wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
==================================================================
BUG: KASAN: null-ptr-deref in ip6_pol_route+0x602/0x11a0
Read of size 4 at addr 0000000000000dcc by task kworker/u8:2/3716

CPU: 0 UID: 0 PID: 3716 Comm: kworker/u8:2 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <IRQ>
 dump_stack_lvl+0xca/0x120
 kasan_report+0xca/0x100
 kasan_check_range+0x39/0x1b0
 ip6_pol_route+0x602/0x11a0
 fib6_rule_lookup+0x20d/0x300
 ip6_route_input+0x606/0xb30
 ip6_rcv_finish_core.constprop.0+0x1a4/0x5e0
 ip6_list_rcv_finish.constprop.0+0x15f/0x9a0
 ipv6_list_rcv+0x2c7/0x3f0
 __netif_receive_skb_list_core+0x4c1/0x8d0
 netif_receive_skb_list_internal+0x6c1/0xc90
 netif_receive_skb_list+0x4f/0x410
 ieee80211_rx_napi+0x356/0x3c0
 ieee80211_handle_queued_frames+0xd9/0x130
 tasklet_action_common+0x235/0x3b0
 handle_softirqs+0x1b1/0x770
 do_softirq+0x48/0x80
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf1/0x110
 __dev_queue_xmit+0xe2e/0x3cc0
 neigh_resolve_output+0x492/0x7f0
 ip6_finish_output2+0x946/0x1aa0
 __ip6_finish_output+0x5d5/0xd10
 ip6_output+0x1c2/0x3e0
 ndisc_send_skb+0x9ed/0x1d10
 ndisc_send_ns+0xa9/0x130
 addrconf_dad_work+0xae2/0x11a0
 process_one_work+0x8e1/0x19c0
 worker_thread+0x67e/0xe90
 kthread+0x3c8/0x740
 ret_from_fork+0x34b/0x430
 ret_from_fork_asm+0x1a/0x30
 </TASK>
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc00000001b9: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000dc8-0x0000000000000dcf]
CPU: 0 UID: 0 PID: 3716 Comm: kworker/u8:2 Tainted: G    B   W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ip6_pol_route+0x617/0x11a0
Code: 00 00 4c 8d b2 cc 0d 00 00 48 89 14 24 4c 89 f7 e8 ae 71 83 fd 4c 89 f1 48 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 <0f> b6 0c 01 4c 89 f0 83 e0 07 83 c0 03 38 c8 7c 10 84 c9 74 0c 4c
RSP: 0018:ffff88806ce08780 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: ffff88800d5b2d00 RCX: 00000000000001b9
RDX: 0000000000000000 RSI: ffffffff81afcfee RDI: 0000000000000007
RBP: ffff8880163b97c0 R08: 0000000000000001 R09: fffffbfff0f11c90
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000046c46800
R13: 0000000000000080 R14: 0000000000000dcc R15: ffff88806ce08800
FS:  0000000000000000(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fda054a1710 CR3: 00000000203c3000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 fib6_rule_lookup+0x20d/0x300
 ip6_route_input+0x606/0xb30
 ip6_rcv_finish_core.constprop.0+0x1a4/0x5e0
 ip6_list_rcv_finish.constprop.0+0x15f/0x9a0
 ipv6_list_rcv+0x2c7/0x3f0
 __netif_receive_skb_list_core+0x4c1/0x8d0
 netif_receive_skb_list_internal+0x6c1/0xc90
 netif_receive_skb_list+0x4f/0x410
 ieee80211_rx_napi+0x356/0x3c0
 ieee80211_handle_queued_frames+0xd9/0x130
 tasklet_action_common+0x235/0x3b0
 handle_softirqs+0x1b1/0x770
 do_softirq+0x48/0x80
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf1/0x110
 __dev_queue_xmit+0xe2e/0x3cc0
 neigh_resolve_output+0x492/0x7f0
 ip6_finish_output2+0x946/0x1aa0
 __ip6_finish_output+0x5d5/0xd10
 ip6_output+0x1c2/0x3e0
 ndisc_send_skb+0x9ed/0x1d10
 ndisc_send_ns+0xa9/0x130
 addrconf_dad_work+0xae2/0x11a0
 process_one_work+0x8e1/0x19c0
 worker_thread+0x67e/0xe90
 kthread+0x3c8/0x740
 ret_from_fork+0x34b/0x430
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ip6_pol_route+0x617/0x11a0
Code: 00 00 4c 8d b2 cc 0d 00 00 48 89 14 24 4c 89 f7 e8 ae 71 83 fd 4c 89 f1 48 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 <0f> b6 0c 01 4c 89 f0 83 e0 07 83 c0 03 38 c8 7c 10 84 c9 74 0c 4c
RSP: 0018:ffff88806ce08780 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: ffff88800d5b2d00 RCX: 00000000000001b9
RDX: 0000000000000000 RSI: ffffffff81afcfee RDI: 0000000000000007
RBP: ffff8880163b97c0 R08: 0000000000000001 R09: fffffbfff0f11c90
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000046c46800
R13: 0000000000000080 R14: 0000000000000dcc R15: ffff88806ce08800
FS:  0000000000000000(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fda054a1710 CR3: 0000000005a88000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	4c 8d b2 cc 0d 00 00 	lea    0xdcc(%rdx),%r14
   9:	48 89 14 24          	mov    %rdx,(%rsp)
   d:	4c 89 f7             	mov    %r14,%rdi
  10:	e8 ae 71 83 fd       	callq  0xfd8371c3
  15:	4c 89 f1             	mov    %r14,%rcx
  18:	48 8b 14 24          	mov    (%rsp),%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 e9 03          	shr    $0x3,%rcx
* 2a:	0f b6 0c 01          	movzbl (%rcx,%rax,1),%ecx <-- trapping instruction
  2e:	4c 89 f0             	mov    %r14,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 c8                	cmp    %cl,%al
  39:	7c 10                	jl     0x4b
  3b:	84 c9                	test   %cl,%cl
  3d:	74 0c                	je     0x4b
  3f:	4c                   	rex.WR