# https://syzkaller.appspot.com/bug?id=5b9f20bfdfb67155f627c5e13c258ca56eff026a
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":1,"sandbox":"","fault_call":-1,"waitrepeat":true}
r0 = socket$inet6(0xa, 0x1, 0x0)
socketpair$inet(0x1e, 0x1, 0x0, &(0x7f0000000080)={<r1=>0x0, <r2=>0x0})
recvmsg(r2, &(0x7f0000000340)={&(0x7f0000000000)=@alg, 0x80, &(0x7f0000000200)=[{&(0x7f00000001c0)=""/2, 0x2}], 0xfd, &(0x7f0000000240)=""/253, 0xfd}, 0x0)
r3 = fcntl$dupfd(r1, 0x0, r0)
write(r1, &(0x7f0000000100), 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000180)={0x5, 0x10, 0xfa00, {&(0x7f0000000380)}}, 0x18)
r4 = socket$kcm(0xa, 0x122000000003, 0x11)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x4000, 0x0)
setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f00000000c0)=r4, 0x4)
sendmsg$kcm(r4, &(0x7f0000000140)={&(0x7f0000003840)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000340)=[{&(0x7f00000037c0)="d90d0000768606681d012f629c75adfa4208d5febf524a024aface6a6ac7d846ed2fa163e15ffb5033e9ad60d7a8a295b90bf9cc8578ec03a10c48d40107080a2f858ad2c4aa592d", 0x48}], 0x1}, 0x0)
r5 = socket(0x11, 0x100000803, 0x0)
r6 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x80020000000004)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x5001})
setsockopt$nfc_llcp_NFC_LLCP_MIUX(r5, 0x118, 0x1, &(0x7f0000000000)=0xfffffffffffffff9, 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000100)={"69666230000000000200ac0c59ab3200", 0x801})
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0xffffffffffffffff, 0x10, &(0x7f00000000c0)={0xfffffffffffff801})
ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, &(0x7f0000000240))
write$tun(r6, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x1)
r7 = socket$inet(0x2, 0x6, 0x0)
setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x1)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x0, 0xa}, 0x90)
setsockopt(r7, 0x0, 0x40, &(0x7f0000000000), 0x0)
fcntl$getownex(r7, 0x10, &(0x7f00000000c0)={0x0, <r8=>0x0})
wait4(r8, &(0x7f0000000100), 0x2100000a, 0x0)
r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x4000, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f0000002940)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000000140)=0x99)
setsockopt$inet6_IPV6_PKTINFO(r9, 0x29, 0x32, &(0x7f0000002a80)={@mcast2={0xff, 0x2, [], 0x1}, r10}, 0x14)
r11 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_tables_names\x00')
pipe2(&(0x7f0000000080), 0x800)
ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r11, 0x40045730, &(0x7f00000000c0)=0x2dbe)
pread64(r11, &(0x7f0000000040)=""/12, 0x2e4, 0x3)
r12 = socket$inet6(0xa, 0x1, 0x0)
socketpair$inet(0x1e, 0x1, 0x0, &(0x7f0000000080)={<r13=>0x0, <r14=>0x0})
recvmsg(r14, &(0x7f0000000340)={&(0x7f0000000000)=@alg, 0x80, &(0x7f0000000200)=[{&(0x7f00000001c0)=""/2, 0x2}], 0x5b, &(0x7f0000000240)=""/253, 0xfd}, 0x0)
r15 = fcntl$dupfd(r13, 0x0, r12)
write(r13, &(0x7f0000000100), 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r15, &(0x7f0000000180)={0x5, 0x10, 0xfa00, {&(0x7f0000000380)}}, 0x18)
r16 = socket$inet6_udp(0xa, 0x2, 0x0)
r17 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r17, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r16, {0x2, 0x0, @multicast2=0xe0000002}, 0x4}}, 0x2e)
r18 = accept(r16, &(0x7f0000000000)=@nfc_llcp, &(0x7f0000000080)=0x80)
ioctl$sock_bt(r18, 0x8906, &(0x7f00000000c0))
r19 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000017c0)='/dev/snapshot\x00', 0x4040, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r19, 0x29, 0x40, &(0x7f0000001840)=@raw={'raw\x00', 0x9, 0x3, 0x310, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x240, 0xffffffff, 0xffffffff, 0x240, 0xffffffff, 0x3, &(0x7f0000001800), {[{{@ipv6={@loopback={0x0, 0x1}, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], [0xffffff00, 0xffffff00, 0xffffffff, 0xffffffff], 'veth0\x00', 'bridge_slave_1\x00', {0xff}, {0xff}, 0x89, 0x0, 0x1, 0x48}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@srh={0x30, 'srh\x00', 0x0, {0x33, 0xffffffff, 0x6, 0x5, 0x9, 0x2000, 0x400}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x8, 0x99, 0x6}}}, {{@uncond, 0x0, 0xf0, 0x120, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xb}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x9, 0x1}, {0x6, 0x419, 0x9}, 0x20, 0x33315efe}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x370)
r20 = socket$inet(0x2, 0x6, 0x0)
setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x0, 0xa}, 0x90)
ioctl$VHOST_SET_VRING_CALL(r19, 0x4008af21, &(0x7f0000001c00)={0x2, 0xffffffffffffff9c})
ioctl$TUNSETIFF(r19, 0x400454ca, &(0x7f0000001bc0)={'ip6_vti0\x00', 0x5000})
r21 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x28000, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r21, 0x29, 0x40, &(0x7f0000000140)=@nat={'nat\x00', 0x1b, 0x5, 0x1610, 0x12a0, 0x0, 0xffffffff, 0x1168, 0x0, 0x1540, 0x1540, 0xffffffff, 0x1540, 0x1540, 0x5, &(0x7f00000000c0), {[{{@ipv6={@mcast2={0xff, 0x2, [], 0x1}, @mcast1={0xff, 0x1, [], 0x1}, [0x0, 0xffffffff, 0xffffff00, 0xffffffff], [0xff, 0x0, 0xffffffff, 0xffffff00], 'syzkaller1\x00', 'team0\x00', {0xff}, {0xff}, 0x0, 0x3, 0x7, 0x4}, 0x0, 0x1120, 0x1168, 0x0, {}, [@common=@unspec=@cgroup1={0x1030, 'cgroup\x00', 0x1, {0x0, 0x1, 0x0, 0x0, './cgroup/syz1\x00', 0x0, 0x2}}, @common=@icmp6={0x28, 'icmp6\x00', 0x0, {0x0, 0x1000, 0x5}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xb, @ipv4=@multicast1=0xe0000001, @ipv4=@dev={0xac, 0x14, 0x14, 0x1d}, @icmp_id=0x67, @port=0x8001}}}, {{@ipv6={@mcast1={0xff, 0x1, [], 0x1}, @local={0xfe, 0x80, [], 0xaa}, [0xffffffff, 0x0, 0xffffff00, 0xffffffff], [0xff, 0xff000000, 0xffffff00, 0xff000000], 'veth1\x00', 'bcsh0\x00', {}, {0xff}, 0xbb, 0xff97, 0x0, 0x41}, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@icmp6={0x28, 'icmp6\x00', 0x0, {0xf, 0x92, 0x7}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x10, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}, @ipv6, @port=0x4e24, @icmp_id=0x66}}}, {{@uncond, 0x0, 0xc8, 0x110}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x26f58e5056adc978, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, @ipv4=@dev={0xac, 0x14, 0x14, 0xd}, @icmp_id=0x67, @icmp_id=0x64}}}, {{@ipv6={@ipv4={[], [0xff, 0xff]}, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, [0xffffffff, 0xff, 0xffffffff, 0xff], [0xffffffff, 0xff, 0x0, 0xff000000], 'bond_slave_0\x00', 'vcan0\x00', {0xff}, {0xff}, 0x2c, 0x48, 0x6, 0x44}, 0x0, 0x148, 0x190, 0x0, {}, [@common=@inet=@hashlimit1={0x58, 'hashlimit\x00', 0x1, {'\x00', {0x40, 0xb56f, 0x9, 0x5, 0x100, 0x718c, 0x9, 0x18}, 0x1}}, @common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x14, 0x99}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x7, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}, @ipv4=@dev={0xac, 0x14, 0x14, 0xc}, @icmp_id=0x66, @gre_key=0x4}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x1670)
setsockopt(r20, 0x0, 0x40, &(0x7f0000000000), 0x0)