Warning: Permanently added '[localhost]:59947' (ECDSA) to the list of known hosts. 2025/09/01 08:10:59 fuzzer started 2025/09/01 08:11:00 dialing manager at localhost:35473 syzkaller login: [ 50.695514] cgroup: Unknown subsys name 'net' [ 50.753076] cgroup: Unknown subsys name 'cpuset' [ 50.766450] cgroup: Unknown subsys name 'rlimit' 2025/09/01 08:11:11 syscalls: 2214 2025/09/01 08:11:11 code coverage: enabled 2025/09/01 08:11:11 comparison tracing: enabled 2025/09/01 08:11:11 extra coverage: enabled 2025/09/01 08:11:11 setuid sandbox: enabled 2025/09/01 08:11:11 namespace sandbox: enabled 2025/09/01 08:11:11 Android sandbox: enabled 2025/09/01 08:11:11 fault injection: enabled 2025/09/01 08:11:11 leak checking: enabled 2025/09/01 08:11:11 net packet injection: enabled 2025/09/01 08:11:11 net device setup: enabled 2025/09/01 08:11:11 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/09/01 08:11:11 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/09/01 08:11:11 USB emulation: enabled 2025/09/01 08:11:11 hci packet injection: enabled 2025/09/01 08:11:11 wifi device emulation: enabled 2025/09/01 08:11:11 802.15.4 emulation: enabled 2025/09/01 08:11:11 fetching corpus: 0, signal 0/2000 (executing program) 2025/09/01 08:11:11 fetching corpus: 50, signal 26413/28621 (executing program) 2025/09/01 08:11:11 fetching corpus: 100, signal 39840/41805 (executing program) 2025/09/01 08:11:11 fetching corpus: 150, signal 49787/51010 (executing program) 2025/09/01 08:11:12 fetching corpus: 200, signal 56222/56701 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/57842 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/57908 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/57966 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58034 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58111 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58159 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58220 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58274 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58334 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58396 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58455 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58518 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58574 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58643 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58708 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58772 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58828 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58896 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/58942 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59000 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59057 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59117 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59179 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59243 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59263 (executing program) 2025/09/01 08:11:12 fetching corpus: 219, signal 57503/59263 (executing program) 2025/09/01 08:11:14 starting 8 fuzzer processes 08:11:14 executing program 0: r0 = syz_io_uring_setup(0x46d4, &(0x7f0000000000), &(0x7f0000939000/0x1000)=nil, &(0x7f0000f0d000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200)=[r1, 0xffffffffffffffff, r0], 0x3) 08:11:14 executing program 4: getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) 08:11:14 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) 08:11:14 executing program 2: io_setup(0x0, 0x0) 08:11:14 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:14 executing program 3: socket$inet6(0xa, 0x5, 0x6) 08:11:14 executing program 5: syz_mount_image$ext4(&(0x7f0000001280)='ext3\x00', &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)={[{@abort}]}) [ 64.879742] audit: type=1400 audit(1756714274.439:7): avc: denied { execmem } for pid=271 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:11:14 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) [ 66.072043] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 66.077957] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 66.081127] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 66.086697] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 66.089466] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 66.092274] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 66.095167] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 66.101199] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 66.107111] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 66.110625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 66.149044] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 66.150796] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 66.152106] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 66.156022] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 66.157237] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 66.164089] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 66.166473] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 66.169118] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 66.177663] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 66.179143] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 66.181824] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 66.195927] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 66.198161] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 66.202886] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 66.205557] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 66.208635] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 66.212633] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 66.219719] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 66.242748] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 66.246387] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 66.248231] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 66.251165] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 66.253739] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 66.256992] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 66.259740] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 66.260912] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 66.264003] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 66.265989] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 66.290077] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 66.301788] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 68.168477] Bluetooth: hci1: command tx timeout [ 68.169105] Bluetooth: hci0: command tx timeout [ 68.230547] Bluetooth: hci2: command tx timeout [ 68.232754] Bluetooth: hci3: command tx timeout [ 68.294551] Bluetooth: hci5: command tx timeout [ 68.295098] Bluetooth: hci6: command tx timeout [ 68.359593] Bluetooth: hci7: command tx timeout [ 68.360111] Bluetooth: hci4: command tx timeout [ 70.216139] Bluetooth: hci1: command tx timeout [ 70.216722] Bluetooth: hci0: command tx timeout [ 70.279460] Bluetooth: hci3: command tx timeout [ 70.279869] Bluetooth: hci2: command tx timeout [ 70.342481] Bluetooth: hci6: command tx timeout [ 70.342882] Bluetooth: hci5: command tx timeout [ 70.407549] Bluetooth: hci4: command tx timeout [ 70.407953] Bluetooth: hci7: command tx timeout [ 72.262568] Bluetooth: hci0: command tx timeout [ 72.262994] Bluetooth: hci1: command tx timeout [ 72.327455] Bluetooth: hci3: command tx timeout [ 72.327867] Bluetooth: hci2: command tx timeout [ 72.391467] Bluetooth: hci5: command tx timeout [ 72.391874] Bluetooth: hci6: command tx timeout [ 72.457586] Bluetooth: hci7: command tx timeout [ 72.457984] Bluetooth: hci4: command tx timeout [ 74.311221] Bluetooth: hci1: command tx timeout [ 74.311885] Bluetooth: hci0: command tx timeout [ 74.375504] Bluetooth: hci3: command tx timeout [ 74.375908] Bluetooth: hci2: command tx timeout [ 74.439451] Bluetooth: hci5: command tx timeout [ 74.439848] Bluetooth: hci6: command tx timeout [ 74.503459] Bluetooth: hci7: command tx timeout [ 74.503867] Bluetooth: hci4: command tx timeout [ 102.686780] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.687585] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.851231] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.852170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.042626] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.043268] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.194412] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.195030] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.350706] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.351877] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.520423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.521038] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.589925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.590948] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.670045] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.671654] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.893659] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.894248] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.948589] audit: type=1400 audit(1756714313.504:8): avc: denied { open } for pid=3833 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 103.954565] audit: type=1400 audit(1756714313.504:9): avc: denied { kernel } for pid=3833 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 104.013484] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.014070] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.163006] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.163043] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.253344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.254329] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.442774] No source specified [ 104.445624] No source specified [ 104.700438] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.701037] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.719168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.719938] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.887977] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.888667] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.918679] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.919214] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:11:54 executing program 3: socket$inet6(0xa, 0x5, 0x6) 08:11:54 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) 08:11:54 executing program 0: r0 = syz_io_uring_setup(0x46d4, &(0x7f0000000000), &(0x7f0000939000/0x1000)=nil, &(0x7f0000f0d000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200)=[r1, 0xffffffffffffffff, r0], 0x3) 08:11:54 executing program 2: io_setup(0x0, 0x0) 08:11:54 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:54 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:54 executing program 4: getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) 08:11:54 executing program 5: syz_mount_image$ext4(&(0x7f0000001280)='ext3\x00', &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)={[{@abort}]}) [ 105.083493] No source specified 08:11:54 executing program 4: getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) 08:11:54 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:54 executing program 0: r0 = syz_io_uring_setup(0x46d4, &(0x7f0000000000), &(0x7f0000939000/0x1000)=nil, &(0x7f0000f0d000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200)=[r1, 0xffffffffffffffff, r0], 0x3) 08:11:54 executing program 2: io_setup(0x0, 0x0) 08:11:54 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:54 executing program 5: syz_mount_image$ext4(&(0x7f0000001280)='ext3\x00', &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)={[{@abort}]}) 08:11:54 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) [ 105.213021] No source specified 08:11:54 executing program 4: getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) 08:11:54 executing program 2: io_setup(0x0, 0x0) 08:11:54 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:54 executing program 3: socket$inet6(0xa, 0x5, 0x6) 08:11:54 executing program 0: r0 = syz_io_uring_setup(0x46d4, &(0x7f0000000000), &(0x7f0000939000/0x1000)=nil, &(0x7f0000f0d000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000200)=[r1, 0xffffffffffffffff, r0], 0x3) 08:11:54 executing program 5: syz_mount_image$ext4(&(0x7f0000001280)='ext3\x00', &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)={[{@abort}]}) 08:11:54 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:54 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) [ 105.321875] No source specified 08:11:54 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) [ 105.409364] kmemleak: Found object by alias at 0x607f1a63e3e4 [ 105.409389] CPU: 0 UID: 0 PID: 3943 Comm: syz-executor.2 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 105.409408] Tainted: [W]=WARN [ 105.409411] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 105.409418] Call Trace: [ 105.409423] [ 105.409428] dump_stack_lvl+0xca/0x120 [ 105.409455] __lookup_object+0x94/0xb0 [ 105.409473] delete_object_full+0x27/0x70 [ 105.409489] free_percpu+0x30/0x1160 [ 105.409507] ? arch_uprobe_clear_state+0x16/0x140 [ 105.409527] futex_hash_free+0x38/0xc0 [ 105.409542] mmput+0x2d3/0x390 [ 105.409561] do_exit+0x79d/0x2970 [ 105.409575] ? lock_release+0xc8/0x290 [ 105.409592] ? __pfx_do_exit+0x10/0x10 [ 105.409606] ? find_held_lock+0x2b/0x80 [ 105.409624] ? get_signal+0x835/0x2340 [ 105.409644] do_group_exit+0xd3/0x2a0 [ 105.409659] get_signal+0x2315/0x2340 [ 105.409682] ? __pfx_get_signal+0x10/0x10 [ 105.409699] ? do_futex+0x135/0x370 [ 105.409713] ? __pfx_do_futex+0x10/0x10 [ 105.409725] ? do_user_addr_fault+0x61b/0xeb0 [ 105.409742] arch_do_signal_or_restart+0x80/0x790 [ 105.409760] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 105.409776] ? __x64_sys_futex+0x1c9/0x4d0 [ 105.409789] ? __x64_sys_futex+0x1d2/0x4d0 [ 105.409804] ? __pfx___x64_sys_futex+0x10/0x10 [ 105.409819] ? __x64_sys_io_setup+0x6d/0x1f0 [ 105.409837] exit_to_user_mode_loop+0x8b/0x110 [ 105.409851] do_syscall_64+0x2f7/0x360 [ 105.409863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.409875] RIP: 0033:0x7fa077d29b19 [ 105.409885] Code: Unable to access opcode bytes at 0x7fa077d29aef. [ 105.409890] RSP: 002b:00007fa07529f218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 105.409902] RAX: fffffffffffffe00 RBX: 00007fa077e3cf68 RCX: 00007fa077d29b19 [ 105.409910] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa077e3cf68 [ 105.409917] RBP: 00007fa077e3cf60 R08: 0000000000000000 R09: 0000000000000000 [ 105.409924] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa077e3cf6c [ 105.409931] R13: 00007ffd588133cf R14: 00007fa07529f300 R15: 0000000000022000 [ 105.409946] [ 105.409951] kmemleak: Object (percpu) 0x607f1a63e3e0 (size 8): [ 105.409957] kmemleak: comm "syz-executor.4", pid 3948, jiffies 4294772282 [ 105.409965] kmemleak: min_count = 1 [ 105.409969] kmemleak: count = 0 [ 105.409972] kmemleak: flags = 0x21 [ 105.409976] kmemleak: checksum = 0 [ 105.409980] kmemleak: backtrace: [ 105.409983] pcpu_alloc_noprof+0x87a/0x1170 [ 105.409999] perf_trace_event_init+0x366/0xa10 [ 105.410013] perf_trace_init+0x1a4/0x2f0 [ 105.410026] perf_tp_event_init+0xa6/0x120 [ 105.410042] perf_try_init_event+0x140/0x9f0 [ 105.410056] perf_event_alloc.part.0+0x118e/0x45f0 [ 105.410073] __do_sys_perf_event_open+0x719/0x2c20 [ 105.410086] do_syscall_64+0xbf/0x360 [ 105.410096] entry_SYSCALL_64_after_hwframe+0x77/0x7f 08:11:55 executing program 5: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:55 executing program 3: socket$inet6(0xa, 0x5, 0x6) 08:11:55 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:55 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) 08:11:55 executing program 5: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:55 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:55 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x28, r1, 0x601, 0x0, 0x0, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}]}]}, 0x28}}, 0x0) 08:11:55 executing program 6: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x3c}, 0x0, @in6=@ipv4}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) 08:11:55 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000c80), 0x80000, 0x0) 08:11:55 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(r0, 0x4b46, &(0x7f00000000c0)) 08:11:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:55 executing program 3: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/pm_async', 0x28001, 0x0) write$tcp_mem(r0, &(0x7f0000000280), 0x48) [ 105.712563] kmemleak: Found object by alias at 0x607f1a63e3e4 [ 105.712586] CPU: 1 UID: 0 PID: 3968 Comm: syz-executor.2 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 105.712605] Tainted: [W]=WARN [ 105.712609] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 105.712616] Call Trace: [ 105.712620] [ 105.712625] dump_stack_lvl+0xca/0x120 [ 105.712650] __lookup_object+0x94/0xb0 [ 105.712668] delete_object_full+0x27/0x70 [ 105.712684] free_percpu+0x30/0x1160 [ 105.712701] ? arch_uprobe_clear_state+0x16/0x140 [ 105.712721] futex_hash_free+0x38/0xc0 [ 105.712735] mmput+0x2d3/0x390 [ 105.712754] do_exit+0x79d/0x2970 [ 105.712768] ? lock_release+0xc8/0x290 [ 105.712785] ? __pfx_do_exit+0x10/0x10 [ 105.712799] ? find_held_lock+0x2b/0x80 [ 105.712816] ? get_signal+0x835/0x2340 [ 105.712837] do_group_exit+0xd3/0x2a0 [ 105.712852] get_signal+0x2315/0x2340 [ 105.712872] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 105.712888] ? __pfx_get_signal+0x10/0x10 [ 105.712905] ? do_futex+0x135/0x370 [ 105.712919] ? __pfx_do_futex+0x10/0x10 [ 105.712934] arch_do_signal_or_restart+0x80/0x790 [ 105.712952] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 105.712968] ? __x64_sys_futex+0x1c9/0x4d0 [ 105.712981] ? __x64_sys_futex+0x1d2/0x4d0 [ 105.712995] ? fput_close_sync+0x114/0x240 [ 105.713011] ? __pfx___x64_sys_futex+0x10/0x10 [ 105.713024] ? __pfx_fput_close_sync+0x10/0x10 [ 105.713040] ? dnotify_flush+0x79/0x4c0 [ 105.713056] exit_to_user_mode_loop+0x8b/0x110 [ 105.713068] do_syscall_64+0x2f7/0x360 [ 105.713081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.713093] RIP: 0033:0x7fa077d29b19 [ 105.713102] Code: Unable to access opcode bytes at 0x7fa077d29aef. [ 105.713108] RSP: 002b:00007fa07529f218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 105.713119] RAX: fffffffffffffe00 RBX: 00007fa077e3cf68 RCX: 00007fa077d29b19 [ 105.713127] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa077e3cf68 [ 105.713134] RBP: 00007fa077e3cf60 R08: 0000000000000000 R09: 0000000000000000 [ 105.713141] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa077e3cf6c [ 105.713148] R13: 00007ffd588133cf R14: 00007fa07529f300 R15: 0000000000022000 [ 105.713163] [ 105.713167] kmemleak: Object (percpu) 0x607f1a63e3e0 (size 8): [ 105.713174] kmemleak: comm "syz-executor.1", pid 3977, jiffies 4294772566 [ 105.713181] kmemleak: min_count = 1 [ 105.713185] kmemleak: count = 0 [ 105.713189] kmemleak: flags = 0x21 [ 105.713192] kmemleak: checksum = 0 [ 105.713196] kmemleak: backtrace: [ 105.713199] pcpu_alloc_noprof+0x87a/0x1170 [ 105.713215] perf_trace_event_init+0x366/0xa10 [ 105.713229] perf_trace_init+0x1a4/0x2f0 [ 105.713242] perf_tp_event_init+0xa6/0x120 [ 105.713258] perf_try_init_event+0x140/0x9f0 [ 105.713272] perf_event_alloc.part.0+0x118e/0x45f0 [ 105.713289] __do_sys_perf_event_open+0x719/0x2c20 [ 105.713303] do_syscall_64+0xbf/0x360 [ 105.713312] entry_SYSCALL_64_after_hwframe+0x77/0x7f 08:11:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:55 executing program 6: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x3c}, 0x0, @in6=@ipv4}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) 08:11:55 executing program 5: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000040)='.)\x00', 0x40, 0x0, &(0x7f0000000080)={0x74, 0x0, 0x8001, 0x7fffffff}) 08:11:55 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f00000005c0)=ANY=[], 0x20) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 08:11:55 executing program 3: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/pm_async', 0x28001, 0x0) write$tcp_mem(r0, &(0x7f0000000280), 0x48) [ 105.795040] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI [ 105.795958] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 105.796544] CPU: 1 UID: 0 PID: 3984 Comm: syz-executor.3 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 105.798512] Tainted: [W]=WARN [ 105.799255] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 105.800889] RIP: 0010:perf_tp_event+0x175/0xe70 [ 105.801820] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 105.805401] RSP: 0018:ffff88801bd7f780 EFLAGS: 00010012 [ 105.806346] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 105.807585] RDX: ffff8880431c3700 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 105.808146] RBP: ffff88801bd7f9f0 R08: ffff88806cf31340 R09: ffffe8ffffd163e0 [ 105.808696] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 105.809242] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 105.809796] FS: 000055556fb9f400(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 105.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.810863] CR2: 000055556fba0c18 CR3: 00000000424e3000 CR4: 0000000000350ef0 [ 105.811410] Call Trace: [ 105.811622] [ 105.811805] ? __pfx_perf_tp_event+0x10/0x10 [ 105.812158] ? arch_scale_cpu_capacity+0x17/0xa0 [ 105.812537] ? cpu_util.constprop.0+0x17d/0x340 [ 105.812911] ? __asan_memset+0x24/0x50 [ 105.813217] ? sched_balance_find_dst_group+0xa9a/0x1c00 [ 105.813638] ? lock_release+0xc8/0x290 [ 105.813949] ? __pfx_sched_balance_find_dst_group+0x10/0x10 [ 105.814387] ? __lock_acquire+0x694/0x1b70 [ 105.814720] ? perf_trace_run_bpf_submit+0xef/0x180 [ 105.815113] ? sched_clock+0x37/0x60 [ 105.815412] ? sched_clock_cpu+0x6c/0x4e0 [ 105.815748] ? lock_is_held_type+0x9e/0x120 [ 105.816089] perf_trace_run_bpf_submit+0xef/0x180 [ 105.816473] perf_trace_preemptirq_template+0x259/0x430 [ 105.816888] ? lock_is_held_type+0x9e/0x120 [ 105.817229] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 105.817686] ? _raw_spin_lock_irqsave+0x53/0x60 [ 105.818055] trace_irq_disable.constprop.0+0xa6/0x100 [ 105.818456] _raw_spin_lock_irqsave+0x53/0x60 [ 105.818813] try_to_wake_up+0xa0/0x11d0 [ 105.819131] ? __pfx_try_to_wake_up+0x10/0x10 [ 105.819488] ? plist_del+0x122/0x270 [ 105.819793] ? find_held_lock+0x2b/0x80 [ 105.820111] ? futex_wake+0x474/0x540 [ 105.820417] wake_up_q+0xa1/0x130 [ 105.820698] futex_wake+0x47e/0x540 [ 105.820990] ? __pfx_futex_wake+0x10/0x10 [ 105.821319] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 105.821727] ? finish_task_switch.isra.0+0x206/0x840 [ 105.822132] do_futex+0x26d/0x370 [ 105.822411] ? __pfx_do_futex+0x10/0x10 [ 105.822725] ? __pfx___schedule+0x10/0x10 [ 105.823054] __x64_sys_futex+0x1c9/0x4d0 [ 105.823376] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 105.823832] ? __pfx___x64_sys_futex+0x10/0x10 [ 105.824191] ? xfd_validate_state+0x55/0x180 [ 105.824544] do_syscall_64+0xbf/0x360 [ 105.824845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.825244] RIP: 0033:0x7f28de7f6b19 [ 105.825535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 105.826926] RSP: 002b:00007ffd1e326fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 105.827509] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f28de7f6b19 [ 105.828063] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f28de909f68 [ 105.828610] RBP: 00007f28de909f60 R08: 00007f28dbd6c700 R09: 0000000000000000 [ 105.829157] R10: 00007f28dbd6c700 R11: 0000000000000246 R12: 00007f28de90e0b0 [ 105.829709] R13: 00007ffd1e3270c0 R14: 00007f28de909f60 R15: 0000000000019cdb [ 105.830261] [ 105.830447] Modules linked in: [ 105.830701] ---[ end trace 0000000000000000 ]--- [ 105.831064] RIP: 0010:perf_tp_event+0x175/0xe70 [ 105.831433] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 105.832834] RSP: 0018:ffff88801bd7f780 EFLAGS: 00010012 [ 105.833245] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 105.833792] RDX: ffff8880431c3700 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 105.834340] RBP: ffff88801bd7f9f0 R08: ffff88806cf31340 R09: ffffe8ffffd163e0 [ 105.834890] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 105.835438] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 105.836001] FS: 000055556fb9f400(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 105.836616] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.837067] CR2: 000055556fba0c18 CR3: 00000000424e3000 CR4: 0000000000350ef0 [ 105.837615] note: syz-executor.3[3984] exited with irqs disabled [ 105.838132] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI [ 105.838991] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 105.839573] CPU: 1 UID: 0 PID: 3984 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 105.840501] Tainted: [D]=DIE, [W]=WARN [ 105.840800] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 105.841430] RIP: 0010:perf_tp_event+0x175/0xe70 [ 105.841801] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 105.843190] RSP: 0018:ffff88806cf08ac0 EFLAGS: 00010012 [ 105.843609] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 105.844158] RDX: ffff8880431c3700 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 105.844708] RBP: ffff88806cf08d30 R08: ffff88806cf313e8 R09: ffffe8ffffd163e0 [ 105.845256] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 105.845805] R13: 0000000000000014 R14: ffff88806cf313e8 R15: dffffc0000000000 [ 105.846356] FS: 000055556fb9f400(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 105.846976] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.847423] CR2: 000055556fba0c18 CR3: 00000000424e3000 CR4: 0000000000350ef0 [ 105.847975] Call Trace: [ 105.848177] [ 105.848351] ? enqueue_task_fair+0xded/0x1e00 [ 105.848710] ? __pfx_perf_tp_event+0x10/0x10 [ 105.849061] ? trace_pelt_se_tp+0xdf/0x130 [ 105.849394] ? __update_load_avg_se+0x428/0xa40 [ 105.849766] ? __cgroup_account_cputime+0x30/0xc0 [ 105.850151] ? update_load_avg+0x17d/0x1ef0 [ 105.850489] ? update_cfs_group+0x11d/0x260 [ 105.850828] ? kvm_sched_clock_read+0x16/0x30 [ 105.851186] ? enqueue_task_fair+0xded/0x1e00 [ 105.851542] ? check_preempt_wakeup_fair+0x6e/0x950 [ 105.851941] ? wakeup_preempt+0x140/0x2a0 [ 105.852267] ? lock_release+0x1c7/0x290 [ 105.852581] ? lock_release+0x1c7/0x290 [ 105.852897] ? perf_trace_run_bpf_submit+0xef/0x180 [ 105.853290] perf_trace_run_bpf_submit+0xef/0x180 [ 105.853672] perf_trace_preemptirq_template+0x259/0x430 [ 105.854084] ? lock_release+0x1c7/0x290 [ 105.854398] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 105.854853] ? lock_acquire+0x18c/0x2f0 [ 105.855169] ? irqentry_enter+0x2a/0x60 [ 105.855489] trace_irq_disable.constprop.0+0xa6/0x100 [ 105.855901] irqentry_enter+0x2a/0x60 [ 105.856207] sysvec_call_function_single+0x18/0xc0 [ 105.856596] asm_sysvec_call_function_single+0x1a/0x20 [ 105.857004] RIP: 0010:handle_softirqs+0x174/0x770 [ 105.857389] Code: c8 83 83 3c 0a 00 00 01 c7 44 24 20 0a 00 00 00 48 89 44 24 18 65 66 c7 05 0f d4 48 06 00 00 e8 72 8f 40 00 fb bb ff ff ff ff <48> c7 c5 c0 c0 a0 85 41 0f bc de 83 c3 01 0f 85 9b 00 00 00 e9 8d [ 105.858788] RSP: 0018:ffff88806cf08f78 EFLAGS: 00000246 [ 105.859203] RAX: 0000000000000001 RBX: 00000000ffffffff RCX: ffffffff817c3ab6 [ 105.859758] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813bac2e [ 105.860305] RBP: ffff88801bd7fe78 R08: 0000000000000000 R09: 0000000000000000 [ 105.860853] R10: ffffffff8643b457 R11: ffff888017d9a898 R12: 0000000000000000 [ 105.861404] R13: 0000000000000000 R14: 0000000000000382 R15: 0000000000000000 [ 105.861950] ? trace_irq_enable.constprop.0+0x26/0x100 [ 105.862359] ? handle_softirqs+0x16e/0x770 [ 105.862699] ? handle_softirqs+0x16e/0x770 [ 105.863039] __irq_exit_rcu+0xc4/0x100 [ 105.863355] irq_exit_rcu+0x9/0x20 [ 105.863642] sysvec_apic_timer_interrupt+0x70/0x80 [ 105.864029] [ 105.864212] [ 105.864391] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.864803] RIP: 0010:make_task_dead+0xa2/0x3b0 [ 105.865172] Code: 38 00 85 db 0f 84 21 01 00 00 e8 09 a6 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 57 a1 38 00 48 85 db 0f 84 17 01 00 00 e9 a5 38 00 31 ff 65 8b 1d 60 2f 49 06 81 e3 ff ff ff 7f 89 de [ 105.866568] RSP: 0018:ffff88801bd7ff28 EFLAGS: 00000246 [ 105.866984] RAX: 0000000000000001 RBX: ffff8880431c3700 RCX: ffffffff817c3ab6 [ 105.867535] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234 [ 105.868088] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 [ 105.868636] R10: ffffffff8643b457 R11: 0000000000000001 R12: ffff8880431c3700 [ 105.869183] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000 [ 105.869735] ? trace_irq_enable.constprop.0+0x26/0x100 [ 105.870140] ? make_task_dead+0x214/0x3b0 [ 105.870470] ? make_task_dead+0x214/0x3b0 [ 105.870804] ? do_syscall_64+0xbf/0x360 [ 105.871120] rewind_stack_and_make_dead+0x16/0x20 [ 105.871500] RIP: 0033:0x7f28de7f6b19 [ 105.871796] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 105.873185] RSP: 002b:00007ffd1e326fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 105.873768] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f28de7f6b19 [ 105.874317] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f28de909f68 [ 105.874868] RBP: 00007f28de909f60 R08: 00007f28dbd6c700 R09: 0000000000000000 [ 105.875411] R10: 00007f28dbd6c700 R11: 0000000000000246 R12: 00007f28de90e0b0 [ 105.875973] R13: 00007ffd1e3270c0 R14: 00007f28de909f60 R15: 0000000000019cdb [ 105.876527] [ 105.876714] Modules linked in: [ 105.876970] ---[ end trace 0000000000000000 ]--- [ 105.877333] RIP: 0010:perf_tp_event+0x175/0xe70 [ 105.877702] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 105.879093] RSP: 0018:ffff88801bd7f780 EFLAGS: 00010012 [ 105.879502] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 105.880060] RDX: ffff8880431c3700 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 105.880608] RBP: ffff88801bd7f9f0 R08: ffff88806cf31340 R09: ffffe8ffffd163e0 [ 105.881155] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 105.881706] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 105.882252] FS: 000055556fb9f400(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 105.882869] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.883320] CR2: 000055556fba0c18 CR3: 00000000424e3000 CR4: 0000000000350ef0 [ 105.883876] Kernel panic - not syncing: Fatal exception in interrupt [ 105.884451] Kernel Offset: disabled [ 105.884737] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 08:11:55 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=ffff88806cf3c300 RCX=ffffffff816880fc RDX=ffff888044f2d280 RSI=ffffffff816880d6 RDI=0000000000000005 RBP=0000000000000003 RSP=ffff888044f67988 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000001 R11=1ffff1100d9c6bb1 R12=ffffed100d9e7861 R13=ffff88806cf3c308 R14=0000000000000001 R15=dffffc0000000000 RIP=ffffffff816880d8 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055555eb5a400 00000000 00000000 GS =0000 ffff8880e55d8000 00000000 00000000 LDT=0000 fffffe2400000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2d024000 CR3=00000000413cf000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000ff00000000000000 XMM01=00000000000000000100000000000000 XMM02=7463656a6e695f31313230385f7a7973 XMM03=00007f65143537c800007f65143537c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff88801bd7f0f0 R8 =0000000000000000 R9 =ffffed10016d1046 R10=0000000000000030 R11=6666666666662052 R12=0000000000000030 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0 RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055556fb9f400 00000000 00000000 GS =0000 ffff8880e56d8000 00000000 00000000 LDT=0000 fffffe4900000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055556fba0c18 CR3=00000000424e3000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f28de8dd7c000007f28de8dd7c8 XMM02=00007f28de8dd7e000007f28de8dd7c0 XMM03=00007f28de8dd7c800007f28de8dd7c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000