Warning: Permanently added '[localhost]:24638' (ECDSA) to the list of known hosts.
2025/08/29 10:12:02 fuzzer started
2025/08/29 10:12:02 dialing manager at localhost:43077
syzkaller login: [   58.122208] cgroup: Unknown subsys name 'net'
[   58.164050] cgroup: Unknown subsys name 'cpuset'
[   58.187200] cgroup: Unknown subsys name 'rlimit'
2025/08/29 10:12:13 syscalls: 2214
2025/08/29 10:12:13 code coverage: enabled
2025/08/29 10:12:13 comparison tracing: enabled
2025/08/29 10:12:13 extra coverage: enabled
2025/08/29 10:12:13 setuid sandbox: enabled
2025/08/29 10:12:13 namespace sandbox: enabled
2025/08/29 10:12:13 Android sandbox: enabled
2025/08/29 10:12:13 fault injection: enabled
2025/08/29 10:12:13 leak checking: enabled
2025/08/29 10:12:13 net packet injection: enabled
2025/08/29 10:12:13 net device setup: enabled
2025/08/29 10:12:13 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/08/29 10:12:13 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/08/29 10:12:13 USB emulation: enabled
2025/08/29 10:12:13 hci packet injection: enabled
2025/08/29 10:12:13 wifi device emulation: enabled
2025/08/29 10:12:13 802.15.4 emulation: enabled
2025/08/29 10:12:13 fetching corpus: 0, signal 0/2000 (executing program)
2025/08/29 10:12:13 fetching corpus: 50, signal 22964/26403 (executing program)
2025/08/29 10:12:14 fetching corpus: 100, signal 31309/36243 (executing program)
2025/08/29 10:12:14 fetching corpus: 150, signal 47790/53641 (executing program)
2025/08/29 10:12:14 fetching corpus: 200, signal 52695/59703 (executing program)
2025/08/29 10:12:14 fetching corpus: 250, signal 56520/64633 (executing program)
2025/08/29 10:12:14 fetching corpus: 300, signal 60488/69587 (executing program)
2025/08/29 10:12:14 fetching corpus: 350, signal 64377/74435 (executing program)
2025/08/29 10:12:14 fetching corpus: 400, signal 67760/78695 (executing program)
2025/08/29 10:12:14 fetching corpus: 450, signal 71272/83014 (executing program)
2025/08/29 10:12:14 fetching corpus: 500, signal 75299/87687 (executing program)
2025/08/29 10:12:15 fetching corpus: 550, signal 81183/93853 (executing program)
2025/08/29 10:12:15 fetching corpus: 600, signal 83563/96912 (executing program)
2025/08/29 10:12:15 fetching corpus: 650, signal 85184/99374 (executing program)
2025/08/29 10:12:15 fetching corpus: 700, signal 87695/102458 (executing program)
2025/08/29 10:12:15 fetching corpus: 750, signal 89374/104766 (executing program)
2025/08/29 10:12:15 fetching corpus: 800, signal 91599/107496 (executing program)
2025/08/29 10:12:15 fetching corpus: 850, signal 93882/110289 (executing program)
2025/08/29 10:12:15 fetching corpus: 900, signal 96019/112862 (executing program)
2025/08/29 10:12:15 fetching corpus: 950, signal 97603/114938 (executing program)
2025/08/29 10:12:15 fetching corpus: 1000, signal 99016/116857 (executing program)
2025/08/29 10:12:16 fetching corpus: 1050, signal 100868/119137 (executing program)
2025/08/29 10:12:16 fetching corpus: 1100, signal 102322/121045 (executing program)
2025/08/29 10:12:16 fetching corpus: 1150, signal 103999/123052 (executing program)
2025/08/29 10:12:16 fetching corpus: 1200, signal 105293/124731 (executing program)
2025/08/29 10:12:16 fetching corpus: 1250, signal 107011/126716 (executing program)
2025/08/29 10:12:16 fetching corpus: 1300, signal 108709/128652 (executing program)
2025/08/29 10:12:16 fetching corpus: 1350, signal 110057/130287 (executing program)
2025/08/29 10:12:16 fetching corpus: 1400, signal 111417/131910 (executing program)
2025/08/29 10:12:16 fetching corpus: 1450, signal 112720/133474 (executing program)
2025/08/29 10:12:16 fetching corpus: 1500, signal 113490/134685 (executing program)
2025/08/29 10:12:17 fetching corpus: 1550, signal 114854/136246 (executing program)
2025/08/29 10:12:17 fetching corpus: 1600, signal 115544/137329 (executing program)
2025/08/29 10:12:17 fetching corpus: 1650, signal 116700/138656 (executing program)
2025/08/29 10:12:17 fetching corpus: 1700, signal 117694/139922 (executing program)
2025/08/29 10:12:17 fetching corpus: 1750, signal 119070/141372 (executing program)
2025/08/29 10:12:17 fetching corpus: 1800, signal 119797/142399 (executing program)
2025/08/29 10:12:17 fetching corpus: 1850, signal 120452/143390 (executing program)
2025/08/29 10:12:17 fetching corpus: 1900, signal 121440/144464 (executing program)
2025/08/29 10:12:17 fetching corpus: 1950, signal 122321/145523 (executing program)
2025/08/29 10:12:17 fetching corpus: 2000, signal 123345/146643 (executing program)
2025/08/29 10:12:17 fetching corpus: 2050, signal 124197/147603 (executing program)
2025/08/29 10:12:18 fetching corpus: 2100, signal 124853/148472 (executing program)
2025/08/29 10:12:18 fetching corpus: 2150, signal 125662/149455 (executing program)
2025/08/29 10:12:18 fetching corpus: 2200, signal 126790/150696 (executing program)
2025/08/29 10:12:18 fetching corpus: 2250, signal 127979/151785 (executing program)
2025/08/29 10:12:18 fetching corpus: 2300, signal 128624/152632 (executing program)
2025/08/29 10:12:18 fetching corpus: 2350, signal 129451/153469 (executing program)
2025/08/29 10:12:18 fetching corpus: 2400, signal 130231/154354 (executing program)
2025/08/29 10:12:18 fetching corpus: 2450, signal 130927/155163 (executing program)
2025/08/29 10:12:18 fetching corpus: 2500, signal 131555/155905 (executing program)
2025/08/29 10:12:18 fetching corpus: 2550, signal 132626/156734 (executing program)
2025/08/29 10:12:18 fetching corpus: 2600, signal 133443/157509 (executing program)
2025/08/29 10:12:19 fetching corpus: 2650, signal 134581/158365 (executing program)
2025/08/29 10:12:19 fetching corpus: 2700, signal 135078/158960 (executing program)
2025/08/29 10:12:19 fetching corpus: 2750, signal 136222/159854 (executing program)
2025/08/29 10:12:19 fetching corpus: 2800, signal 136929/160485 (executing program)
2025/08/29 10:12:19 fetching corpus: 2850, signal 137416/161074 (executing program)
2025/08/29 10:12:19 fetching corpus: 2900, signal 138205/161756 (executing program)
2025/08/29 10:12:19 fetching corpus: 2950, signal 139026/162386 (executing program)
2025/08/29 10:12:19 fetching corpus: 3000, signal 139490/162874 (executing program)
2025/08/29 10:12:19 fetching corpus: 3050, signal 140448/163482 (executing program)
2025/08/29 10:12:19 fetching corpus: 3100, signal 142207/164258 (executing program)
2025/08/29 10:12:20 fetching corpus: 3150, signal 142906/164901 (executing program)
2025/08/29 10:12:20 fetching corpus: 3200, signal 143429/165403 (executing program)
2025/08/29 10:12:20 fetching corpus: 3250, signal 144040/165864 (executing program)
2025/08/29 10:12:20 fetching corpus: 3300, signal 144874/166464 (executing program)
2025/08/29 10:12:20 fetching corpus: 3350, signal 145547/166899 (executing program)
2025/08/29 10:12:20 fetching corpus: 3400, signal 146177/167423 (executing program)
2025/08/29 10:12:20 fetching corpus: 3450, signal 147336/167917 (executing program)
2025/08/29 10:12:20 fetching corpus: 3500, signal 147868/168319 (executing program)
2025/08/29 10:12:20 fetching corpus: 3550, signal 148608/168715 (executing program)
2025/08/29 10:12:20 fetching corpus: 3600, signal 148947/169061 (executing program)
2025/08/29 10:12:20 fetching corpus: 3650, signal 149588/169471 (executing program)
2025/08/29 10:12:21 fetching corpus: 3700, signal 150129/169787 (executing program)
2025/08/29 10:12:21 fetching corpus: 3750, signal 150529/170091 (executing program)
2025/08/29 10:12:21 fetching corpus: 3800, signal 151123/170435 (executing program)
2025/08/29 10:12:21 fetching corpus: 3850, signal 151674/170748 (executing program)
2025/08/29 10:12:21 fetching corpus: 3900, signal 152496/171054 (executing program)
2025/08/29 10:12:21 fetching corpus: 3950, signal 153078/171312 (executing program)
2025/08/29 10:12:21 fetching corpus: 4000, signal 153463/171555 (executing program)
2025/08/29 10:12:21 fetching corpus: 4050, signal 153901/171851 (executing program)
2025/08/29 10:12:21 fetching corpus: 4100, signal 154400/172075 (executing program)
2025/08/29 10:12:21 fetching corpus: 4150, signal 154766/172197 (executing program)
2025/08/29 10:12:21 fetching corpus: 4200, signal 155240/172225 (executing program)
2025/08/29 10:12:21 fetching corpus: 4250, signal 155889/172233 (executing program)
2025/08/29 10:12:22 fetching corpus: 4300, signal 156548/172253 (executing program)
2025/08/29 10:12:22 fetching corpus: 4350, signal 157202/172257 (executing program)
2025/08/29 10:12:22 fetching corpus: 4400, signal 157691/172267 (executing program)
2025/08/29 10:12:22 fetching corpus: 4450, signal 158309/172279 (executing program)
2025/08/29 10:12:22 fetching corpus: 4500, signal 158630/172281 (executing program)
2025/08/29 10:12:22 fetching corpus: 4550, signal 159030/172299 (executing program)
2025/08/29 10:12:22 fetching corpus: 4600, signal 159519/172305 (executing program)
2025/08/29 10:12:22 fetching corpus: 4650, signal 160188/172306 (executing program)
2025/08/29 10:12:22 fetching corpus: 4700, signal 160704/172319 (executing program)
2025/08/29 10:12:23 fetching corpus: 4750, signal 161185/172407 (executing program)
2025/08/29 10:12:23 fetching corpus: 4800, signal 161567/172410 (executing program)
2025/08/29 10:12:23 fetching corpus: 4850, signal 161967/172450 (executing program)
2025/08/29 10:12:23 fetching corpus: 4900, signal 162363/172461 (executing program)
2025/08/29 10:12:23 fetching corpus: 4950, signal 162581/172471 (executing program)
2025/08/29 10:12:23 fetching corpus: 5000, signal 163070/172473 (executing program)
2025/08/29 10:12:23 fetching corpus: 5050, signal 163798/172475 (executing program)
2025/08/29 10:12:23 fetching corpus: 5100, signal 164208/172482 (executing program)
2025/08/29 10:12:23 fetching corpus: 5150, signal 164515/172485 (executing program)
2025/08/29 10:12:23 fetching corpus: 5200, signal 165182/172488 (executing program)
2025/08/29 10:12:23 fetching corpus: 5250, signal 165732/172488 (executing program)
2025/08/29 10:12:24 fetching corpus: 5300, signal 166066/172497 (executing program)
2025/08/29 10:12:24 fetching corpus: 5350, signal 166439/172519 (executing program)
2025/08/29 10:12:24 fetching corpus: 5400, signal 166791/172539 (executing program)
2025/08/29 10:12:24 fetching corpus: 5450, signal 167133/172539 (executing program)
2025/08/29 10:12:24 fetching corpus: 5500, signal 167443/172553 (executing program)
2025/08/29 10:12:24 fetching corpus: 5550, signal 167842/172557 (executing program)
2025/08/29 10:12:24 fetching corpus: 5600, signal 168331/172568 (executing program)
2025/08/29 10:12:24 fetching corpus: 5650, signal 168672/172590 (executing program)
2025/08/29 10:12:24 fetching corpus: 5700, signal 169061/172590 (executing program)
2025/08/29 10:12:24 fetching corpus: 5750, signal 169338/172592 (executing program)
2025/08/29 10:12:24 fetching corpus: 5800, signal 169840/172592 (executing program)
2025/08/29 10:12:25 fetching corpus: 5850, signal 170113/172611 (executing program)
2025/08/29 10:12:25 fetching corpus: 5868, signal 170191/172614 (executing program)
2025/08/29 10:12:25 fetching corpus: 5868, signal 170191/172614 (executing program)
2025/08/29 10:12:27 starting 8 fuzzer processes
10:12:27 executing program 0:
keyctl$set_reqkey_keyring(0xe, 0x6)

10:12:27 executing program 1:
r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d0c, &(0x7f00000000c0)={{}, {0x400}, 0x0, 0x3})

10:12:27 executing program 4:
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./mnt\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0)
fadvise64(r0, 0x0, 0x0, 0x3)

10:12:27 executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0x0, 0x0, &(0x7f0000000240))

10:12:27 executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x0, 0xffffff9e})

10:12:27 executing program 5:
r0 = syz_open_dev$rtc(&(0x7f0000000800), 0x0, 0x0)
ioctl$RTC_WKALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1b}})

10:12:27 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x4b62, 0xf0ff1f00000000)

10:12:27 executing program 6:
r0 = io_uring_setup(0x1ff, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_FILES(r0, 0x1d, &(0x7f0000000140), 0x0)

[   82.986073] audit: type=1400 audit(1756462347.796:7): avc:  denied  { execmem } for  pid=283 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[   84.198169] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   84.200339] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   84.202445] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   84.206883] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   84.210117] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   84.326949] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   84.333205] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   84.337506] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   84.338871] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   84.343268] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   84.345330] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   84.347015] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   84.349893] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   84.352029] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   84.358929] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   84.362073] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   84.368940] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   84.388801] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   84.401809] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   84.404367] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   84.407911] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   84.409869] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   84.412003] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   84.415851] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   84.418383] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   84.420496] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   84.426968] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   84.429276] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   84.430811] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   84.432263] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   84.434823] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   84.438186] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   84.439490] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   84.440918] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   84.444288] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   84.445902] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   84.448362] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   84.450032] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   84.459602] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   84.468807] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   86.228102] Bluetooth: hci0: command tx timeout
[   86.419664] Bluetooth: hci2: command tx timeout
[   86.420686] Bluetooth: hci1: command tx timeout
[   86.485578] Bluetooth: hci3: command tx timeout
[   86.548575] Bluetooth: hci4: command tx timeout
[   86.549479] Bluetooth: hci5: command tx timeout
[   86.549584] Bluetooth: hci7: command tx timeout
[   86.550437] Bluetooth: hci6: command tx timeout
[   88.275557] Bluetooth: hci0: command tx timeout
[   88.468568] Bluetooth: hci1: command tx timeout
[   88.469029] Bluetooth: hci2: command tx timeout
[   88.531565] Bluetooth: hci3: command tx timeout
[   88.597547] Bluetooth: hci6: command tx timeout
[   88.597975] Bluetooth: hci5: command tx timeout
[   88.598349] Bluetooth: hci4: command tx timeout
[   88.598757] Bluetooth: hci7: command tx timeout
[   90.324881] Bluetooth: hci0: command tx timeout
[   90.516766] Bluetooth: hci2: command tx timeout
[   90.517222] Bluetooth: hci1: command tx timeout
[   90.580743] Bluetooth: hci3: command tx timeout
[   90.644569] Bluetooth: hci7: command tx timeout
[   90.645019] Bluetooth: hci4: command tx timeout
[   90.645049] Bluetooth: hci5: command tx timeout
[   90.645422] Bluetooth: hci6: command tx timeout
[   92.373523] Bluetooth: hci0: command tx timeout
[   92.564639] Bluetooth: hci1: command tx timeout
[   92.565090] Bluetooth: hci2: command tx timeout
[   92.629295] Bluetooth: hci3: command tx timeout
[   92.693607] Bluetooth: hci5: command tx timeout
[   92.694032] Bluetooth: hci4: command tx timeout
[   92.694415] Bluetooth: hci7: command tx timeout
[   92.694828] Bluetooth: hci6: command tx timeout
[  124.280739] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  124.281886] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  124.516020] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  124.517049] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  124.697771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  124.698628] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  124.868860] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  124.869993] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
10:13:09 executing program 4:
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./mnt\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0)
fadvise64(r0, 0x0, 0x0, 0x3)

10:13:09 executing program 4:
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./mnt\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0)
fadvise64(r0, 0x0, 0x0, 0x3)

[  125.053560] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  125.054202] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
10:13:09 executing program 4:
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./mnt\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0)
fadvise64(r0, 0x0, 0x0, 0x3)

10:13:10 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x9)
sendmsg$FOU_CMD_DEL(r0, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x14}, 0x14}}, 0x0)

[  125.231076] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=3842 comm=syz-executor.4
[  125.266884] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  125.267480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
10:13:10 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x9)
sendmsg$FOU_CMD_DEL(r0, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x14}, 0x14}}, 0x0)

[  125.341155] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=3848 comm=syz-executor.4
10:13:10 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x9)
sendmsg$FOU_CMD_DEL(r0, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x14}, 0x14}}, 0x0)

[  125.537707] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=3858 comm=syz-executor.4
10:13:10 executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0x0, 0x0, &(0x7f0000000240))

10:13:10 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x9)
sendmsg$FOU_CMD_DEL(r0, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x14}, 0x14}}, 0x0)

[  125.676618] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  125.678096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  125.796405] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=3869 comm=syz-executor.4
[  125.971797] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  125.973649] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.039937] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  126.047817] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  126.349071] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.350155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.432017] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.433528] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.470578] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.471496] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.550007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.551367] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.553906] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.555251] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.623445] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.624395] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  127.152893] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.154371] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  127.197478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.199413] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
10:13:12 executing program 0:
keyctl$set_reqkey_keyring(0xe, 0x6)

10:13:12 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x4b62, 0xf0ff1f00000000)

10:13:12 executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0x0, 0x0, &(0x7f0000000240))

10:13:12 executing program 1:
r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d0c, &(0x7f00000000c0)={{}, {0x400}, 0x0, 0x3})

10:13:12 executing program 6:
r0 = io_uring_setup(0x1ff, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_FILES(r0, 0x1d, &(0x7f0000000140), 0x0)

10:13:12 executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x0, 0xffffff9e})

10:13:12 executing program 5:
r0 = syz_open_dev$rtc(&(0x7f0000000800), 0x0, 0x0)
ioctl$RTC_WKALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1b}})

10:13:12 executing program 4:
getrandom(0x0, 0x0, 0x7)

[  127.452183] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO
10:13:12 executing program 6:
r0 = io_uring_setup(0x1ff, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_FILES(r0, 0x1d, &(0x7f0000000140), 0x0)

10:13:12 executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x0, 0xffffff9e})

10:13:12 executing program 2:
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0x0, 0x0, &(0x7f0000000240))

10:13:12 executing program 4:
getrandom(0x0, 0x0, 0x7)

10:13:12 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x4b62, 0xf0ff1f00000000)

10:13:12 executing program 5:
r0 = syz_open_dev$rtc(&(0x7f0000000800), 0x0, 0x0)
ioctl$RTC_WKALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1b}})

[  127.626093] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO
10:13:12 executing program 0:
keyctl$set_reqkey_keyring(0xe, 0x6)

10:13:12 executing program 6:
r0 = io_uring_setup(0x1ff, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_FILES(r0, 0x1d, &(0x7f0000000140), 0x0)

10:13:12 executing program 1:
r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d0c, &(0x7f00000000c0)={{}, {0x400}, 0x0, 0x3})

10:13:12 executing program 7:
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x0, 0xffffff9e})

10:13:12 executing program 5:
r0 = syz_open_dev$rtc(&(0x7f0000000800), 0x0, 0x0)
ioctl$RTC_WKALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1b}})

10:13:12 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x4b62, 0xf0ff1f00000000)

10:13:12 executing program 4:
getrandom(0x0, 0x0, 0x7)

10:13:12 executing program 2:
mlockall(0x7)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, <r1=>0x0}, &(0x7f0000000040)=0x5)
setuid(r1)
io_setup(0x8, &(0x7f0000000080))

[  127.820122] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO
10:13:12 executing program 1:
r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d0c, &(0x7f00000000c0)={{}, {0x400}, 0x0, 0x3})

10:13:12 executing program 0:
keyctl$set_reqkey_keyring(0xe, 0x6)

10:13:12 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_audit(0x10, 0x3, 0x9)
write$binfmt_script(r0, &(0x7f0000000180)={'#! ', './file0', [{0x20, '{)'}, {0x20, '\x00'}]}, 0x10)

10:13:12 executing program 2:
mlockall(0x7)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, <r1=>0x0}, &(0x7f0000000040)=0x5)
setuid(r1)
io_setup(0x8, &(0x7f0000000080))

10:13:12 executing program 4:
getrandom(0x0, 0x0, 0x7)

10:13:12 executing program 5:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
shutdown(r0, 0x0)
recvmmsg(r0, &(0x7f0000003d80)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000440)=""/35, 0x23}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

10:13:12 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
read(r0, &(0x7f0000000040)=""/140, 0x8c)

10:13:12 executing program 3:
prctl$PR_SET_SECCOMP(0x41, 0x2, 0x0)

[  128.134616] audit: type=1400 audit(1756462392.942:8): avc:  denied  { open } for  pid=3970 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  128.147785] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI
[  128.149561] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  128.150883] CPU: 1 UID: 0 PID: 3782 Comm: kworker/u8:2 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  128.158430] Tainted: [W]=WARN
[  128.158908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  128.160143] Workqueue: ipv6_addrconf addrconf_dad_work
[  128.160964] RIP: 0010:perf_tp_event+0x175/0xe70
[  128.161681] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  128.164405] RSP: 0018:ffff8880453a6f00 EFLAGS: 00010212
[  128.165166] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[  128.166109] RDX: ffff888013fc9b80 RSI: ffffffff818995b7 RDI: 0000000100000190
[  128.167045] RBP: ffff8880453a7170 R08: ffff88806cf31340 R09: ffffe8ffffd16248
[  128.167978] R10: 0000000000000000 R11: 0000000000006cee R12: dffffc0000000000
[  128.168910] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  128.169865] FS:  0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  128.170922] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  128.171693] CR2: 00007f91b0947018 CR3: 000000001f541000 CR4: 0000000000350ef0
[  128.172630] Call Trace:
[  128.172981]  <TASK>
[  128.173290]  ? ieee80211_handle_wake_tx_queue+0x1ca/0x260
[  128.174043]  ? __pfx_perf_tp_event+0x10/0x10
[  128.174652]  ? ieee80211_queue_skb+0xb36/0x1ff0
[  128.175300]  ? ieee80211_tx+0x259/0x410
[  128.175835]  ? __pfx_ieee80211_tx+0x10/0x10
[  128.176411]  ? lock_is_held_type+0x9e/0x120
[  128.177007]  ? perf_trace_run_bpf_submit+0xef/0x180
[  128.177682]  ? __pfx_ieee80211_build_hdr+0x10/0x10
[  128.178346]  perf_trace_run_bpf_submit+0xef/0x180
[  128.179001]  perf_trace_lock+0x337/0x5d0
[  128.179556]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.180178]  ? lock_acquire+0x15e/0x2f0
[  128.180717]  ? unwind_next_frame+0xb9/0x2540
[  128.181331]  ? unwind_next_frame+0x3b2/0x2540
[  128.181955]  lock_release+0x1ab/0x290
[  128.182479]  unwind_next_frame+0x3b7/0x2540
[  128.183070]  ? __unwind_start+0x592/0x7c0
[  128.183638]  ? get_stack_info_noinstr+0x16/0xf0
[  128.184270]  __unwind_start+0x517/0x7c0
[  128.184815]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  128.185541]  arch_stack_walk+0x62/0xf0
[  128.186086]  ? arch_stack_walk+0x62/0xf0
[  128.186632]  stack_trace_save+0x8e/0xc0
[  128.187173]  ? __pfx_stack_trace_save+0x10/0x10
[  128.187802]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.188417]  ? unwind_next_frame+0xb9/0x2540
[  128.189026]  kasan_save_stack+0x24/0x50
[  128.189565]  ? unwind_next_frame+0xb9/0x2540
[  128.190179]  ? find_held_lock+0x2b/0x80
[  128.190724]  ? unwind_next_frame+0x3b2/0x2540
[  128.191340]  ? lock_release+0xc8/0x290
[  128.191869]  ? unwind_next_frame+0x3bc/0x2540
[  128.192482]  ? ret_from_fork_asm+0x1a/0x30
[  128.193067]  ? ret_from_fork_asm+0x1a/0x30
[  128.193639]  ? kernel_text_address+0x11/0xc0
[  128.194240]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  128.194970]  ? arch_stack_walk+0x86/0xf0
[  128.195528]  ? perf_trace_lock+0xb5/0x5d0
[  128.196093]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.196713]  kasan_save_track+0x14/0x30
[  128.197252]  __kasan_slab_alloc+0x59/0x70
[  128.197814]  kmem_cache_alloc_noprof+0x205/0x690
[  128.198469]  ? __alloc_object+0x2b/0x2c0
[  128.199019]  __alloc_object+0x2b/0x2c0
[  128.199553]  __create_object+0x1d/0x80
[  128.200089]  __kmalloc_cache_noprof+0x42a/0x690
[  128.200721]  ? __pfx_percpu_counter_add_batch+0x10/0x10
[  128.201432]  ? kmem_cache_alloc_noprof+0x264/0x690
[  128.202104]  ? dst_cow_metrics_generic+0x4c/0x1e0
[  128.202761]  ? dst_alloc+0x44f/0x620
[  128.203272]  dst_cow_metrics_generic+0x4c/0x1e0
[  128.203904]  icmp6_dst_alloc+0x4a7/0x650
[  128.204451]  ? icmpv6_flow_init+0x3d/0x280
[  128.205026]  ? selinux_sk_getsecid+0x7c/0xd0
[  128.205622]  ndisc_send_skb+0x11f0/0x1d10
[  128.206200]  ? __pfx_ndisc_send_skb+0x10/0x10
[  128.206813]  ? lock_release+0xc8/0x290
[  128.207342]  ? lock_is_held_type+0x9e/0x120
[  128.207933]  ? __asan_memcpy+0x3d/0x60
[  128.208474]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.209094]  ndisc_send_ns+0xa9/0x130
[  128.209608]  ? __pfx_ndisc_send_ns+0x10/0x10
[  128.210210]  ? mark_held_locks+0x49/0x80
[  128.210762]  addrconf_dad_work+0xae2/0x11a0
[  128.211352]  ? __pfx_addrconf_dad_work+0x10/0x10
[  128.211998]  ? lock_release+0xc8/0x290
[  128.212528]  process_one_work+0x8e1/0x19c0
[  128.213109]  ? __pfx_process_one_work+0x10/0x10
[  128.213736]  ? move_linked_works+0x172/0x270
[  128.214355]  ? assign_work+0x196/0x240
[  128.214887]  worker_thread+0x67e/0xe90
[  128.215416]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  128.216118]  ? __pfx_worker_thread+0x10/0x10
[  128.216719]  kthread+0x3c8/0x740
[  128.217186]  ? __pfx_kthread+0x10/0x10
[  128.217711]  ? ret_from_fork+0x23/0x430
[  128.218263]  ? lock_release+0xc8/0x290
[  128.218789]  ? __pfx_kthread+0x10/0x10
[  128.219317]  ret_from_fork+0x34b/0x430
[  128.219850]  ? __pfx_kthread+0x10/0x10
[  128.220375]  ret_from_fork_asm+0x1a/0x30
[  128.220938]  </TASK>
[  128.221258] Modules linked in:
[  128.221701] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
[  128.223357] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  128.224499] CPU: 0 UID: 0 PID: 3977 Comm: syz-executor.5 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  128.226257] Tainted: [D]=DIE, [W]=WARN
[  128.226834] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  128.228030] RIP: 0010:perf_tp_event+0x175/0xe70
[  128.228767] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  128.231435] RSP: 0018:ffff8880447bf800 EFLAGS: 00010212
[  128.232234] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90002a1e000
[  128.233368] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191
[  128.234708] RBP: ffff8880447bfa70 R08: ffff88806ce31340 R09: ffffe8ffffc16248
[  128.235763] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[  128.236816] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  128.237895] FS:  00007f5b7111e700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  128.239089] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  128.239968] CR2: 00007fbde02379c8 CR3: 000000000e1e9000 CR4: 0000000000350ef0
[  128.241024] Call Trace:
[  128.241430]  <TASK>
[  128.241775]  ? perf_trace_lock+0xb5/0x5d0
[  128.242426]  ? __pfx_perf_tp_event+0x10/0x10
[  128.243104]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.243811]  ? unwind_next_frame+0x3b2/0x2540
[  128.244542]  ? lock_release+0x1c7/0x290
[  128.245161]  ? __is_insn_slot_addr+0x136/0x290
[  128.245884]  ? lock_release+0x1c7/0x290
[  128.246518]  ? __is_insn_slot_addr+0x140/0x290
[  128.247230]  ? kernel_text_address+0x5b/0xc0
[  128.247912]  ? __kernel_text_address+0xd/0x40
[  128.248596]  ? unwind_get_return_address+0x59/0xa0
[  128.249372]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  128.250232]  ? arch_stack_walk+0x9c/0xf0
[  128.250839]  ? perf_trace_run_bpf_submit+0xef/0x180
[  128.251618]  perf_trace_run_bpf_submit+0xef/0x180
[  128.252384]  perf_trace_lock+0x337/0x5d0
[  128.253008]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.253706]  ? kmem_cache_free+0x15b/0x540
[  128.254438]  ? __fput+0x67b/0xb50
[  128.255128]  ? fput_close_sync+0x10f/0x240
[  128.255857]  ? do_syscall_64+0xbf/0x360
[  128.256487]  ? get_futex_key+0x592/0x14a0
[  128.257148]  ? futex_ref_get+0x114/0x300
[  128.257748]  ? futex_hash+0x15c/0x390
[  128.258386]  lock_release+0x1ab/0x290
[  128.258966]  ? futex_hash+0x15c/0x390
[  128.259566]  futex_ref_get+0x119/0x300
[  128.260164]  ? futex_hash+0x15c/0x390
[  128.260770]  futex_hash+0x70/0x390
[  128.261326]  futex_wake+0x143/0x540
[  128.261920]  ? __virt_addr_valid+0x2e8/0x5d0
[  128.262634]  ? lock_release+0x1c7/0x290
[  128.263237]  ? __pfx_futex_wake+0x10/0x10
[  128.263894]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  128.264707]  ? __call_rcu_common.constprop.0+0x4c1/0x960
[  128.265551]  do_futex+0x26d/0x370
[  128.266182]  ? __pfx_do_futex+0x10/0x10
[  128.266950]  ? __fput+0x67b/0xb50
[  128.267642]  __x64_sys_futex+0x1c9/0x4d0
[  128.268429]  ? fput_close_sync+0x114/0x240
[  128.269260]  ? __pfx___x64_sys_futex+0x10/0x10
[  128.270161]  ? __pfx_fput_close_sync+0x10/0x10
[  128.271047]  ? dnotify_flush+0x79/0x4c0
[  128.271826]  do_syscall_64+0xbf/0x360
[  128.272499]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  128.273318] RIP: 0033:0x7f5b73ba8b19
[  128.273918] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  128.276871] RSP: 002b:00007f5b7111e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  128.278169] RAX: ffffffffffffffda RBX: 00007f5b73cbbf68 RCX: 00007f5b73ba8b19
[  128.279226] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5b73cbbf6c
[  128.280285] RBP: 00007f5b73cbbf60 R08: 000000000000000e R09: 0000000000000000
[  128.281348] R10: 0000000000000004 R11: 0000000000000246 R12: 00007f5b73cbbf6c
[  128.282413] R13: 00007ffe7883731f R14: 00007f5b7111e300 R15: 0000000000022000
[  128.283479]  </TASK>
[  128.283834] Modules linked in:
[  128.284332] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#3] SMP KASAN NOPTI
[  128.285850] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  128.287017] CPU: 1 UID: 0 PID: 3782 Comm: kworker/u8:2 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  128.288597] Tainted: [D]=DIE, [W]=WARN
[  128.289119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  128.290229] Workqueue: ipv6_addrconf addrconf_dad_work
[  128.290960] RIP: 0010:perf_tp_event+0x175/0xe70
[  128.291608] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  128.294047] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012
[  128.294771] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[  128.295732] RDX: ffff888013fc9b80 RSI: ffffffff818995b7 RDI: 0000000100000190
[  128.296698] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd16248
[  128.297658] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[  128.298622] R13: 000000000000002c R14: ffff88806cf31490 R15: dffffc0000000000
[  128.299581] FS:  0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  128.300657] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  128.301443] CR2: 00007f91b0947018 CR3: 000000001f541000 CR4: 0000000000350ef0
[  128.302409] Call Trace:
[  128.302765]  <IRQ>
[  128.303077]  ? __pfx_perf_tp_event+0x10/0x10
[  128.303693]  ? lock_is_held_type+0x9e/0x120
[  128.304290]  ? trace_pelt_se_tp+0xdf/0x130
[  128.304872]  ? perf_trace_lock+0xb5/0x5d0
[  128.305441]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.306090]  ? mark_held_locks+0x49/0x80
[  128.306653]  ? perf_trace_run_bpf_submit+0xef/0x180
[  128.307344]  perf_trace_run_bpf_submit+0xef/0x180
[  128.308019]  perf_trace_lock+0x337/0x5d0
[  128.308588]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.309223]  ? mark_held_locks+0x49/0x80
[  128.309781]  ? hrtimer_interrupt+0x114/0x830
[  128.310394]  lock_release+0x1ab/0x290
[  128.310927]  ktime_get_update_offsets_now+0xab/0x3c0
[  128.311623]  ? hrtimer_interrupt+0x114/0x830
[  128.312233]  hrtimer_interrupt+0x114/0x830
[  128.312808]  ? __local_bh_enable+0x7b/0x90
[  128.313398]  ? handle_softirqs+0x50c/0x770
[  128.313997]  __sysvec_apic_timer_interrupt+0xbb/0x330
[  128.314709]  sysvec_apic_timer_interrupt+0x6b/0x80
[  128.315385]  </IRQ>
[  128.315701]  <TASK>
[  128.316019]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  128.316736] RIP: 0010:oops_exit+0x0/0x50
[  128.317296] Code: f1 39 00 be ff ff ff ff 48 c7 c7 50 ac 43 86 e8 c6 0f f9 ff 5b e9 20 f1 39 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 06 f1 39 00 8b 1d c0 ed 4e 06 31 ff 89 de e8 27
[  128.319733] RSP: 0018:ffff8880453a6d90 EFLAGS: 00000202
[  128.320453] RAX: 0000000000000000 RBX: 0000000000000293 RCX: ffffffff8139f06f
[  128.321408] RDX: ffff888013fc9b80 RSI: ffffffff812a3dca RDI: 0000000000000007
[  128.322378] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f11c90
[  128.323336] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880453a6e58
[  128.324308] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000
[  128.325316]  ? add_taint+0x5f/0xd0
[  128.325855]  ? oops_end+0x4a/0xe0
[  128.326375]  oops_end+0x65/0xe0
[  128.326878]  exc_general_protection+0x1a2/0x330
[  128.327565]  asm_exc_general_protection+0x26/0x30
[  128.328247] RIP: 0010:perf_tp_event+0x175/0xe70
[  128.328917] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  128.331463] RSP: 0018:ffff8880453a6f00 EFLAGS: 00010212
[  128.332204] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[  128.333206] RDX: ffff888013fc9b80 RSI: ffffffff818995b7 RDI: 0000000100000190
[  128.334185] RBP: ffff8880453a7170 R08: ffff88806cf31340 R09: ffffe8ffffd16248
[  128.335165] R10: 0000000000000000 R11: 0000000000006cee R12: dffffc0000000000
[  128.336122] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  128.337068]  ? perf_tp_event+0x167/0xe70
[  128.337624]  ? ieee80211_handle_wake_tx_queue+0x1ca/0x260
[  128.338376]  ? __pfx_perf_tp_event+0x10/0x10
[  128.338981]  ? ieee80211_queue_skb+0xb36/0x1ff0
[  128.339635]  ? ieee80211_tx+0x259/0x410
[  128.340172]  ? __pfx_ieee80211_tx+0x10/0x10
[  128.340749]  ? lock_is_held_type+0x9e/0x120
[  128.341343]  ? perf_trace_run_bpf_submit+0xef/0x180
[  128.342023]  ? __pfx_ieee80211_build_hdr+0x10/0x10
[  128.342687]  perf_trace_run_bpf_submit+0xef/0x180
[  128.343344]  perf_trace_lock+0x337/0x5d0
[  128.343897]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.344523]  ? lock_acquire+0x15e/0x2f0
[  128.345063]  ? unwind_next_frame+0xb9/0x2540
[  128.345669]  ? unwind_next_frame+0x3b2/0x2540
[  128.346298]  lock_release+0x1ab/0x290
[  128.346823]  unwind_next_frame+0x3b7/0x2540
[  128.347411]  ? __unwind_start+0x592/0x7c0
[  128.347979]  ? get_stack_info_noinstr+0x16/0xf0
[  128.348607]  __unwind_start+0x517/0x7c0
[  128.349154]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  128.349883]  arch_stack_walk+0x62/0xf0
[  128.350416]  ? arch_stack_walk+0x62/0xf0
[  128.350967]  stack_trace_save+0x8e/0xc0
[  128.351515]  ? __pfx_stack_trace_save+0x10/0x10
[  128.352150]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.352767]  ? unwind_next_frame+0xb9/0x2540
[  128.353375]  kasan_save_stack+0x24/0x50
[  128.353923]  ? unwind_next_frame+0xb9/0x2540
[  128.354526]  ? find_held_lock+0x2b/0x80
[  128.355071]  ? unwind_next_frame+0x3b2/0x2540
[  128.355686]  ? lock_release+0xc8/0x290
[  128.356217]  ? unwind_next_frame+0x3bc/0x2540
[  128.356831]  ? ret_from_fork_asm+0x1a/0x30
[  128.357414]  ? ret_from_fork_asm+0x1a/0x30
[  128.357991]  ? kernel_text_address+0x11/0xc0
[  128.358595]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  128.359321]  ? arch_stack_walk+0x86/0xf0
[  128.359877]  ? perf_trace_lock+0xb5/0x5d0
[  128.360440]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.361057]  kasan_save_track+0x14/0x30
[  128.361595]  __kasan_slab_alloc+0x59/0x70
[  128.362168]  kmem_cache_alloc_noprof+0x205/0x690
[  128.362814]  ? __alloc_object+0x2b/0x2c0
[  128.363371]  __alloc_object+0x2b/0x2c0
[  128.363904]  __create_object+0x1d/0x80
[  128.364439]  __kmalloc_cache_noprof+0x42a/0x690
[  128.365074]  ? __pfx_percpu_counter_add_batch+0x10/0x10
[  128.365787]  ? kmem_cache_alloc_noprof+0x264/0x690
[  128.366460]  ? dst_cow_metrics_generic+0x4c/0x1e0
[  128.367113]  ? dst_alloc+0x44f/0x620
[  128.367624]  dst_cow_metrics_generic+0x4c/0x1e0
[  128.368258]  icmp6_dst_alloc+0x4a7/0x650
[  128.368812]  ? icmpv6_flow_init+0x3d/0x280
[  128.369385]  ? selinux_sk_getsecid+0x7c/0xd0
[  128.369989]  ndisc_send_skb+0x11f0/0x1d10
[  128.370562]  ? __pfx_ndisc_send_skb+0x10/0x10
[  128.371174]  ? lock_release+0xc8/0x290
[  128.371700]  ? lock_is_held_type+0x9e/0x120
[  128.372286]  ? __asan_memcpy+0x3d/0x60
[  128.372822]  ? __pfx_perf_trace_lock+0x10/0x10
[  128.373443]  ndisc_send_ns+0xa9/0x130
[  128.373963]  ? __pfx_ndisc_send_ns+0x10/0x10
[  128.374560]  ? mark_held_locks+0x49/0x80
[  128.375111]  addrconf_dad_work+0xae2/0x11a0
[  128.375709]  ? __pfx_addrconf_dad_work+0x10/0x10
[  128.376383]  ? lock_release+0xc8/0x290
[  128.376943]  process_one_work+0x8e1/0x19c0
[  128.377543]  ? __pfx_process_one_work+0x10/0x10
[  128.378208]  ? move_linked_works+0x172/0x270
[  128.378846]  ? assign_work+0x196/0x240
[  128.379400]  worker_thread+0x67e/0xe90
[  128.379949]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  128.380689]  ? __pfx_worker_thread+0x10/0x10
[  128.381318]  kthread+0x3c8/0x740
[  128.381809]  ? __pfx_kthread+0x10/0x10
[  128.382377]  ? ret_from_fork+0x23/0x430
[  128.382943]  ? lock_release+0xc8/0x290
[  128.383481]  ? __pfx_kthread+0x10/0x10
[  128.384044]  ret_from_fork+0x34b/0x430
[  128.384610]  ? __pfx_kthread+0x10/0x10
[  128.385162]  ret_from_fork_asm+0x1a/0x30
[  128.385762]  </TASK>
[  128.386101] Modules linked in:
[  128.386555] ---[ end trace 0000000000000000 ]---
[  128.386563] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#4] SMP KASAN NOPTI
[  128.387222] RIP: 0010:perf_tp_event+0x175/0xe70
[  128.389108] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  128.389720] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  128.390909] CPU: 0 UID: 0 PID: 3977 Comm: syz-executor.5 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  128.393338] RSP: 0018:ffff8880453a6f00 EFLAGS: 00010212
[  128.395112] Tainted: [D]=DIE, [W]=WARN
[  128.395830] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[  128.396444] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  128.397409] RDX: ffff888013fc9b80 RSI: ffffffff818995b7 RDI: 0000000100000190
[  128.398700] RIP: 0010:perf_tp_event+0x175/0xe70
[  128.399693] RBP: ffff8880453a7170 R08: ffff88806cf31340 R09: ffffe8ffffd16248
[  128.400448] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  128.401415] R10: 0000000000000000 R11: 0000000000006cee R12: dffffc0000000000
[  128.404215] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012
[  128.405196] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  128.405204] 
[  128.405217] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  128.405922] FS:  0000000000000000(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  128.407166] RDX: ffff888013fcd280 RSI: ffffffff818995b7 RDI: 0000000000000191
[  128.407400] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  128.408498] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc16248
[  128.409583] CR2: 00007f91b0947018 CR3: 000000001f541000 CR4: 0000000000350ef0
[  128.410691] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[  128.411459] Kernel panic - not syncing: Fatal exception in interrupt
[  129.469899] Shutting down cpus with NMI
[  129.472116] Kernel Offset: disabled
[  129.472405] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

VM DIAGNOSIS:
10:13:13  Registers:
info registers vcpu 0
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84bdec0e RDX=fffffbfff0f0ec09
RSI=0000000000000004 RDI=ffffffff87876044 RBP=ffffffff87876044 RSP=ffff8880447bf5b0
R8 =0000000000000000 R9 =fffffbfff0f0ec08 R10=ffffffff87876047 R11=202c746c75616620
R12=1ffff110088f7eb7 R13=0000000000000007 R14=fffffbfff0f0ec08 R15=ffff8880447bf5e8
RIP=ffffffff84bdeda0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f5b7111e700 00000000 00000000
GS =0000 ffff8880e55dd000 00000000 00000000
LDT=0000 fffffe2c00000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fbde02379c8 CR3=000000000e1e9000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f5b73c8f7c000007f5b73c8f7c8
XMM02=00007f5b73c8f7e000007f5b73c8f7c0 XMM03=00007f5b73c8f7c800007f5b73c8f7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff8880453a6860
R8 =0000000000000000 R9 =ffffed100153e046 R10=0000000000000030 R11=552031203a555043
R12=0000000000000030 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0
RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff8880e56dd000 00000000 00000000
LDT=0000 fffffe3300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f91b0947018 CR3=000000001f541000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000