Warning: Permanently added '[localhost]:14106' (ECDSA) to the list of known hosts.
2025/09/01 11:42:59 fuzzer started
2025/09/01 11:43:00 dialing manager at localhost:35473
syzkaller login: [   54.973269] cgroup: Unknown subsys name 'net'
[   54.999975] cgroup: Unknown subsys name 'cpuset'
[   55.006661] cgroup: Unknown subsys name 'rlimit'
2025/09/01 11:43:10 syscalls: 2214
2025/09/01 11:43:10 code coverage: enabled
2025/09/01 11:43:10 comparison tracing: enabled
2025/09/01 11:43:10 extra coverage: enabled
2025/09/01 11:43:10 setuid sandbox: enabled
2025/09/01 11:43:10 namespace sandbox: enabled
2025/09/01 11:43:10 Android sandbox: enabled
2025/09/01 11:43:10 fault injection: enabled
2025/09/01 11:43:10 leak checking: enabled
2025/09/01 11:43:10 net packet injection: enabled
2025/09/01 11:43:10 net device setup: enabled
2025/09/01 11:43:10 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 11:43:10 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 11:43:10 USB emulation: enabled
2025/09/01 11:43:10 hci packet injection: enabled
2025/09/01 11:43:10 wifi device emulation: enabled
2025/09/01 11:43:10 802.15.4 emulation: enabled
2025/09/01 11:43:10 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 11:43:10 fetching corpus: 50, signal 21233/24770 (executing program)
2025/09/01 11:43:10 fetching corpus: 100, signal 33538/38453 (executing program)
2025/09/01 11:43:10 fetching corpus: 150, signal 40891/47122 (executing program)
2025/09/01 11:43:10 fetching corpus: 200, signal 46542/54041 (executing program)
2025/09/01 11:43:10 fetching corpus: 250, signal 52892/61486 (executing program)
2025/09/01 11:43:10 fetching corpus: 300, signal 56751/66491 (executing program)
2025/09/01 11:43:10 fetching corpus: 350, signal 60811/71630 (executing program)
2025/09/01 11:43:11 fetching corpus: 400, signal 70131/81411 (executing program)
2025/09/01 11:43:11 fetching corpus: 450, signal 72892/85149 (executing program)
2025/09/01 11:43:11 fetching corpus: 500, signal 77475/90477 (executing program)
2025/09/01 11:43:11 fetching corpus: 550, signal 80167/94059 (executing program)
2025/09/01 11:43:11 fetching corpus: 600, signal 82720/97486 (executing program)
2025/09/01 11:43:11 fetching corpus: 650, signal 84297/100005 (executing program)
2025/09/01 11:43:11 fetching corpus: 700, signal 86739/103172 (executing program)
2025/09/01 11:43:11 fetching corpus: 750, signal 88698/105903 (executing program)
2025/09/01 11:43:11 fetching corpus: 800, signal 90490/108520 (executing program)
2025/09/01 11:43:11 fetching corpus: 850, signal 92228/110958 (executing program)
2025/09/01 11:43:11 fetching corpus: 900, signal 94370/113752 (executing program)
2025/09/01 11:43:12 fetching corpus: 950, signal 96293/116287 (executing program)
2025/09/01 11:43:12 fetching corpus: 1000, signal 98376/118961 (executing program)
2025/09/01 11:43:12 fetching corpus: 1050, signal 99992/121213 (executing program)
2025/09/01 11:43:12 fetching corpus: 1100, signal 101474/123308 (executing program)
2025/09/01 11:43:12 fetching corpus: 1150, signal 103822/126028 (executing program)
2025/09/01 11:43:12 fetching corpus: 1200, signal 104710/127621 (executing program)
2025/09/01 11:43:12 fetching corpus: 1250, signal 106121/129581 (executing program)
2025/09/01 11:43:12 fetching corpus: 1300, signal 107124/131195 (executing program)
2025/09/01 11:43:12 fetching corpus: 1350, signal 108147/132823 (executing program)
2025/09/01 11:43:12 fetching corpus: 1400, signal 109526/134668 (executing program)
2025/09/01 11:43:13 fetching corpus: 1450, signal 111281/136784 (executing program)
2025/09/01 11:43:13 fetching corpus: 1500, signal 112956/138769 (executing program)
2025/09/01 11:43:13 fetching corpus: 1550, signal 114216/140425 (executing program)
2025/09/01 11:43:13 fetching corpus: 1600, signal 115319/141923 (executing program)
2025/09/01 11:43:13 fetching corpus: 1650, signal 116512/143472 (executing program)
2025/09/01 11:43:13 fetching corpus: 1700, signal 117766/145082 (executing program)
2025/09/01 11:43:13 fetching corpus: 1750, signal 118922/146587 (executing program)
2025/09/01 11:43:13 fetching corpus: 1800, signal 119932/148000 (executing program)
2025/09/01 11:43:13 fetching corpus: 1850, signal 121478/149724 (executing program)
2025/09/01 11:43:13 fetching corpus: 1900, signal 122604/151104 (executing program)
2025/09/01 11:43:14 fetching corpus: 1950, signal 123461/152358 (executing program)
2025/09/01 11:43:14 fetching corpus: 2000, signal 124294/153566 (executing program)
2025/09/01 11:43:14 fetching corpus: 2050, signal 125581/154983 (executing program)
2025/09/01 11:43:14 fetching corpus: 2100, signal 126792/156320 (executing program)
2025/09/01 11:43:14 fetching corpus: 2150, signal 127600/157463 (executing program)
2025/09/01 11:43:14 fetching corpus: 2200, signal 128322/158532 (executing program)
2025/09/01 11:43:14 fetching corpus: 2250, signal 128992/159599 (executing program)
2025/09/01 11:43:14 fetching corpus: 2300, signal 130054/160809 (executing program)
2025/09/01 11:43:14 fetching corpus: 2350, signal 130982/161934 (executing program)
2025/09/01 11:43:14 fetching corpus: 2400, signal 131702/162928 (executing program)
2025/09/01 11:43:14 fetching corpus: 2450, signal 132327/163899 (executing program)
2025/09/01 11:43:14 fetching corpus: 2500, signal 133240/164990 (executing program)
2025/09/01 11:43:15 fetching corpus: 2550, signal 134022/165963 (executing program)
2025/09/01 11:43:15 fetching corpus: 2600, signal 134817/166956 (executing program)
2025/09/01 11:43:15 fetching corpus: 2650, signal 136355/168260 (executing program)
2025/09/01 11:43:15 fetching corpus: 2700, signal 137067/169180 (executing program)
2025/09/01 11:43:15 fetching corpus: 2750, signal 137791/170044 (executing program)
2025/09/01 11:43:15 fetching corpus: 2800, signal 138738/171112 (executing program)
2025/09/01 11:43:15 fetching corpus: 2850, signal 139554/171962 (executing program)
2025/09/01 11:43:15 fetching corpus: 2900, signal 140198/172740 (executing program)
2025/09/01 11:43:15 fetching corpus: 2950, signal 140815/173535 (executing program)
2025/09/01 11:43:15 fetching corpus: 3000, signal 141577/174380 (executing program)
2025/09/01 11:43:15 fetching corpus: 3050, signal 142211/175146 (executing program)
2025/09/01 11:43:15 fetching corpus: 3100, signal 143089/175998 (executing program)
2025/09/01 11:43:16 fetching corpus: 3150, signal 143765/176825 (executing program)
2025/09/01 11:43:16 fetching corpus: 3200, signal 144328/177564 (executing program)
2025/09/01 11:43:16 fetching corpus: 3250, signal 144913/178288 (executing program)
2025/09/01 11:43:16 fetching corpus: 3300, signal 145435/178960 (executing program)
2025/09/01 11:43:16 fetching corpus: 3350, signal 146073/179712 (executing program)
2025/09/01 11:43:16 fetching corpus: 3400, signal 146554/180373 (executing program)
2025/09/01 11:43:16 fetching corpus: 3450, signal 147064/180997 (executing program)
2025/09/01 11:43:16 fetching corpus: 3500, signal 147633/181646 (executing program)
2025/09/01 11:43:16 fetching corpus: 3550, signal 148323/182310 (executing program)
2025/09/01 11:43:16 fetching corpus: 3600, signal 148982/182897 (executing program)
2025/09/01 11:43:16 fetching corpus: 3650, signal 149428/183422 (executing program)
2025/09/01 11:43:16 fetching corpus: 3700, signal 149984/183992 (executing program)
2025/09/01 11:43:17 fetching corpus: 3750, signal 150388/184535 (executing program)
2025/09/01 11:43:17 fetching corpus: 3800, signal 150916/185086 (executing program)
2025/09/01 11:43:17 fetching corpus: 3850, signal 151472/185647 (executing program)
2025/09/01 11:43:17 fetching corpus: 3900, signal 152142/186188 (executing program)
2025/09/01 11:43:17 fetching corpus: 3950, signal 152606/186762 (executing program)
2025/09/01 11:43:17 fetching corpus: 4000, signal 153312/187305 (executing program)
2025/09/01 11:43:17 fetching corpus: 4050, signal 153655/187772 (executing program)
2025/09/01 11:43:17 fetching corpus: 4100, signal 154337/188329 (executing program)
2025/09/01 11:43:17 fetching corpus: 4150, signal 154829/188813 (executing program)
2025/09/01 11:43:17 fetching corpus: 4200, signal 155392/189314 (executing program)
2025/09/01 11:43:17 fetching corpus: 4250, signal 155763/189767 (executing program)
2025/09/01 11:43:17 fetching corpus: 4300, signal 156247/190192 (executing program)
2025/09/01 11:43:18 fetching corpus: 4350, signal 156653/190634 (executing program)
2025/09/01 11:43:18 fetching corpus: 4400, signal 156917/191067 (executing program)
2025/09/01 11:43:18 fetching corpus: 4450, signal 157255/191473 (executing program)
2025/09/01 11:43:18 fetching corpus: 4500, signal 157699/191874 (executing program)
2025/09/01 11:43:18 fetching corpus: 4550, signal 158349/192322 (executing program)
2025/09/01 11:43:18 fetching corpus: 4600, signal 158964/192726 (executing program)
2025/09/01 11:43:18 fetching corpus: 4650, signal 159454/193118 (executing program)
2025/09/01 11:43:18 fetching corpus: 4700, signal 159840/193516 (executing program)
2025/09/01 11:43:18 fetching corpus: 4750, signal 160451/193673 (executing program)
2025/09/01 11:43:18 fetching corpus: 4800, signal 160930/193683 (executing program)
2025/09/01 11:43:18 fetching corpus: 4850, signal 161380/193689 (executing program)
2025/09/01 11:43:19 fetching corpus: 4900, signal 162054/193714 (executing program)
2025/09/01 11:43:19 fetching corpus: 4950, signal 162511/193714 (executing program)
2025/09/01 11:43:19 fetching corpus: 5000, signal 162948/193721 (executing program)
2025/09/01 11:43:19 fetching corpus: 5050, signal 163347/193721 (executing program)
2025/09/01 11:43:19 fetching corpus: 5100, signal 163715/193722 (executing program)
2025/09/01 11:43:19 fetching corpus: 5150, signal 164112/193723 (executing program)
2025/09/01 11:43:19 fetching corpus: 5200, signal 164516/193737 (executing program)
2025/09/01 11:43:19 fetching corpus: 5250, signal 165042/193741 (executing program)
2025/09/01 11:43:19 fetching corpus: 5300, signal 165573/193767 (executing program)
2025/09/01 11:43:19 fetching corpus: 5350, signal 165865/193777 (executing program)
2025/09/01 11:43:19 fetching corpus: 5400, signal 166266/193798 (executing program)
2025/09/01 11:43:19 fetching corpus: 5450, signal 166838/193798 (executing program)
2025/09/01 11:43:20 fetching corpus: 5500, signal 167116/193799 (executing program)
2025/09/01 11:43:20 fetching corpus: 5550, signal 167487/193804 (executing program)
2025/09/01 11:43:20 fetching corpus: 5600, signal 167875/193849 (executing program)
2025/09/01 11:43:20 fetching corpus: 5650, signal 168273/193851 (executing program)
2025/09/01 11:43:20 fetching corpus: 5700, signal 168768/193855 (executing program)
2025/09/01 11:43:20 fetching corpus: 5750, signal 169158/193871 (executing program)
2025/09/01 11:43:20 fetching corpus: 5800, signal 169379/193886 (executing program)
2025/09/01 11:43:20 fetching corpus: 5850, signal 169640/193889 (executing program)
2025/09/01 11:43:20 fetching corpus: 5900, signal 169949/193896 (executing program)
2025/09/01 11:43:20 fetching corpus: 5950, signal 170553/193930 (executing program)
2025/09/01 11:43:20 fetching corpus: 6000, signal 171191/193934 (executing program)
2025/09/01 11:43:20 fetching corpus: 6050, signal 171506/193944 (executing program)
2025/09/01 11:43:21 fetching corpus: 6100, signal 171850/193956 (executing program)
2025/09/01 11:43:21 fetching corpus: 6150, signal 172191/193972 (executing program)
2025/09/01 11:43:21 fetching corpus: 6200, signal 172395/193981 (executing program)
2025/09/01 11:43:21 fetching corpus: 6250, signal 172763/193983 (executing program)
2025/09/01 11:43:21 fetching corpus: 6300, signal 173606/194009 (executing program)
2025/09/01 11:43:21 fetching corpus: 6350, signal 173943/194015 (executing program)
2025/09/01 11:43:21 fetching corpus: 6400, signal 174316/194040 (executing program)
2025/09/01 11:43:21 fetching corpus: 6450, signal 175071/194060 (executing program)
2025/09/01 11:43:21 fetching corpus: 6500, signal 175690/194063 (executing program)
2025/09/01 11:43:21 fetching corpus: 6550, signal 175937/194065 (executing program)
2025/09/01 11:43:21 fetching corpus: 6600, signal 176346/194067 (executing program)
2025/09/01 11:43:21 fetching corpus: 6650, signal 176633/194067 (executing program)
2025/09/01 11:43:21 fetching corpus: 6700, signal 176887/194069 (executing program)
2025/09/01 11:43:21 fetching corpus: 6750, signal 177099/194072 (executing program)
2025/09/01 11:43:22 fetching corpus: 6800, signal 177860/194076 (executing program)
2025/09/01 11:43:22 fetching corpus: 6850, signal 178157/194099 (executing program)
2025/09/01 11:43:22 fetching corpus: 6900, signal 178438/194120 (executing program)
2025/09/01 11:43:22 fetching corpus: 6950, signal 178866/194134 (executing program)
2025/09/01 11:43:22 fetching corpus: 7000, signal 179232/194136 (executing program)
2025/09/01 11:43:22 fetching corpus: 7050, signal 179496/194136 (executing program)
2025/09/01 11:43:22 fetching corpus: 7100, signal 179834/194146 (executing program)
2025/09/01 11:43:22 fetching corpus: 7150, signal 180059/194159 (executing program)
2025/09/01 11:43:22 fetching corpus: 7200, signal 180584/194170 (executing program)
2025/09/01 11:43:22 fetching corpus: 7250, signal 180846/194170 (executing program)
2025/09/01 11:43:22 fetching corpus: 7300, signal 181065/194172 (executing program)
2025/09/01 11:43:22 fetching corpus: 7350, signal 181435/194216 (executing program)
2025/09/01 11:43:22 fetching corpus: 7400, signal 181730/194223 (executing program)
2025/09/01 11:43:23 fetching corpus: 7450, signal 182031/194225 (executing program)
2025/09/01 11:43:23 fetching corpus: 7500, signal 182296/194241 (executing program)
2025/09/01 11:43:23 fetching corpus: 7550, signal 182564/194245 (executing program)
2025/09/01 11:43:23 fetching corpus: 7600, signal 182855/194264 (executing program)
2025/09/01 11:43:23 fetching corpus: 7650, signal 183133/194265 (executing program)
2025/09/01 11:43:23 fetching corpus: 7700, signal 183458/194268 (executing program)
2025/09/01 11:43:23 fetching corpus: 7750, signal 183771/194270 (executing program)
2025/09/01 11:43:23 fetching corpus: 7800, signal 184192/194273 (executing program)
2025/09/01 11:43:23 fetching corpus: 7850, signal 184508/194313 (executing program)
2025/09/01 11:43:23 fetching corpus: 7900, signal 184879/194317 (executing program)
2025/09/01 11:43:23 fetching corpus: 7950, signal 185025/194324 (executing program)
2025/09/01 11:43:23 fetching corpus: 8000, signal 185275/194324 (executing program)
2025/09/01 11:43:24 fetching corpus: 8050, signal 185696/194328 (executing program)
2025/09/01 11:43:24 fetching corpus: 8100, signal 186018/194328 (executing program)
2025/09/01 11:43:24 fetching corpus: 8150, signal 186305/194330 (executing program)
2025/09/01 11:43:24 fetching corpus: 8200, signal 186525/194336 (executing program)
2025/09/01 11:43:24 fetching corpus: 8250, signal 186845/194337 (executing program)
2025/09/01 11:43:24 fetching corpus: 8300, signal 187352/194348 (executing program)
2025/09/01 11:43:24 fetching corpus: 8350, signal 187591/194349 (executing program)
2025/09/01 11:43:24 fetching corpus: 8400, signal 187901/194351 (executing program)
2025/09/01 11:43:24 fetching corpus: 8450, signal 188188/194363 (executing program)
2025/09/01 11:43:24 fetching corpus: 8500, signal 188461/194367 (executing program)
2025/09/01 11:43:24 fetching corpus: 8550, signal 188739/194418 (executing program)
2025/09/01 11:43:24 fetching corpus: 8600, signal 189354/194448 (executing program)
2025/09/01 11:43:25 fetching corpus: 8650, signal 189582/194451 (executing program)
2025/09/01 11:43:25 fetching corpus: 8700, signal 190005/194453 (executing program)
2025/09/01 11:43:25 fetching corpus: 8750, signal 190205/194455 (executing program)
2025/09/01 11:43:25 fetching corpus: 8800, signal 190450/194455 (executing program)
2025/09/01 11:43:25 fetching corpus: 8850, signal 190756/194470 (executing program)
2025/09/01 11:43:25 fetching corpus: 8900, signal 190984/194476 (executing program)
2025/09/01 11:43:25 fetching corpus: 8950, signal 191156/194481 (executing program)
2025/09/01 11:43:25 fetching corpus: 9000, signal 191372/194486 (executing program)
2025/09/01 11:43:25 fetching corpus: 9050, signal 191600/194493 (executing program)
2025/09/01 11:43:25 fetching corpus: 9063, signal 191660/194493 (executing program)
2025/09/01 11:43:25 fetching corpus: 9063, signal 191660/194493 (executing program)
2025/09/01 11:43:27 starting 8 fuzzer processes
11:43:27 executing program 0:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
write$binfmt_script(r0, 0x0, 0x144)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000))

11:43:27 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2c, &(0x7f0000000080), 0x4)

11:43:27 executing program 2:
r0 = memfd_secret(0x0)
read$char_usb(r0, 0x0, 0x0)

11:43:27 executing program 7:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff)
sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, &(0x7f0000000180)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x729, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}}, 0x0)

11:43:27 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='comm\x00')
writev(r0, &(0x7f0000000300)=[{&(0x7f0000000100)="f0", 0x1}], 0x1)

11:43:27 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000001240)={0x1c, r1, 0x5, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x0)

11:43:27 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
setsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f00000000c0)={@multicast2, @remote, @multicast2}, 0xc)

11:43:27 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

[   82.773148] audit: type=1400 audit(1756727007.965:7): avc:  denied  { execmem } for  pid=273 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[   84.091139] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   84.095836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   84.097738] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   84.099071] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   84.105965] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   84.107287] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   84.110148] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   84.114600] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   84.119333] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   84.123549] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   84.126684] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   84.128090] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   84.132572] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   84.134778] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   84.137012] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   84.140093] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   84.145580] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   84.147081] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   84.148658] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   84.149222] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   84.152847] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   84.153278] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   84.154300] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   84.156525] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   84.159773] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   84.161804] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   84.169782] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   84.172834] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   84.177421] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   84.179032] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   84.179645] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   84.181730] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   84.183427] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   84.187226] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   84.187663] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   84.207118] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   84.222876] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   84.225909] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   84.228817] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   84.230941] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   86.241339] Bluetooth: hci4: command tx timeout
[   86.242897] Bluetooth: hci0: command tx timeout
[   86.242987] Bluetooth: hci3: command tx timeout
[   86.243639] Bluetooth: hci5: command tx timeout
[   86.244969] Bluetooth: hci2: command tx timeout
[   86.304546] Bluetooth: hci6: command tx timeout
[   86.305271] Bluetooth: hci7: command tx timeout
[   86.306012] Bluetooth: hci1: command tx timeout
[   88.288466] Bluetooth: hci5: command tx timeout
[   88.288933] Bluetooth: hci2: command tx timeout
[   88.289551] Bluetooth: hci4: command tx timeout
[   88.289955] Bluetooth: hci3: command tx timeout
[   88.290341] Bluetooth: hci0: command tx timeout
[   88.352430] Bluetooth: hci6: command tx timeout
[   88.352843] Bluetooth: hci7: command tx timeout
[   88.353227] Bluetooth: hci1: command tx timeout
[   90.336568] Bluetooth: hci0: command tx timeout
[   90.337036] Bluetooth: hci3: command tx timeout
[   90.338348] Bluetooth: hci4: command tx timeout
[   90.338807] Bluetooth: hci2: command tx timeout
[   90.338836] Bluetooth: hci5: command tx timeout
[   90.400857] Bluetooth: hci1: command tx timeout
[   90.400899] Bluetooth: hci6: command tx timeout
[   90.401347] Bluetooth: hci7: command tx timeout
[   92.384551] Bluetooth: hci4: command tx timeout
[   92.385051] Bluetooth: hci0: command tx timeout
[   92.386470] Bluetooth: hci2: command tx timeout
[   92.386912] Bluetooth: hci3: command tx timeout
[   92.387263] Bluetooth: hci5: command tx timeout
[   92.448533] Bluetooth: hci1: command tx timeout
[   92.448703] Bluetooth: hci6: command tx timeout
[   92.449003] Bluetooth: hci7: command tx timeout
[  120.595822] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  120.597266] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  120.847675] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  120.849396] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  121.192788] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.194220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  121.373403] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.374308] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:44:06 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

[  121.478427] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.479256] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:44:06 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

11:44:06 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

[  121.643398] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.644235] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:44:06 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

[  121.673927] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.674636] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:44:06 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

[  121.730961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.731929] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:44:06 executing program 3:
io_setup(0xfff, &(0x7f0000000040)=<r0=>0x0)
r1 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
io_submit(r0, 0x1, &(0x7f00000003c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}])

11:44:06 executing program 5:
mlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000)
munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x15)
madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x14)
mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0)

[  121.813622] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.814241] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:44:07 executing program 3:
io_setup(0xfff, &(0x7f0000000040)=<r0=>0x0)
r1 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
io_submit(r0, 0x1, &(0x7f00000003c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}])

[  121.907109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.907992] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  121.932728] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.933308] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  121.980072] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  121.980687] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  122.028344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  122.029001] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  122.113027] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  122.113669] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  122.162880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  122.163452] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  122.194324] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  122.194977] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  122.202080] audit: type=1400 audit(1756727047.392:8): avc:  denied  { open } for  pid=3903 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  122.203796] audit: type=1400 audit(1756727047.392:9): avc:  denied  { kernel } for  pid=3903 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  122.327299] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  122.353730] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  122.382535] syz-executor.6 (3912) used greatest stack depth: 22960 bytes left
11:44:07 executing program 7:
syz_mount_image$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount$cgroup(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x2000, 0x0)

11:44:07 executing program 2:
r0 = memfd_secret(0x0)
read$char_usb(r0, 0x0, 0x0)

11:44:07 executing program 5:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019040)='/proc/partitions\x00', 0x0, 0x0)
pread64(r0, &(0x7f0000000040)=""/102400, 0x19000, 0x0)

11:44:07 executing program 3:
io_setup(0xfff, &(0x7f0000000040)=<r0=>0x0)
r1 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
io_submit(r0, 0x1, &(0x7f00000003c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}])

11:44:07 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
setsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f00000000c0)={@multicast2, @remote, @multicast2}, 0xc)

11:44:07 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$DVD_AUTH(r0, 0x5303, &(0x7f0000000140)=@lsc={0x3, 0x0, "8c2e9c993edfe1625d5a"})

11:44:07 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2c, &(0x7f0000000080), 0x4)

11:44:07 executing program 0:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
write$binfmt_script(r0, 0x0, 0x144)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000))

11:44:07 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2c, &(0x7f0000000080), 0x4)

11:44:07 executing program 2:
r0 = memfd_secret(0x0)
read$char_usb(r0, 0x0, 0x0)

11:44:07 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r1, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r1, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
dup2(r0, r1)

11:44:07 executing program 5:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019040)='/proc/partitions\x00', 0x0, 0x0)
pread64(r0, &(0x7f0000000040)=""/102400, 0x19000, 0x0)

11:44:07 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
setsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f00000000c0)={@multicast2, @remote, @multicast2}, 0xc)

11:44:07 executing program 3:
io_setup(0xfff, &(0x7f0000000040)=<r0=>0x0)
r1 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
io_submit(r0, 0x1, &(0x7f00000003c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}])

11:44:07 executing program 0:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
write$binfmt_script(r0, 0x0, 0x144)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000))

11:44:07 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$DVD_AUTH(r0, 0x5303, &(0x7f0000000140)=@lsc={0x3, 0x0, "8c2e9c993edfe1625d5a"})

11:44:07 executing program 2:
r0 = memfd_secret(0x0)
read$char_usb(r0, 0x0, 0x0)

11:44:07 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2c, &(0x7f0000000080), 0x4)

11:44:07 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000640)={@multicast2, @dev}, 0x8)
setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000000)={@multicast2, @remote, @multicast2}, 0xc)
setsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f00000000c0)={@multicast2, @remote, @multicast2}, 0xc)

11:44:07 executing program 5:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019040)='/proc/partitions\x00', 0x0, 0x0)
pread64(r0, &(0x7f0000000040)=""/102400, 0x19000, 0x0)

11:44:07 executing program 1:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$VT_ACTIVATE(r0, 0x2282, 0x4000000000000)

11:44:07 executing program 0:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
write$binfmt_script(r0, 0x0, 0x144)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000))

11:44:07 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r1, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r1, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
dup2(r0, r1)

11:44:07 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, 0xd7)

11:44:08 executing program 5:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000019040)='/proc/partitions\x00', 0x0, 0x0)
pread64(r0, &(0x7f0000000040)=""/102400, 0x19000, 0x0)

11:44:08 executing program 3:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$rtc(&(0x7f0000000800), 0x0, 0x0)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x9, 0x0, 0x49})

11:44:08 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$DVD_AUTH(r0, 0x5303, &(0x7f0000000140)=@lsc={0x3, 0x0, "8c2e9c993edfe1625d5a"})

11:44:08 executing program 1:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$VT_ACTIVATE(r0, 0x2282, 0x4000000000000)

11:44:08 executing program 2:
syz_open_dev$sg(&(0x7f0000000c00), 0xffffffffffffffff, 0x40)

11:44:08 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@ipv4}}, 0xe8)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)

11:44:08 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, 0xd7)

11:44:08 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@ipv4}}, 0xe8)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)

11:44:08 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r1, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r1, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
dup2(r0, r1)

11:44:08 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev}]}, 0x38}}, 0x0)

11:44:08 executing program 1:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$VT_ACTIVATE(r0, 0x2282, 0x4000000000000)

11:44:08 executing program 2:
syz_open_dev$sg(&(0x7f0000000c00), 0xffffffffffffffff, 0x40)

11:44:08 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$DVD_AUTH(r0, 0x5303, &(0x7f0000000140)=@lsc={0x3, 0x0, "8c2e9c993edfe1625d5a"})

11:44:08 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@ipv4}}, 0xe8)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)

11:44:08 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev}]}, 0x38}}, 0x0)

11:44:08 executing program 5:
r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0)
fsetxattr$security_evm(r0, &(0x7f0000000000), &(0x7f0000000040)=@v2, 0x9, 0x0)

11:44:08 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r1, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r1, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
dup2(r0, r1)

11:44:08 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, 0xd7)

11:44:08 executing program 1:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0)
ioctl$VT_ACTIVATE(r0, 0x2282, 0x4000000000000)

11:44:08 executing program 2:
syz_open_dev$sg(&(0x7f0000000c00), 0xffffffffffffffff, 0x40)

11:44:08 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev}]}, 0x38}}, 0x0)

11:44:08 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "8d8f0c322bffe58557009febbfed69a1a6ba88"})
ioctl$TCXONC(r0, 0x540a, 0x2)

11:44:08 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@ipv4}}, 0xe8)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c)

11:44:08 executing program 6:
r0 = socket$nl_audit(0x10, 0x3, 0x9)
sendmmsg(r0, &(0x7f0000008100)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000940)="13", 0x1}], 0x1}}, {{&(0x7f0000000b00)=@isdn, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000b80)="0f", 0x1}], 0x1}}], 0x2, 0x0)

11:44:08 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev}]}, 0x38}}, 0x0)

11:44:08 executing program 2:
syz_open_dev$sg(&(0x7f0000000c00), 0xffffffffffffffff, 0x40)

11:44:08 executing program 6:
r0 = socket$nl_audit(0x10, 0x3, 0x9)
sendmmsg(r0, &(0x7f0000008100)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000940)="13", 0x1}], 0x1}}, {{&(0x7f0000000b00)=@isdn, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000b80)="0f", 0x1}], 0x1}}], 0x2, 0x0)

11:44:08 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, 0xd7)

11:44:08 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='mounts\x00')
sendfile(r0, r0, &(0x7f0000000000)=0x8000, 0x307)

11:44:08 executing program 6:
r0 = socket$nl_audit(0x10, 0x3, 0x9)
sendmmsg(r0, &(0x7f0000008100)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000940)="13", 0x1}], 0x1}}, {{&(0x7f0000000b00)=@isdn, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000b80)="0f", 0x1}], 0x1}}], 0x2, 0x0)

11:44:08 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
semget$private(0x0, 0x4, 0x0)
semop(0x0, &(0x7f0000000100)=[{0x3, 0x9}], 0x1)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3)
socket$nl_generic(0x10, 0x3, 0x10)

11:44:08 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDGKBENT(r0, 0x4b46, 0x0)

11:44:08 executing program 0:
set_robust_list(&(0x7f0000000640), 0x18)

11:44:08 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
ioprio_get$pid(0x2, 0x0)

11:44:08 executing program 4:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40345410, &(0x7f0000000100)={{0x0, 0x1}})
ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, 0x0)

[  123.580017] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI
[  123.580908] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  123.581470] CPU: 0 UID: 0 PID: 4030 Comm: syz-executor.2 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  123.582345] Tainted: [W]=WARN
[  123.583078] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  123.584821] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.585824] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  123.589587] RSP: 0018:ffff88804744f7c0 EFLAGS: 00010212
[  123.589989] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  123.590509] RDX: ffff888016a19b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[  123.591037] RBP: ffff88804744fa30 R08: ffff88806ce31340 R09: ffffe8ffffc15118
[  123.591561] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[  123.592080] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  123.592600] FS:  00005555644de400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[  123.593185] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  123.593612] CR2: 00005555644dfc18 CR3: 000000001e421000 CR4: 0000000000350ef0
[  123.594133] Call Trace:
[  123.594328]  <TASK>
[  123.594505]  ? __pfx_perf_tp_event+0x10/0x10
[  123.594850]  ? cpu_util.constprop.0+0x17d/0x340
[  123.595205]  ? __asan_memset+0x24/0x50
[  123.595501]  ? sched_balance_find_dst_group+0xa9a/0x1c00
[  123.595905]  ? lock_release+0xc8/0x290
[  123.596205]  ? __pfx_sched_balance_find_dst_group+0x10/0x10
[  123.596620]  ? __lock_acquire+0x694/0x1b70
[  123.596942]  ? perf_trace_run_bpf_submit+0xef/0x180
[  123.597317]  perf_trace_run_bpf_submit+0xef/0x180
[  123.597683]  perf_trace_lock_acquire+0x3c2/0x700
[  123.598045]  ? __pfx_perf_trace_lock_acquire+0x10/0x10
[  123.598437]  ? lock_acquire+0x15e/0x2f0
[  123.598746]  lock_acquire+0xc5/0x2f0
[  123.599027]  ? futex_private_hash_put+0x4c/0x2d0
[  123.599382]  ? futex_hash+0x2d8/0x390
[  123.599667]  ? lock_release+0xc8/0x290
[  123.599961]  futex_private_hash_put+0x5d/0x2d0
[  123.600301]  ? futex_private_hash_put+0x4c/0x2d0
[  123.600654]  futex_hash_put+0x3f/0x50
[  123.600940]  futex_wake+0x1bb/0x540
[  123.601219]  ? kernel_clone+0x204/0x7f0
[  123.601519]  ? __pfx_futex_wake+0x10/0x10
[  123.601832]  ? __pfx_kernel_clone+0x10/0x10
[  123.602154]  ? __lock_acquire+0x694/0x1b70
[  123.602474]  do_futex+0x26d/0x370
[  123.602748]  ? __pfx_do_futex+0x10/0x10
[  123.603048]  ? __pfx___do_sys_clone+0x10/0x10
[  123.603384]  ? find_held_lock+0x2b/0x80
[  123.603689]  __x64_sys_futex+0x1c9/0x4d0
[  123.603997]  ? __pfx___x64_sys_futex+0x10/0x10
[  123.604342]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  123.604734]  do_syscall_64+0xbf/0x360
[  123.605023]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.605405] RIP: 0033:0x7fe6f9383b19
[  123.605683] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  123.607042] RSP: 002b:00007ffeb5a3f5a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  123.607657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe6f9383b19
[  123.608239] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe6f9496f68
[  123.608820] RBP: 00007fe6f9496f60 R08: 00007fe6f68f9700 R09: 0000000000000000
[  123.609401] R10: 00007fe6f68f9700 R11: 0000000000000246 R12: 00007fe6f949b150
[  123.609985] R13: 00007ffeb5a3f6b0 R14: 00007fe6f9496f60 R15: 000000000001e25a
[  123.610575]  </TASK>
[  123.610777] Modules linked in:
[  123.611055] BUG: unable to handle page fault for address: ffffed1028f0b35e
[  123.612175] #PF: supervisor read access in kernel mode
[  123.612986] #PF: error_code(0x0000) - not-present page
[  123.613787] PGD 7ffd4067 P4D 7ffd4067 PUD 7ffd3067 PMD 0 
[  123.614669] Oops: Oops: 0000 [#2] SMP KASAN NOPTI
[  123.615430] CPU: 1 UID: 0 PID: 4026 Comm: syz-executor.7 Tainted: G      D W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  123.617248] Tainted: [D]=DIE, [W]=WARN
[  123.617840] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  123.619115] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.619856] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  123.622633] RSP: 0018:ffff888018d37800 EFLAGS: 00010212
[  123.623459] RAX: 1ffff11028f0b35e RBX: ffff888147859900 RCX: ffffc9000269d000
[  123.624543] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: ffff888147859af0
[  123.625621] RBP: ffff888018d37a70 R08: ffff88806cf31340 R09: ffffe8ffffd15118
[  123.626716] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000
[  123.627801] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000
[  123.628887] FS:  00007f24d288b700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[  123.630103] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  123.631011] CR2: ffffed1028f0b35e CR3: 0000000047c9c000 CR4: 0000000000350ef0
[  123.632112] Call Trace:
[  123.632530]  <TASK>
[  123.632906]  ? __pfx_perf_tp_event+0x10/0x10
[  123.633623]  ? perf_tp_event+0x807/0xe70
[  123.634287]  ? __pfx_perf_tp_event+0x10/0x10
[  123.635008]  ? __pfx_ctx_sched_in+0x10/0x10
[  123.635706]  ? arch_stack_walk+0x9c/0xf0
[  123.636372]  ? perf_trace_run_bpf_submit+0xef/0x180
[  123.637167]  ? perf_trace_run_bpf_submit+0xef/0x180
[  123.637969]  ? perf_trace_run_bpf_submit+0xef/0x180
[  123.638780]  perf_trace_run_bpf_submit+0xef/0x180
[  123.639553]  perf_trace_lock_acquire+0x3c2/0x700
[  123.640309]  ? __pfx_perf_trace_lock_acquire+0x10/0x10
[  123.641143]  ? __pfx_perf_trace_lock_acquire+0x10/0x10
[  123.641976]  ? lock_acquire+0xc5/0x2f0
[  123.642594]  ? lock_acquire+0x18c/0x2f0
[  123.643248]  lock_acquire+0xc5/0x2f0
[  123.643845]  ? futex_wake+0x228/0x540
[  123.644465]  ? futex_hash+0x15c/0x390
[  123.645077]  _raw_spin_lock+0x2b/0x40
[  123.645691]  ? futex_wake+0x228/0x540
[  123.646300]  futex_wake+0x228/0x540
[  123.646900]  ? __pfx_futex_wake+0x10/0x10
[  123.647567]  ? lock_release+0x1c7/0x290
[  123.648196]  ? lock_release+0x1c7/0x290
[  123.648819]  ? fd_install+0x1f0/0x660
[  123.649428]  do_futex+0x26d/0x370
[  123.649983]  ? __pfx_do_futex+0x10/0x10
[  123.650611]  ? __pfx___do_sys_perf_event_open+0x10/0x10
[  123.651476]  ? find_held_lock+0x2b/0x80
[  123.652123]  __x64_sys_futex+0x1c9/0x4d0
[  123.652771]  ? __pfx___x64_sys_futex+0x10/0x10
[  123.653501]  ? xfd_validate_state+0x55/0x180
[  123.654220]  do_syscall_64+0xbf/0x360
[  123.654838]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.655642] RIP: 0033:0x7f24d5315b19
[  123.656226] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  123.659042] RSP: 002b:00007f24d288b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  123.660212] RAX: ffffffffffffffda RBX: 00007f24d5428f68 RCX: 00007f24d5315b19
[  123.661305] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f24d5428f6c
[  123.662404] RBP: 00007f24d5428f60 R08: 000000000000000e R09: 0000000000000000
[  123.663521] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f24d5428f6c
[  123.664626] R13: 00007fff2e45e33f R14: 00007f24d288b300 R15: 0000000000022000
[  123.665740]  </TASK>
[  123.666115] Modules linked in:
[  123.666629] CR2: ffffed1028f0b35e
[  123.667203] ---[ end trace 0000000000000000 ]---
[  123.667203] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI
[  123.667219] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  123.667943] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.668837] CPU: 0 UID: 0 PID: 4030 Comm: syz-executor.2 Tainted: G      D W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  123.669982] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  123.670357] Tainted: [D]=DIE, [W]=WARN
[  123.672164] RSP: 0018:ffff88804744f7c0 EFLAGS: 00010212
[  123.673622] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  123.674213] 
[  123.674641] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.675904] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  123.676049] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  123.676759] RDX: ffff888016a19b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[  123.677332] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012
[  123.680103] RBP: ffff88804744fa30 R08: ffff88806ce31340 R09: ffffe8ffffc15118
[  123.680680] 
[  123.680685] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  123.681488] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[  123.682064] RDX: ffff888016a19b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[  123.682332] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  123.682914] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc15118
[  123.684009] FS:  00007f24d288b700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[  123.684589] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[  123.685674] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  123.686247] R13: 000000000000002c R14: ffff88806ce31490 R15: dffffc0000000000
[  123.687469] CR2: ffffed1028f0b35e CR3: 0000000047c9c000 CR4: 0000000000350ef0
[  123.688016] FS:  00005555644de400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[  123.688887] note: syz-executor.7[4026] exited with irqs disabled
[  123.689441] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  123.692086] CR2: 00005555644dfc18 CR3: 000000001e421000 CR4: 0000000000350ef0
[  123.692647] Call Trace:
[  123.692856]  <IRQ>
[  123.693038]  ? __pfx_perf_tp_event+0x10/0x10
[  123.693393]  ? __pfx_css_rstat_updated+0x10/0x10
[  123.693775]  ? lock_is_held_type+0x9e/0x120
[  123.694122]  ? trace_pelt_se_tp+0xdf/0x130
[  123.694458]  ? __update_load_avg_se+0x428/0xa40
[  123.694848]  ? lock_is_held_type+0x9e/0x120
[  123.695196]  ? update_load_avg+0x17d/0x1ef0
[  123.695539]  ? update_cfs_group+0x11d/0x260
[  123.695879]  ? kvm_sched_clock_read+0x16/0x30
[  123.696241]  ? enqueue_task_fair+0xded/0x1e00
[  123.696602]  ? perf_trace_lock_acquire+0xc9/0x700
[  123.696990]  ? perf_trace_run_bpf_submit+0xef/0x180
[  123.697394]  ? perf_trace_lock_acquire+0xc9/0x700
[  123.697780]  perf_trace_run_bpf_submit+0xef/0x180
[  123.698173]  perf_trace_lock_acquire+0x3c2/0x700
[  123.698551]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  123.698935]  ? __pfx_perf_trace_lock_acquire+0x10/0x10
[  123.699347]  ? lock_acquire+0x15e/0x2f0
[  123.699667]  ? find_held_lock+0x2b/0x80
[  123.700004]  ? clockevents_program_event+0x14f/0x360
[  123.700427]  ? lock_release+0xc8/0x290
[  123.700751]  lock_acquire+0xc5/0x2f0
[  123.701065]  ? hrtimer_interrupt+0xd6/0x830
[  123.701421]  ? __pfx_lapic_next_deadline+0x10/0x10
[  123.701834]  _raw_spin_lock_irqsave+0x3a/0x60
[  123.702210]  ? hrtimer_interrupt+0xd6/0x830
[  123.702566]  hrtimer_interrupt+0xd6/0x830
[  123.702925]  __sysvec_apic_timer_interrupt+0xbb/0x330
[  123.703356]  sysvec_apic_timer_interrupt+0x6b/0x80
[  123.703763]  </IRQ>
[  123.703951]  <TASK>
[  123.704138]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  123.704574] RIP: 0010:oops_exit+0x0/0x50
[  123.704912] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57
[  123.706392] RSP: 0018:ffff88804744f650 EFLAGS: 00000202
[  123.706841] RAX: 0000000000000000 RBX: 0000000000000293 RCX: ffffffff8139f06f
[  123.707417] RDX: ffff888016a19b80 RSI: ffffffff812a3dca RDI: 0000000000000007
[  123.707994] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690
[  123.708574] R10: 0000000000000000 R11: 000000000000002c R12: ffff88804744f718
[  123.709151] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000
[  123.709736]  ? add_taint+0x5f/0xd0
[  123.710038]  ? oops_end+0x4a/0xe0
[  123.710340]  oops_end+0x65/0xe0
[  123.710625]  exc_general_protection+0x1a2/0x330
[  123.711028]  asm_exc_general_protection+0x26/0x30
[  123.711421] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.711808] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  123.713275] RSP: 0018:ffff88804744f7c0 EFLAGS: 00010212
[  123.713710] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  123.714294] RDX: ffff888016a19b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[  123.714880] RBP: ffff88804744fa30 R08: ffff88806ce31340 R09: ffffe8ffffc15118
[  123.715456] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[  123.716033] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  123.716611]  ? perf_tp_event+0x167/0xe70
[  123.716959]  ? __pfx_perf_tp_event+0x10/0x10
[  123.717329]  ? cpu_util.constprop.0+0x17d/0x340
[  123.717719]  ? __asan_memset+0x24/0x50
[  123.718043]  ? sched_balance_find_dst_group+0xa9a/0x1c00
[  123.718487]  ? lock_release+0xc8/0x290
[  123.718824]  ? __pfx_sched_balance_find_dst_group+0x10/0x10
[  123.719289]  ? __lock_acquire+0x694/0x1b70
[  123.719644]  ? perf_trace_run_bpf_submit+0xef/0x180
[  123.720063]  perf_trace_run_bpf_submit+0xef/0x180
[  123.720467]  perf_trace_lock_acquire+0x3c2/0x700
[  123.720869]  ? __pfx_perf_trace_lock_acquire+0x10/0x10
[  123.721308]  ? lock_acquire+0x15e/0x2f0
[  123.721642]  lock_acquire+0xc5/0x2f0
[  123.721958]  ? futex_private_hash_put+0x4c/0x2d0
[  123.722348]  ? futex_hash+0x2d8/0x390
[  123.722666]  ? lock_release+0xc8/0x290
[  123.722995]  futex_private_hash_put+0x5d/0x2d0
[  123.723374]  ? futex_private_hash_put+0x4c/0x2d0
[  123.723753]  futex_hash_put+0x3f/0x50
[  123.724056]  futex_wake+0x1bb/0x540
[  123.724352]  ? kernel_clone+0x204/0x7f0
[  123.724671]  ? __pfx_futex_wake+0x10/0x10
[  123.725005]  ? __pfx_kernel_clone+0x10/0x10
[  123.725348]  ? __lock_acquire+0x694/0x1b70
[  123.725691]  do_futex+0x26d/0x370
[  123.725974]  ? __pfx_do_futex+0x10/0x10
[  123.726293]  ? __pfx___do_sys_clone+0x10/0x10
[  123.726650]  ? find_held_lock+0x2b/0x80
[  123.726988]  __x64_sys_futex+0x1c9/0x4d0
[  123.727317]  ? __pfx___x64_sys_futex+0x10/0x10
[  123.727685]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  123.728100]  do_syscall_64+0xbf/0x360
[  123.728407]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.728814] RIP: 0033:0x7fe6f9383b19
[  123.729111] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  123.730532] RSP: 002b:00007ffeb5a3f5a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  123.731138] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe6f9383b19
[  123.731698] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe6f9496f68
[  123.732257] RBP: 00007fe6f9496f60 R08: 00007fe6f68f9700 R09: 0000000000000000
[  123.732822] R10: 00007fe6f68f9700 R11: 0000000000000246 R12: 00007fe6f949b150
[  123.733381] R13: 00007ffeb5a3f6b0 R14: 00007fe6f9496f60 R15: 000000000001e25a
[  123.733946]  </TASK>
[  123.734134] Modules linked in:
[  123.734394] ---[ end trace 0000000000000000 ]---
[  123.734397] BUG: unable to handle page fault for address: ffffed1028f0b35e
[  123.734774] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.735844] #PF: supervisor read access in kernel mode
[  123.736210] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  123.737014] #PF: error_code(0x0000) - not-present page
[  123.738445] RSP: 0018:ffff88804744f7c0 EFLAGS: 00010212
[  123.739268] PGD 7ffd4067 
[  123.739689] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  123.739694] P4D 7ffd4067 PUD 7ffd3067 
[  123.739917] RDX: ffff888016a19b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[  123.741027] PMD 0 
[  123.741330] RBP: ffff88804744fa30 R08: ffff88806ce31340 R09: ffffe8ffffc15118
[  123.742433] 
[  123.742608] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[  123.743692] Oops: Oops: 0000 [#4] SMP KASAN NOPTI
[  123.743828] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  123.744910] CPU: 1 UID: 0 PID: 4026 Comm: syz-executor.7 Tainted: G      D W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
[  123.745271] FS:  00005555644de400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[  123.746351] Tainted: [D]=DIE, [W]=WARN
[  123.747250] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  123.748450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  123.748748] CR2: 00005555644dfc18 CR3: 000000001e421000 CR4: 0000000000350ef0
[  123.749623] RIP: 0010:perf_tp_event+0x175/0xe70
[  123.750252] Kernel panic - not syncing: Fatal exception in interrupt
[  124.792585] Shutting down cpus with NMI
[  124.804322] Kernel Offset: disabled
[  124.804597] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

VM DIAGNOSIS:
11:44:08  Registers:
info registers vcpu 0
RAX=0000000000000066 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff88804744f0b0
R8 =0000000000000000 R9 =ffffed10014ee046 R10=0000000000000066 R11=000000000000002c
R12=0000000000000066 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0
RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00005555644de400 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 fffffe5800000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00005555644dfc18 CR3=000000001e421000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007fe6f946a7c000007fe6f946a7c8
XMM02=00007fe6f946a7e000007fe6f946a7c0 XMM03=00007fe6f946a7c800007fe6f946a7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84be3c0e RDX=fffffbfff0f0f609
RSI=0000000000000004 RDI=ffffffff8787b044 RBP=ffffffff8787b044 RSP=ffff888018d37480
R8 =0000000000000000 R9 =fffffbfff0f0f608 R10=ffffffff8787b047 R11=000000000000002c
R12=1ffff110031a6e91 R13=0000000000000007 R14=fffffbfff0f0f608 R15=ffff888018d374b8
RIP=ffffffff84be3da0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f24d288b700 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe2300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=ffffed1028f0b35e CR3=0000000047c9c000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f24d53fc7c000007f24d53fc7c8
XMM02=00007f24d53fc7e000007f24d53fc7c0 XMM03=00007f24d53fc7c800007f24d53fc7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000