.c:410 [inline]
 __se_sys_getdents64+0x69/0x100 fs/readdir.c:396
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x8f/0x250 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5fa0dc1833
Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 32 3d f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8
RSP: 002b:00007ffc9ba81438 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 0000555573a344e0 RCX: 00007f5fa0dc1833
RDX: 0000000000008000 RSI: 0000555573a344e0 RDI: 0000000000000005
RBP: 0000555573a344b4 R08: 0000000000028b61 R09: 0000000000000000
R10: 00007f5fa0fb7cc0 R11: 0000000000000293 R12: ffffffffffffffa8
R13: 0000000000000010 R14: 0000555573a344b0 R15: 00007ffc9ba836f0
 </TASK>
Modules linked in:
CR2: 0000000000000010
---[ end trace 0000000000000000 ]---
RIP: 0010:exfat_convert_ucs2_to_char fs/exfat/nls.c:441 [inline]
RIP: 0010:__exfat_utf16_to_nls fs/exfat/nls.c:554 [inline]
RIP: 0010:exfat_utf16_to_nls+0xcf/0x230 fs/exfat/nls.c:638
Code: 00 00 31 f6 81 fa 00 dc 00 00 40 0f 94 c6 4c 0f 44 e1 41 01 f5 eb 35 c6 44 24 08 00 66 83 ff 7f 77 04 89 f8 eb 26 48 8b 04 24 <4c> 8b 58 10 48 8d 74 24 08 ba 06 00 00 00 2e e8 d5 93 8a 1e 85 c0
RSP: 0018:ffffc90001db7b00 EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff888103a89004 RCX: 0000000000000001
RDX: 0000000000000004 RSI: ffffc90001db7bc0 RDI: 00000000000000e1
RBP: 00000000000005ff R08: 0000000000000000 R09: ffff88817c1ba000
R10: 0000000000000100 R11: 0000000000000000 R12: ffffc90001db7bc8
R13: 0000000000000004 R14: 0000000000000004 R15: 0000000000000600
FS:  0000555573a19500(0000) GS:ffff8882b37b9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 0000000102740000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	31 f6                	xor    %esi,%esi
   4:	81 fa 00 dc 00 00    	cmp    $0xdc00,%edx
   a:	40 0f 94 c6          	sete   %sil
   e:	4c 0f 44 e1          	cmove  %rcx,%r12
  12:	41 01 f5             	add    %esi,%r13d
  15:	eb 35                	jmp    0x4c
  17:	c6 44 24 08 00       	movb   $0x0,0x8(%rsp)
  1c:	66 83 ff 7f          	cmp    $0x7f,%di
  20:	77 04                	ja     0x26
  22:	89 f8                	mov    %edi,%eax
  24:	eb 26                	jmp    0x4c
  26:	48 8b 04 24          	mov    (%rsp),%rax
* 2a:	4c 8b 58 10          	mov    0x10(%rax),%r11 <-- trapping instruction
  2e:	48 8d 74 24 08       	lea    0x8(%rsp),%rsi
  33:	ba 06 00 00 00       	mov    $0x6,%edx
  38:	2e e8 d5 93 8a 1e    	cs call 0x1e8a9413
  3e:	85 c0                	test   %eax,%eax