Warning: Permanently added '[localhost]:50676' (ECDSA) to the list of known hosts.
2025/09/01 09:58:59 fuzzer started
2025/09/01 09:58:59 dialing manager at localhost:35473
syzkaller login: [   51.424531] cgroup: Unknown subsys name 'net'
[   51.481681] cgroup: Unknown subsys name 'cpuset'
[   51.496188] cgroup: Unknown subsys name 'rlimit'
2025/09/01 09:59:10 syscalls: 2214
2025/09/01 09:59:10 code coverage: enabled
2025/09/01 09:59:10 comparison tracing: enabled
2025/09/01 09:59:10 extra coverage: enabled
2025/09/01 09:59:10 setuid sandbox: enabled
2025/09/01 09:59:10 namespace sandbox: enabled
2025/09/01 09:59:10 Android sandbox: enabled
2025/09/01 09:59:10 fault injection: enabled
2025/09/01 09:59:10 leak checking: enabled
2025/09/01 09:59:10 net packet injection: enabled
2025/09/01 09:59:10 net device setup: enabled
2025/09/01 09:59:10 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 09:59:10 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 09:59:10 USB emulation: enabled
2025/09/01 09:59:10 hci packet injection: enabled
2025/09/01 09:59:10 wifi device emulation: enabled
2025/09/01 09:59:10 802.15.4 emulation: enabled
2025/09/01 09:59:10 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 09:59:10 fetching corpus: 50, signal 22040/25499 (executing program)
2025/09/01 09:59:10 fetching corpus: 100, signal 31448/36254 (executing program)
2025/09/01 09:59:10 fetching corpus: 150, signal 35838/42048 (executing program)
2025/09/01 09:59:10 fetching corpus: 200, signal 43682/50991 (executing program)
2025/09/01 09:59:11 fetching corpus: 250, signal 50429/58680 (executing program)
2025/09/01 09:59:11 fetching corpus: 300, signal 55998/65214 (executing program)
2025/09/01 09:59:11 fetching corpus: 350, signal 58963/69183 (executing program)
2025/09/01 09:59:11 fetching corpus: 400, signal 65208/76019 (executing program)
2025/09/01 09:59:11 fetching corpus: 450, signal 68366/79952 (executing program)
2025/09/01 09:59:11 fetching corpus: 500, signal 72682/84877 (executing program)
2025/09/01 09:59:11 fetching corpus: 550, signal 75456/88377 (executing program)
2025/09/01 09:59:11 fetching corpus: 600, signal 78116/91642 (executing program)
2025/09/01 09:59:11 fetching corpus: 650, signal 80106/94361 (executing program)
2025/09/01 09:59:11 fetching corpus: 700, signal 81272/96364 (executing program)
2025/09/01 09:59:11 fetching corpus: 750, signal 84097/99632 (executing program)
2025/09/01 09:59:12 fetching corpus: 800, signal 86952/102867 (executing program)
2025/09/01 09:59:12 fetching corpus: 850, signal 88580/105060 (executing program)
2025/09/01 09:59:12 fetching corpus: 900, signal 90465/107434 (executing program)
2025/09/01 09:59:12 fetching corpus: 950, signal 92303/109691 (executing program)
2025/09/01 09:59:12 fetching corpus: 1000, signal 94716/112310 (executing program)
2025/09/01 09:59:12 fetching corpus: 1050, signal 96379/114380 (executing program)
2025/09/01 09:59:12 fetching corpus: 1100, signal 99011/117120 (executing program)
2025/09/01 09:59:12 fetching corpus: 1150, signal 100175/118736 (executing program)
2025/09/01 09:59:12 fetching corpus: 1200, signal 101740/120631 (executing program)
2025/09/01 09:59:12 fetching corpus: 1250, signal 102702/122086 (executing program)
2025/09/01 09:59:13 fetching corpus: 1300, signal 104024/123781 (executing program)
2025/09/01 09:59:13 fetching corpus: 1350, signal 105495/125485 (executing program)
2025/09/01 09:59:13 fetching corpus: 1400, signal 106612/126904 (executing program)
2025/09/01 09:59:13 fetching corpus: 1450, signal 107838/128415 (executing program)
2025/09/01 09:59:13 fetching corpus: 1500, signal 109080/129815 (executing program)
2025/09/01 09:59:13 fetching corpus: 1550, signal 110592/131436 (executing program)
2025/09/01 09:59:13 fetching corpus: 1600, signal 111350/132548 (executing program)
2025/09/01 09:59:13 fetching corpus: 1650, signal 113310/134363 (executing program)
2025/09/01 09:59:13 fetching corpus: 1700, signal 114281/135551 (executing program)
2025/09/01 09:59:13 fetching corpus: 1750, signal 115659/136886 (executing program)
2025/09/01 09:59:13 fetching corpus: 1800, signal 117240/138346 (executing program)
2025/09/01 09:59:14 fetching corpus: 1850, signal 118164/139445 (executing program)
2025/09/01 09:59:14 fetching corpus: 1900, signal 119400/140693 (executing program)
2025/09/01 09:59:14 fetching corpus: 1950, signal 120248/141660 (executing program)
2025/09/01 09:59:14 fetching corpus: 2000, signal 121532/142839 (executing program)
2025/09/01 09:59:14 fetching corpus: 2050, signal 122807/143953 (executing program)
2025/09/01 09:59:14 fetching corpus: 2100, signal 123477/144754 (executing program)
2025/09/01 09:59:14 fetching corpus: 2150, signal 125067/146013 (executing program)
2025/09/01 09:59:14 fetching corpus: 2200, signal 125881/146889 (executing program)
2025/09/01 09:59:14 fetching corpus: 2250, signal 126872/147755 (executing program)
2025/09/01 09:59:14 fetching corpus: 2300, signal 127545/148523 (executing program)
2025/09/01 09:59:15 fetching corpus: 2350, signal 128484/149332 (executing program)
2025/09/01 09:59:15 fetching corpus: 2400, signal 129065/150011 (executing program)
2025/09/01 09:59:15 fetching corpus: 2450, signal 131006/151195 (executing program)
2025/09/01 09:59:15 fetching corpus: 2500, signal 132189/152072 (executing program)
2025/09/01 09:59:15 fetching corpus: 2550, signal 133073/152774 (executing program)
2025/09/01 09:59:15 fetching corpus: 2600, signal 133865/153487 (executing program)
2025/09/01 09:59:15 fetching corpus: 2650, signal 135259/154349 (executing program)
2025/09/01 09:59:15 fetching corpus: 2700, signal 135811/154868 (executing program)
2025/09/01 09:59:15 fetching corpus: 2750, signal 136369/155396 (executing program)
2025/09/01 09:59:15 fetching corpus: 2800, signal 137214/155997 (executing program)
2025/09/01 09:59:15 fetching corpus: 2850, signal 137768/156498 (executing program)
2025/09/01 09:59:16 fetching corpus: 2900, signal 138503/157031 (executing program)
2025/09/01 09:59:16 fetching corpus: 2950, signal 139322/157597 (executing program)
2025/09/01 09:59:16 fetching corpus: 3000, signal 139896/158111 (executing program)
2025/09/01 09:59:16 fetching corpus: 3050, signal 140398/158521 (executing program)
2025/09/01 09:59:16 fetching corpus: 3100, signal 140889/158950 (executing program)
2025/09/01 09:59:16 fetching corpus: 3150, signal 141535/159434 (executing program)
2025/09/01 09:59:16 fetching corpus: 3200, signal 142002/159814 (executing program)
2025/09/01 09:59:16 fetching corpus: 3250, signal 142598/160194 (executing program)
2025/09/01 09:59:16 fetching corpus: 3300, signal 143405/160599 (executing program)
2025/09/01 09:59:16 fetching corpus: 3350, signal 143900/160941 (executing program)
2025/09/01 09:59:16 fetching corpus: 3400, signal 144423/161275 (executing program)
2025/09/01 09:59:17 fetching corpus: 3450, signal 144945/161585 (executing program)
2025/09/01 09:59:17 fetching corpus: 3500, signal 145866/161951 (executing program)
2025/09/01 09:59:17 fetching corpus: 3550, signal 146416/162257 (executing program)
2025/09/01 09:59:17 fetching corpus: 3600, signal 147207/162674 (executing program)
2025/09/01 09:59:17 fetching corpus: 3650, signal 147626/162948 (executing program)
2025/09/01 09:59:17 fetching corpus: 3700, signal 148235/163224 (executing program)
2025/09/01 09:59:17 fetching corpus: 3750, signal 148924/163484 (executing program)
2025/09/01 09:59:17 fetching corpus: 3800, signal 149302/163713 (executing program)
2025/09/01 09:59:17 fetching corpus: 3850, signal 149929/163933 (executing program)
2025/09/01 09:59:18 fetching corpus: 3900, signal 150616/164141 (executing program)
2025/09/01 09:59:18 fetching corpus: 3950, signal 151174/164314 (executing program)
2025/09/01 09:59:18 fetching corpus: 4000, signal 151945/164446 (executing program)
2025/09/01 09:59:18 fetching corpus: 4050, signal 153591/164467 (executing program)
2025/09/01 09:59:18 fetching corpus: 4100, signal 154290/164475 (executing program)
2025/09/01 09:59:18 fetching corpus: 4150, signal 154686/164497 (executing program)
2025/09/01 09:59:18 fetching corpus: 4200, signal 155259/164504 (executing program)
2025/09/01 09:59:18 fetching corpus: 4250, signal 155776/164511 (executing program)
2025/09/01 09:59:18 fetching corpus: 4300, signal 156453/164538 (executing program)
2025/09/01 09:59:18 fetching corpus: 4350, signal 156816/164545 (executing program)
2025/09/01 09:59:19 fetching corpus: 4400, signal 157074/164561 (executing program)
2025/09/01 09:59:19 fetching corpus: 4450, signal 157669/164569 (executing program)
2025/09/01 09:59:19 fetching corpus: 4500, signal 158098/164569 (executing program)
2025/09/01 09:59:19 fetching corpus: 4550, signal 158822/164581 (executing program)
2025/09/01 09:59:19 fetching corpus: 4600, signal 159158/164597 (executing program)
2025/09/01 09:59:19 fetching corpus: 4650, signal 159567/164602 (executing program)
2025/09/01 09:59:19 fetching corpus: 4700, signal 160082/164612 (executing program)
2025/09/01 09:59:19 fetching corpus: 4750, signal 160488/164623 (executing program)
2025/09/01 09:59:19 fetching corpus: 4800, signal 160986/164660 (executing program)
2025/09/01 09:59:19 fetching corpus: 4850, signal 161260/164672 (executing program)
2025/09/01 09:59:19 fetching corpus: 4900, signal 161602/164680 (executing program)
2025/09/01 09:59:19 fetching corpus: 4945, signal 161897/164688 (executing program)
2025/09/01 09:59:19 fetching corpus: 4945, signal 161897/164688 (executing program)
2025/09/01 09:59:21 starting 8 fuzzer processes
09:59:21 executing program 0:
eventfd2(0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000980)='fdinfo/3\x00')
pread64(r0, &(0x7f0000000100)=""/147, 0x93, 0x0)

09:59:21 executing program 1:
creat(&(0x7f0000000080)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
lseek(r0, 0xfffffffffffffff9, 0x3)

09:59:21 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, 0x0, &(0x7f00000003c0))
timer_getoverrun(0x0)

09:59:21 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x541b, 0xf0ff1f00000000)

[   73.075322] audit: type=1400 audit(1756720761.383:7): avc:  denied  { execmem } for  pid=272 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
09:59:21 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@empty}, 0x14)

09:59:21 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)="1d", 0x1}], 0x1}, 0x40011)
recvmmsg(r1, &(0x7f0000000c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x3, 0x0)

09:59:21 executing program 5:
mq_open(&(0x7f0000003940)=']&\xa3,(\x00', 0x0, 0x0, &(0x7f0000003980))

09:59:21 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x44840, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000080))
openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x44840, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0)
io_cancel(0x0, 0x0, 0x0)
ioctl$DVD_AUTH(r0, 0x5390, 0x0)

[   74.213877] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   74.216143] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   74.218019] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   74.221821] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   74.224484] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   74.296858] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   74.299597] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   74.314012] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   74.330866] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   74.332946] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   74.405206] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   74.411155] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   74.414349] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   74.415835] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   74.418199] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   74.422380] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   74.422404] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   74.426728] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   74.429385] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   74.431149] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   74.432700] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   74.434604] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   74.441528] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   74.443261] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   74.445854] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   74.447040] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   74.448878] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   74.453194] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   74.486727] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   74.487697] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   74.494554] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   74.497389] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   74.501901] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   74.510588] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   74.512629] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   74.521850] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   74.531430] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   74.548732] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   74.551075] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   74.553759] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   76.246615] Bluetooth: hci0: command tx timeout
[   76.374272] Bluetooth: hci1: command tx timeout
[   76.502408] Bluetooth: hci4: command tx timeout
[   76.502459] Bluetooth: hci2: command tx timeout
[   76.566354] Bluetooth: hci3: command tx timeout
[   76.566351] Bluetooth: hci5: command tx timeout
[   76.631256] Bluetooth: hci6: command tx timeout
[   76.694273] Bluetooth: hci7: command tx timeout
[   78.293829] Bluetooth: hci0: command tx timeout
[   78.421321] Bluetooth: hci1: command tx timeout
[   78.549387] Bluetooth: hci2: command tx timeout
[   78.550340] Bluetooth: hci4: command tx timeout
[   78.613352] Bluetooth: hci5: command tx timeout
[   78.615266] Bluetooth: hci3: command tx timeout
[   78.677297] Bluetooth: hci6: command tx timeout
[   78.741263] Bluetooth: hci7: command tx timeout
[   80.342351] Bluetooth: hci0: command tx timeout
[   80.469286] Bluetooth: hci1: command tx timeout
[   80.598268] Bluetooth: hci4: command tx timeout
[   80.598274] Bluetooth: hci2: command tx timeout
[   80.661340] Bluetooth: hci3: command tx timeout
[   80.661357] Bluetooth: hci5: command tx timeout
[   80.726285] Bluetooth: hci6: command tx timeout
[   80.791116] Bluetooth: hci7: command tx timeout
[   82.389418] Bluetooth: hci0: command tx timeout
[   82.517634] Bluetooth: hci1: command tx timeout
[   82.645389] Bluetooth: hci2: command tx timeout
[   82.646392] Bluetooth: hci4: command tx timeout
[   82.709328] Bluetooth: hci3: command tx timeout
[   82.709648] Bluetooth: hci5: command tx timeout
[   82.775339] Bluetooth: hci6: command tx timeout
[   82.837320] Bluetooth: hci7: command tx timeout
[  109.758484] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.759162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  109.969285] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.969925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.113591] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.114182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.307268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.308004] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.477568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.478242] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.544798] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.545670] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.618590] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.619179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.657548] audit: type=1400 audit(1756720798.966:8): avc:  denied  { open } for  pid=3862 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  110.659934] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.660626] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.662311] audit: type=1400 audit(1756720798.966:9): avc:  denied  { kernel } for  pid=3862 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  110.747951] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.748552] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.814094] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.814695] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.861820] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.862391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.938487] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.939125] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.982142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.982834] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.005191] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.005876] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.060391] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.061007] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.106547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.107168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.172084] audit: type=1400 audit(1756720799.480:10): avc:  denied  { write } for  pid=3887 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
09:59:59 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x541b, 0xf0ff1f00000000)

09:59:59 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, 0x0, &(0x7f00000003c0))
timer_getoverrun(0x0)

09:59:59 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)="1d", 0x1}], 0x1}, 0x40011)
recvmmsg(r1, &(0x7f0000000c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x3, 0x0)

09:59:59 executing program 0:
eventfd2(0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000980)='fdinfo/3\x00')
pread64(r0, &(0x7f0000000100)=""/147, 0x93, 0x0)

09:59:59 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@empty}, 0x14)

09:59:59 executing program 1:
creat(&(0x7f0000000080)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
lseek(r0, 0xfffffffffffffff9, 0x3)

09:59:59 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@empty}, 0x14)

09:59:59 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x44840, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000080))
openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x44840, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0)
io_cancel(0x0, 0x0, 0x0)
ioctl$DVD_AUTH(r0, 0x5390, 0x0)

09:59:59 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, 0x0, &(0x7f00000003c0))
timer_getoverrun(0x0)

09:59:59 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x541b, 0xf0ff1f00000000)

09:59:59 executing program 1:
creat(&(0x7f0000000080)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
lseek(r0, 0xfffffffffffffff9, 0x3)

09:59:59 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@empty}, 0x14)

09:59:59 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)="1d", 0x1}], 0x1}, 0x40011)
recvmmsg(r1, &(0x7f0000000c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x3, 0x0)

09:59:59 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@empty}, 0x14)

09:59:59 executing program 0:
eventfd2(0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000980)='fdinfo/3\x00')
pread64(r0, &(0x7f0000000100)=""/147, 0x93, 0x0)

09:59:59 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x541b, 0xf0ff1f00000000)

[  111.489539] kmemleak: Found object by alias at 0x607f1a63e560
[  111.489558] CPU: 1 UID: 0 PID: 3913 Comm: syz-executor.4 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  111.489577] Tainted: [W]=WARN
[  111.489581] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  111.489589] Call Trace:
[  111.489593]  <TASK>
[  111.489598]  dump_stack_lvl+0xca/0x120
[  111.489625]  __lookup_object+0x94/0xb0
[  111.489643]  delete_object_full+0x27/0x70
[  111.489660]  free_percpu+0x30/0x1160
[  111.489682]  perf_trace_event_unreg.isra.0+0xe0/0x1d0
[  111.489700]  perf_trace_destroy+0xc8/0x1c0
[  111.489714]  ? __pfx_tp_perf_event_destroy+0x10/0x10
[  111.489733]  __free_event+0x255/0xc20
[  111.489754]  perf_event_release_kernel+0x3ef/0x540
[  111.489772]  ? __pfx_perf_release+0x10/0x10
[  111.489784]  perf_release+0x31/0x40
[  111.489796]  __fput+0x401/0xb50
[  111.489816]  fput_close_sync+0x10f/0x240
[  111.489833]  ? __pfx_fput_close_sync+0x10/0x10
[  111.489849]  ? dnotify_flush+0x79/0x4c0
[  111.489867]  __x64_sys_close+0x8f/0x120
09:59:59 executing program 1:
creat(&(0x7f0000000080)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
lseek(r0, 0xfffffffffffffff9, 0x3)

[  111.489886]  do_syscall_64+0xbf/0x360
[  111.489900]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.489914] RIP: 0033:0x7f359d61972b
[  111.489923] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
[  111.489934] RSP: 002b:00007ffd0bf35690 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[  111.489946] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f359d61972b
[  111.489954] RDX: 00007f359d77ef10 RSI: 00007f359d3de628 RDI: 0000000000000003
[  111.489961] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2d124f04
[  111.489968] R10: 0000000000001a85 R11: 0000000000000293 R12: 000000000001b30c
[  111.489975] R13: 00000000000003e8 R14: 00007f359d779f60 R15: 000000000001b2e9
[  111.489991]  </TASK>
[  111.489995] kmemleak: Object (percpu) 0x607f1a63e558 (size 16):
[  111.490002] kmemleak:   comm "syz-executor.2", pid 279, jiffies 4294778410
[  111.490009] kmemleak:   min_count = 1
[  111.490013] kmemleak:   count = 0
[  111.490016] kmemleak:   flags = 0x21
[  111.490020] kmemleak:   checksum = 0
[  111.490024] kmemleak:   backtrace:
[  111.490027]  pcpu_alloc_noprof+0x87a/0x1170
09:59:59 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@empty}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x14)
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@empty}, 0x14)

[  111.490043]  mm_init+0x99b/0x1170
[  111.490053]  copy_process+0x3ab7/0x73c0
[  111.490063]  kernel_clone+0xea/0x7f0
[  111.490074]  __do_sys_clone+0xce/0x120
[  111.490084]  do_syscall_64+0xbf/0x360
[  111.490093]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
09:59:59 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x44840, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000080))
openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x44840, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0)
io_cancel(0x0, 0x0, 0x0)
ioctl$DVD_AUTH(r0, 0x5390, 0x0)

[  111.535104] kmemleak: Found object by alias at 0x607f1a63e55c
[  111.535117] CPU: 1 UID: 0 PID: 3920 Comm: syz-executor.5 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  111.535134] Tainted: [W]=WARN
[  111.535138] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  111.535145] Call Trace:
[  111.535148]  <TASK>
[  111.535152]  dump_stack_lvl+0xca/0x120
[  111.535174]  __lookup_object+0x94/0xb0
[  111.535189]  delete_object_full+0x27/0x70
[  111.535206]  free_percpu+0x30/0x1160
[  111.535225]  ? arch_uprobe_clear_state+0x16/0x140
[  111.535246]  futex_hash_free+0x38/0xc0
[  111.535261]  mmput+0x2d3/0x390
[  111.535280]  do_exit+0x79d/0x2970
[  111.535294]  ? signal_wake_up_state+0x85/0x120
[  111.535311]  ? zap_other_threads+0x2b9/0x3a0
[  111.535327]  ? __pfx_do_exit+0x10/0x10
[  111.535340]  ? do_group_exit+0x1c3/0x2a0
[  111.535354]  ? lock_release+0xc8/0x290
[  111.535372]  do_group_exit+0xd3/0x2a0
[  111.535387]  __x64_sys_exit_group+0x3e/0x50
[  111.535402]  x64_sys_call+0x18c5/0x18d0
[  111.535417]  do_syscall_64+0xbf/0x360
[  111.535430]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.535442] RIP: 0033:0x7fbfbdce6b19
[  111.535451] Code: Unable to access opcode bytes at 0x7fbfbdce6aef.
[  111.535456] RSP: 002b:00007ffd8cd991d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[  111.535467] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fbfbdce6b19
[  111.535475] RDX: 00007fbfbdc9972b RSI: ffffffffffffffbc RDI: 0000000000000000
[  111.535483] RBP: 0000000000000000 R08: 0000001b2d22476c R09: 0000000000000000
[  111.535490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  111.535497] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffd8cd992c0
[  111.535513]  </TASK>
[  111.535517] kmemleak: Object (percpu) 0x607f1a63e558 (size 16):
[  111.535523] kmemleak:   comm "syz-executor.1", pid 282, jiffies 4294778431
[  111.535531] kmemleak:   min_count = 1
[  111.535534] kmemleak:   count = 0
[  111.535538] kmemleak:   flags = 0x21
[  111.535542] kmemleak:   checksum = 0
[  111.535546] kmemleak:   backtrace:
[  111.535549]  pcpu_alloc_noprof+0x87a/0x1170
[  111.535565]  mm_init+0x99b/0x1170
[  111.535573]  copy_process+0x3ab7/0x73c0
[  111.535584]  kernel_clone+0xea/0x7f0
[  111.535594]  __do_sys_clone+0xce/0x120
[  111.535604]  do_syscall_64+0xbf/0x360
[  111.535613]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.579038] kmemleak: Found object by alias at 0x607f1a63e564
[  111.579051] CPU: 1 UID: 0 PID: 3919 Comm: syz-executor.4 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  111.579069] Tainted: [W]=WARN
[  111.579072] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  111.579079] Call Trace:
[  111.579083]  <TASK>
[  111.579087]  dump_stack_lvl+0xca/0x120
[  111.579108]  __lookup_object+0x94/0xb0
[  111.579124]  delete_object_full+0x27/0x70
[  111.579141]  free_percpu+0x30/0x1160
[  111.579156]  ? arch_uprobe_clear_state+0x16/0x140
[  111.579176]  futex_hash_free+0x38/0xc0
[  111.579190]  mmput+0x2d3/0x390
[  111.579208]  do_exit+0x79d/0x2970
[  111.579226]  ? lock_release+0xc8/0x290
[  111.579243]  ? __pfx_do_exit+0x10/0x10
[  111.579258]  ? find_held_lock+0x2b/0x80
[  111.579276]  ? get_signal+0x835/0x2340
[  111.579296]  do_group_exit+0xd3/0x2a0
[  111.579311]  get_signal+0x2315/0x2340
[  111.579329]  ? __pfx_do_recvmmsg+0x10/0x10
[  111.579348]  ? __fget_files+0x203/0x3b0
[  111.579365]  ? __pfx_get_signal+0x10/0x10
[  111.579381]  ? do_futex+0x135/0x370
[  111.579396]  ? __pfx_do_futex+0x10/0x10
[  111.579411]  arch_do_signal_or_restart+0x80/0x790
[  111.579430]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  111.579447]  ? __x64_sys_futex+0x1c9/0x4d0
[  111.579460]  ? __x64_sys_futex+0x1d2/0x4d0
[  111.579475]  ? __pfx___x64_sys_futex+0x10/0x10
[  111.579489]  ? __pfx___x64_sys_recvmmsg+0x10/0x10
[  111.579505]  exit_to_user_mode_loop+0x8b/0x110
[  111.579518]  do_syscall_64+0x2f7/0x360
[  111.579531]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.579543] RIP: 0033:0x7f359d666b19
[  111.579551] Code: Unable to access opcode bytes at 0x7f359d666aef.
[  111.579557] RSP: 002b:00007f359abdc218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  111.579568] RAX: fffffffffffffe00 RBX: 00007f359d779f68 RCX: 00007f359d666b19
[  111.579576] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f359d779f68
[  111.579583] RBP: 00007f359d779f60 R08: 0000000000000000 R09: 0000000000000000
[  111.579590] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f359d779f6c
[  111.579597] R13: 00007ffd0bf3562f R14: 00007f359abdc300 R15: 0000000000022000
[  111.579613]  </TASK>
[  111.579617] kmemleak: Object (percpu) 0x607f1a63e558 (size 16):
[  111.579624] kmemleak:   comm "syz-executor.1", pid 282, jiffies 4294778431
[  111.579631] kmemleak:   min_count = 1
[  111.579635] kmemleak:   count = 0
[  111.579639] kmemleak:   flags = 0x21
[  111.579642] kmemleak:   checksum = 0
[  111.579646] kmemleak:   backtrace:
[  111.579649]  pcpu_alloc_noprof+0x87a/0x1170
[  111.579665]  mm_init+0x99b/0x1170
[  111.579674]  copy_process+0x3ab7/0x73c0
[  111.579684]  kernel_clone+0xea/0x7f0
[  111.579694]  __do_sys_clone+0xce/0x120
[  111.579705]  do_syscall_64+0xbf/0x360
[  111.579714]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.587971] kmemleak: Cannot insert 0x607f1a63e560 into the object search tree (overlaps existing)
[  111.587991] CPU: 0 UID: 0 PID: 3931 Comm: syz-executor.3 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  111.588010] Tainted: [W]=WARN
[  111.588014] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  111.588022] Call Trace:
[  111.588027]  <TASK>
[  111.588034]  dump_stack_lvl+0xca/0x120
[  111.588063]  __link_object+0x190/0x210
[  111.588082]  __create_object+0x48/0x80
[  111.588100]  pcpu_alloc_noprof+0x87a/0x1170
[  111.588133]  fib_nh_common_init+0x30/0xd0
[  111.588150]  fib6_nh_init+0x968/0x1a00
[  111.588163]  ? do_raw_spin_lock+0x123/0x260
[  111.588184]  ? __pfx_fib6_nh_init+0x10/0x10
[  111.588199]  ? mark_held_locks+0x49/0x80
[  111.588231]  ? _raw_spin_unlock_irqrestore+0x2c/0x50
[  111.588251]  ? __create_object+0x59/0x80
[  111.588271]  ? trace_kmalloc+0x1f/0xb0
[  111.588292]  ip6_route_info_create_nh+0x530/0xf80
[  111.588307]  ? __pfx_ip6_route_info_create_nh+0x10/0x10
[  111.588321]  ? __asan_memcpy+0x3d/0x60
[  111.588339]  addrconf_f6i_alloc+0x208/0x430
[  111.588357]  ? __pfx_addrconf_f6i_alloc+0x10/0x10
[  111.588371]  ? __lock_acquire+0xc65/0x1b70
[  111.588393]  ? __pfx_do_raw_write_lock+0x10/0x10
[  111.588409]  ? ipv6_chk_prefix+0x34/0x520
[  111.588424]  ? find_held_lock+0x2b/0x80
[  111.588450]  ? lock_is_held_type+0x9e/0x120
[  111.588470]  __ipv6_dev_ac_inc+0x2fc/0xd80
[  111.588493]  ipv6_sock_ac_join+0x8b5/0x1190
[  111.588512]  ? __pfx_ipv6_sock_ac_join+0x10/0x10
[  111.588535]  ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10
[  111.588555]  ? mark_held_locks+0x49/0x80
[  111.588572]  do_ipv6_setsockopt+0x3f54/0x47b0
[  111.588594]  ? __pfx_do_ipv6_setsockopt+0x10/0x10
[  111.588622]  ? __lock_acquire+0xc65/0x1b70
[  111.588641]  ? lock_acquire+0x15e/0x2f0
[  111.588657]  ? sock_has_perm+0x21d/0x2b0
[  111.588670]  ? __pfx_sock_has_perm+0x10/0x10
[  111.588686]  ? selinux_netlbl_socket_setsockopt+0xa1/0x460
[  111.588703]  ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10
[  111.588723]  ipv6_setsockopt+0xcb/0x170
[  111.588743]  udpv6_setsockopt+0x84/0xd0
[  111.588760]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  111.588777]  do_sock_setsockopt+0xf7/0x1e0
[  111.588793]  __sys_setsockopt+0x11f/0x1a0
[  111.588814]  __x64_sys_setsockopt+0xbe/0x160
[  111.588832]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  111.588849]  do_syscall_64+0xbf/0x360
[  111.588862]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.588875] RIP: 0033:0x7f1d57166b19
[  111.588885] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  111.588896] RSP: 002b:00007f1d546dc188 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  111.588909] RAX: ffffffffffffffda RBX: 00007f1d57279f60 RCX: 00007f1d57166b19
[  111.588920] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000003
[  111.588927] RBP: 00007f1d571c0f6d R08: 0000000000000014 R09: 0000000000000000
[  111.588934] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000000
[  111.588941] R13: 00007ffc79c29daf R14: 00007f1d546dc300 R15: 0000000000022000
[  111.588959]  </TASK>
[  111.589549] kmemleak: Kernel memory leak detector disabled
[  111.589554] kmemleak: Object (percpu) 0x607f1a63e558 (size 16):
[  111.589561] kmemleak:   comm "syz-executor.1", pid 282, jiffies 4294778431
[  111.589569] kmemleak:   min_count = 1
[  111.589573] kmemleak:   count = 0
[  111.589577] kmemleak:   flags = 0x21
[  111.589581] kmemleak:   checksum = 0
[  111.589585] kmemleak:   backtrace:
[  111.589589]  pcpu_alloc_noprof+0x87a/0x1170
[  111.589608]  mm_init+0x99b/0x1170
[  111.589619]  copy_process+0x3ab7/0x73c0
[  111.589630]  kernel_clone+0xea/0x7f0
[  111.589640]  __do_sys_clone+0xce/0x120
[  111.589651]  do_syscall_64+0xbf/0x360
[  111.589660]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.636271] Oops: general protection fault, probably for non-canonical address 0xdffffc001fffffff: 0000 [#1] SMP KASAN NOPTI
[  111.637218] KASAN: probably user-memory-access in range [0x00000000fffffff8-0x00000000ffffffff]
[  111.637910] CPU: 0 UID: 0 PID: 283 Comm: syz-executor.4 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  111.639537] Tainted: [W]=WARN
[  111.640397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  111.642429] RIP: 0010:dst_dev_put+0x21/0x250
[  111.644085] Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 54 55 53 48 89 fb e8 f0 9a a8 fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b5 01 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00
[  111.648118] RSP: 0018:ffff88806ce08db8 EFLAGS: 00010217
[  111.648563] RAX: dffffc0000000000 RBX: 00000000ffffffff RCX: ffffffff841076c7
[  111.649138] RDX: 000000001fffffff RSI: ffffffff83cb5bc0 RDI: 00000000ffffffff
[  111.649716] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001
[  111.650296] R10: 0000000000000000 R11: 0000000000000001 R12: fffffbfff0b0a4ac
[  111.650869] R13: 0000607f1a63e560 R14: 0000607f1a63e560 R15: 0000000000000000
[  111.651449] FS:  00005555683f6400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[  111.652097] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  111.652579] CR2: 000000c000687000 CR3: 000000003f003000 CR4: 0000000000350ef0
[  111.653155] Call Trace:
[  111.653368]  <IRQ>
[  111.653550]  rt_fibinfo_free_cpus.part.0+0xdb/0x1a0
[  111.653968]  ? rcu_core+0x7c3/0x1800
[  111.654281]  fib_nh_common_release+0xa8/0x2c0
[  111.654657]  ? rcu_core+0x7c3/0x1800
[  111.654965]  ? rcu_core+0x7c3/0x1800
[  111.655277]  fib6_info_destroy_rcu+0x18b/0x1f0
[  111.655658]  ? rcu_core+0x7c3/0x1800
[  111.655969]  rcu_core+0x7c8/0x1800
[  111.656281]  ? __pfx_rcu_core+0x10/0x10
[  111.656616]  ? mark_held_locks+0x49/0x80
[  111.656948]  handle_softirqs+0x1b1/0x770
[  111.657297]  ? kernel_fpu_end+0x59/0x70
[  111.657631]  do_softirq+0x48/0x80
[  111.657919]  </IRQ>
[  111.658109]  <TASK>
[  111.658295]  __local_bh_enable_ip+0xf1/0x110
[  111.658669]  kernel_fpu_end+0x5e/0x70
[  111.658984]  crc32c+0x2d0/0x350
[  111.659259]  ? jbd2_journal_get_write_access+0x19f/0x250
[  111.659713]  ext4_inode_bitmap_csum_set+0x13f/0x270
[  111.660128]  ext4_free_inode+0x931/0x13e0
[  111.660486]  ? __pfx_ext4_free_inode+0x10/0x10
[  111.660863]  ? __ext4_journal_start_sb+0x325/0x5d0
[  111.661267]  ? __ext4_journal_start_sb+0x1e3/0x5d0
[  111.661681]  ext4_evict_inode+0xc0a/0x1740
[  111.662029]  ? __pfx_ext4_evict_inode+0x10/0x10
[  111.662415]  ? lock_release+0xc8/0x290
[  111.662738]  ? __pfx_ext4_evict_inode+0x10/0x10
[  111.663126]  evict+0x368/0x860
[  111.663401]  ? __pfx_evict+0x10/0x10
[  111.663718]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  111.664100]  ? find_held_lock+0x2b/0x80
[  111.664441]  ? iput.part.0+0x539/0x770
[  111.664766]  ? lock_release+0xc8/0x290
[  111.665081]  iput.part.0+0x541/0x770
[  111.665391]  ? __pfx_ext4_drop_inode+0x10/0x10
[  111.665771]  iput+0x62/0x80
[  111.666018]  do_unlinkat+0x4fb/0x670
[  111.666327]  ? __pfx_do_unlinkat+0x10/0x10
[  111.666673]  ? __check_object_size+0x57b/0x880
[  111.667060]  ? strncpy_from_user+0x21b/0x2f0
[  111.667436]  __x64_sys_unlink+0xc7/0x110
[  111.667772]  do_syscall_64+0xbf/0x360
[  111.668089]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.668526] RIP: 0033:0x7f359d666457
[  111.668827] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  111.670302] RSP: 002b:00007ffd0bf34778 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
[  111.670914] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f359d666457
[  111.671497] RDX: 00007ffd0bf347b0 RSI: 00007ffd0bf347b0 RDI: 00007ffd0bf34840
[  111.672071] RBP: 00007ffd0bf34840 R08: 0000000000000001 R09: 00007ffd0bf34610
[  111.672648] R10: 00005555683f7c7b R11: 0000000000000206 R12: 00007f359d6c0105
[  111.673219] R13: 00007ffd0bf35900 R14: 00005555683f7c20 R15: 00007ffd0bf35940
[  111.673798]  </TASK>
[  111.673994] Modules linked in:
[  111.674301] ---[ end trace 0000000000000000 ]---
[  111.674688] RIP: 0010:dst_dev_put+0x21/0x250
[  111.675062] Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 54 55 53 48 89 fb e8 f0 9a a8 fd 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b5 01 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00
[  111.676556] RSP: 0018:ffff88806ce08db8 EFLAGS: 00010217
[  111.676990] RAX: dffffc0000000000 RBX: 00000000ffffffff RCX: ffffffff841076c7
[  111.677582] RDX: 000000001fffffff RSI: ffffffff83cb5bc0 RDI: 00000000ffffffff
[  111.678160] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001
[  111.678749] R10: 0000000000000000 R11: 0000000000000001 R12: fffffbfff0b0a4ac
[  111.679334] R13: 0000607f1a63e560 R14: 0000607f1a63e560 R15: 0000000000000000
[  111.679912] FS:  00005555683f6400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[  111.680595] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  111.681071] CR2: 000000c000687000 CR3: 000000003f003000 CR4: 0000000000350ef0
[  111.681667] Kernel panic - not syncing: Fatal exception in interrupt
[  111.682394] Kernel Offset: disabled
[  111.682695] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

VM DIAGNOSIS:
10:00:00  Registers:
info registers vcpu 0
RAX=000000000000005f RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff88806ce08708
R8 =0000000000000000 R9 =ffffed1001308046 R10=000000000000005f R11=30353278302f3132
R12=000000000000005f R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0
RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00005555683f6400 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 fffffe3300000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000c000687000 CR3=000000003f003000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11
XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000
XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000001 RBX=ffff88800eac3b90 RCX=ffffffff817c3ab6 RDX=0000000000000000
RSI=0000000000000008 RDI=ffffffff84be3363 RBP=ffff88800eac3b90 RSP=ffff88800f88fe30
R8 =0000000000000000 R9 =0000000000000000 R10=ffffffff8643b457 R11=1ffff1100d9e6f7b
R12=ffffffffffffffff R13=0000000000000000 R14=0000000000000001 R15=000000000000001f
RIP=ffffffff84be336b RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe4300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555584446c58 CR3=0000000035e2b000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=000000000bbeaa1531a000a09376d911 XMM01=0000000027d497df8c95bfd6ae012240
XMM02=00000000462912ceccbe75516c743732 XMM03=000000002e02da15825898f0793902bd
XMM04=000000007ac9734f47e2d996574cecfb XMM05=000000002e02da158299dd64e2db8173
XMM06=00000000000000000000000000000000 XMM07=00000001db710640b4e5b025f7011641
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000