Warning: Permanently added '[localhost]:46644' (ECDSA) to the list of known hosts.
2025/08/29 11:17:22 fuzzer started
2025/08/29 11:17:22 dialing manager at localhost:43077
syzkaller login: [   50.905463] cgroup: Unknown subsys name 'net'
[   50.989314] cgroup: Unknown subsys name 'cpuset'
[   51.005134] cgroup: Unknown subsys name 'rlimit'
2025/08/29 11:17:33 syscalls: 2214
2025/08/29 11:17:33 code coverage: enabled
2025/08/29 11:17:33 comparison tracing: enabled
2025/08/29 11:17:33 extra coverage: enabled
2025/08/29 11:17:33 setuid sandbox: enabled
2025/08/29 11:17:33 namespace sandbox: enabled
2025/08/29 11:17:33 Android sandbox: enabled
2025/08/29 11:17:33 fault injection: enabled
2025/08/29 11:17:33 leak checking: enabled
2025/08/29 11:17:33 net packet injection: enabled
2025/08/29 11:17:33 net device setup: enabled
2025/08/29 11:17:33 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/08/29 11:17:33 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/08/29 11:17:33 USB emulation: enabled
2025/08/29 11:17:33 hci packet injection: enabled
2025/08/29 11:17:33 wifi device emulation: enabled
2025/08/29 11:17:33 802.15.4 emulation: enabled
2025/08/29 11:17:33 fetching corpus: 0, signal 0/2000 (executing program)
2025/08/29 11:17:33 fetching corpus: 50, signal 22651/26188 (executing program)
2025/08/29 11:17:33 fetching corpus: 100, signal 34223/39119 (executing program)
2025/08/29 11:17:33 fetching corpus: 150, signal 42308/48496 (executing program)
2025/08/29 11:17:33 fetching corpus: 200, signal 50868/58201 (executing program)
2025/08/29 11:17:33 fetching corpus: 250, signal 58214/66548 (executing program)
2025/08/29 11:17:33 fetching corpus: 300, signal 61801/71231 (executing program)
2025/08/29 11:17:34 fetching corpus: 350, signal 63519/74127 (executing program)
2025/08/29 11:17:34 fetching corpus: 400, signal 67780/79286 (executing program)
2025/08/29 11:17:34 fetching corpus: 450, signal 70893/83357 (executing program)
2025/08/29 11:17:34 fetching corpus: 500, signal 73671/87030 (executing program)
2025/08/29 11:17:34 fetching corpus: 550, signal 76174/90451 (executing program)
2025/08/29 11:17:34 fetching corpus: 600, signal 78830/93955 (executing program)
2025/08/29 11:17:34 fetching corpus: 650, signal 81543/97445 (executing program)
2025/08/29 11:17:34 fetching corpus: 700, signal 83801/100467 (executing program)
2025/08/29 11:17:34 fetching corpus: 750, signal 86595/103920 (executing program)
2025/08/29 11:17:34 fetching corpus: 800, signal 89192/107097 (executing program)
2025/08/29 11:17:35 fetching corpus: 850, signal 90624/109283 (executing program)
2025/08/29 11:17:35 fetching corpus: 900, signal 92632/111879 (executing program)
2025/08/29 11:17:35 fetching corpus: 950, signal 93685/113706 (executing program)
2025/08/29 11:17:35 fetching corpus: 1000, signal 95387/116061 (executing program)
2025/08/29 11:17:35 fetching corpus: 1050, signal 96925/118207 (executing program)
2025/08/29 11:17:35 fetching corpus: 1100, signal 98164/120150 (executing program)
2025/08/29 11:17:35 fetching corpus: 1150, signal 100029/122528 (executing program)
2025/08/29 11:17:35 fetching corpus: 1200, signal 101960/124922 (executing program)
2025/08/29 11:17:35 fetching corpus: 1250, signal 103334/126852 (executing program)
2025/08/29 11:17:35 fetching corpus: 1300, signal 104491/128549 (executing program)
2025/08/29 11:17:36 fetching corpus: 1350, signal 105819/130379 (executing program)
2025/08/29 11:17:36 fetching corpus: 1400, signal 107058/132167 (executing program)
2025/08/29 11:17:36 fetching corpus: 1450, signal 108260/133862 (executing program)
2025/08/29 11:17:36 fetching corpus: 1500, signal 109820/135730 (executing program)
2025/08/29 11:17:36 fetching corpus: 1550, signal 111329/137602 (executing program)
2025/08/29 11:17:36 fetching corpus: 1600, signal 112944/139475 (executing program)
2025/08/29 11:17:36 fetching corpus: 1650, signal 114527/141263 (executing program)
2025/08/29 11:17:36 fetching corpus: 1700, signal 115683/142786 (executing program)
2025/08/29 11:17:36 fetching corpus: 1750, signal 117258/144532 (executing program)
2025/08/29 11:17:36 fetching corpus: 1800, signal 118652/146205 (executing program)
2025/08/29 11:17:36 fetching corpus: 1850, signal 119405/147397 (executing program)
2025/08/29 11:17:37 fetching corpus: 1900, signal 120626/148890 (executing program)
2025/08/29 11:17:37 fetching corpus: 1950, signal 121853/150289 (executing program)
2025/08/29 11:17:37 fetching corpus: 2000, signal 123020/151630 (executing program)
2025/08/29 11:17:37 fetching corpus: 2050, signal 123955/152835 (executing program)
2025/08/29 11:17:37 fetching corpus: 2100, signal 125099/154149 (executing program)
2025/08/29 11:17:37 fetching corpus: 2150, signal 125932/155248 (executing program)
2025/08/29 11:17:37 fetching corpus: 2200, signal 126437/156150 (executing program)
2025/08/29 11:17:37 fetching corpus: 2250, signal 127739/157485 (executing program)
2025/08/29 11:17:37 fetching corpus: 2300, signal 128652/158590 (executing program)
2025/08/29 11:17:37 fetching corpus: 2350, signal 129251/159504 (executing program)
2025/08/29 11:17:38 fetching corpus: 2400, signal 130026/160519 (executing program)
2025/08/29 11:17:38 fetching corpus: 2450, signal 130702/161473 (executing program)
2025/08/29 11:17:38 fetching corpus: 2500, signal 131856/162632 (executing program)
2025/08/29 11:17:38 fetching corpus: 2550, signal 132737/163579 (executing program)
2025/08/29 11:17:38 fetching corpus: 2600, signal 135580/165399 (executing program)
2025/08/29 11:17:38 fetching corpus: 2650, signal 136370/166294 (executing program)
2025/08/29 11:17:38 fetching corpus: 2700, signal 137440/167321 (executing program)
2025/08/29 11:17:38 fetching corpus: 2750, signal 138374/168229 (executing program)
2025/08/29 11:17:38 fetching corpus: 2800, signal 138937/168961 (executing program)
2025/08/29 11:17:38 fetching corpus: 2850, signal 139863/169980 (executing program)
2025/08/29 11:17:39 fetching corpus: 2900, signal 140670/170839 (executing program)
2025/08/29 11:17:39 fetching corpus: 2950, signal 141476/171684 (executing program)
2025/08/29 11:17:39 fetching corpus: 3000, signal 142453/172506 (executing program)
2025/08/29 11:17:39 fetching corpus: 3050, signal 143176/173261 (executing program)
2025/08/29 11:17:39 fetching corpus: 3100, signal 143977/174018 (executing program)
2025/08/29 11:17:39 fetching corpus: 3150, signal 144475/174690 (executing program)
2025/08/29 11:17:39 fetching corpus: 3200, signal 145030/175344 (executing program)
2025/08/29 11:17:39 fetching corpus: 3250, signal 145627/175999 (executing program)
2025/08/29 11:17:39 fetching corpus: 3300, signal 146180/176603 (executing program)
2025/08/29 11:17:39 fetching corpus: 3350, signal 146666/177217 (executing program)
2025/08/29 11:17:39 fetching corpus: 3400, signal 147197/177804 (executing program)
2025/08/29 11:17:40 fetching corpus: 3450, signal 147576/178329 (executing program)
2025/08/29 11:17:40 fetching corpus: 3500, signal 148174/178885 (executing program)
2025/08/29 11:17:40 fetching corpus: 3550, signal 149533/179611 (executing program)
2025/08/29 11:17:40 fetching corpus: 3600, signal 149937/180106 (executing program)
2025/08/29 11:17:40 fetching corpus: 3650, signal 150313/180606 (executing program)
2025/08/29 11:17:40 fetching corpus: 3700, signal 151309/181192 (executing program)
2025/08/29 11:17:40 fetching corpus: 3750, signal 151898/181720 (executing program)
2025/08/29 11:17:40 fetching corpus: 3800, signal 152537/182281 (executing program)
2025/08/29 11:17:40 fetching corpus: 3850, signal 153006/182709 (executing program)
2025/08/29 11:17:40 fetching corpus: 3900, signal 153788/183232 (executing program)
2025/08/29 11:17:40 fetching corpus: 3950, signal 154285/183686 (executing program)
2025/08/29 11:17:41 fetching corpus: 4000, signal 154723/184090 (executing program)
2025/08/29 11:17:41 fetching corpus: 4050, signal 155306/184517 (executing program)
2025/08/29 11:17:41 fetching corpus: 4100, signal 155822/184941 (executing program)
2025/08/29 11:17:41 fetching corpus: 4150, signal 156231/185320 (executing program)
2025/08/29 11:17:41 fetching corpus: 4200, signal 156700/185744 (executing program)
2025/08/29 11:17:41 fetching corpus: 4250, signal 157304/186151 (executing program)
2025/08/29 11:17:41 fetching corpus: 4300, signal 157780/186514 (executing program)
2025/08/29 11:17:41 fetching corpus: 4350, signal 158136/186856 (executing program)
2025/08/29 11:17:41 fetching corpus: 4400, signal 158953/187294 (executing program)
2025/08/29 11:17:41 fetching corpus: 4450, signal 159338/187603 (executing program)
2025/08/29 11:17:42 fetching corpus: 4500, signal 159718/187927 (executing program)
2025/08/29 11:17:42 fetching corpus: 4550, signal 160199/188018 (executing program)
2025/08/29 11:17:42 fetching corpus: 4600, signal 160736/188019 (executing program)
2025/08/29 11:17:42 fetching corpus: 4650, signal 161084/188028 (executing program)
2025/08/29 11:17:42 fetching corpus: 4700, signal 161845/188055 (executing program)
2025/08/29 11:17:42 fetching corpus: 4750, signal 162213/188072 (executing program)
2025/08/29 11:17:42 fetching corpus: 4800, signal 162590/188079 (executing program)
2025/08/29 11:17:42 fetching corpus: 4850, signal 163187/188123 (executing program)
2025/08/29 11:17:42 fetching corpus: 4900, signal 163576/188136 (executing program)
2025/08/29 11:17:42 fetching corpus: 4950, signal 164072/188147 (executing program)
2025/08/29 11:17:42 fetching corpus: 5000, signal 164405/188161 (executing program)
2025/08/29 11:17:43 fetching corpus: 5050, signal 164782/188176 (executing program)
2025/08/29 11:17:43 fetching corpus: 5100, signal 165062/188206 (executing program)
2025/08/29 11:17:43 fetching corpus: 5150, signal 165413/188209 (executing program)
2025/08/29 11:17:43 fetching corpus: 5200, signal 165902/188213 (executing program)
2025/08/29 11:17:43 fetching corpus: 5250, signal 166717/188266 (executing program)
2025/08/29 11:17:43 fetching corpus: 5300, signal 167108/188281 (executing program)
2025/08/29 11:17:43 fetching corpus: 5350, signal 167668/188284 (executing program)
2025/08/29 11:17:43 fetching corpus: 5400, signal 167963/188293 (executing program)
2025/08/29 11:17:43 fetching corpus: 5450, signal 168442/188330 (executing program)
2025/08/29 11:17:43 fetching corpus: 5500, signal 168682/188333 (executing program)
2025/08/29 11:17:43 fetching corpus: 5550, signal 168976/188357 (executing program)
2025/08/29 11:17:44 fetching corpus: 5600, signal 169260/188357 (executing program)
2025/08/29 11:17:44 fetching corpus: 5650, signal 169631/188364 (executing program)
2025/08/29 11:17:44 fetching corpus: 5700, signal 170028/188371 (executing program)
2025/08/29 11:17:44 fetching corpus: 5750, signal 170391/188384 (executing program)
2025/08/29 11:17:44 fetching corpus: 5800, signal 170798/188386 (executing program)
2025/08/29 11:17:44 fetching corpus: 5850, signal 171169/188395 (executing program)
2025/08/29 11:17:44 fetching corpus: 5900, signal 171390/188400 (executing program)
2025/08/29 11:17:44 fetching corpus: 5950, signal 171888/188488 (executing program)
2025/08/29 11:17:44 fetching corpus: 6000, signal 172195/188505 (executing program)
2025/08/29 11:17:44 fetching corpus: 6050, signal 172560/188506 (executing program)
2025/08/29 11:17:44 fetching corpus: 6100, signal 172874/188517 (executing program)
2025/08/29 11:17:45 fetching corpus: 6150, signal 173143/188540 (executing program)
2025/08/29 11:17:45 fetching corpus: 6200, signal 173445/188542 (executing program)
2025/08/29 11:17:45 fetching corpus: 6250, signal 173706/188553 (executing program)
2025/08/29 11:17:45 fetching corpus: 6300, signal 174169/188556 (executing program)
2025/08/29 11:17:45 fetching corpus: 6350, signal 174498/188560 (executing program)
2025/08/29 11:17:45 fetching corpus: 6400, signal 174800/188568 (executing program)
2025/08/29 11:17:45 fetching corpus: 6450, signal 175040/188571 (executing program)
2025/08/29 11:17:45 fetching corpus: 6500, signal 175461/188572 (executing program)
2025/08/29 11:17:45 fetching corpus: 6550, signal 175702/188576 (executing program)
2025/08/29 11:17:45 fetching corpus: 6600, signal 176002/188587 (executing program)
2025/08/29 11:17:45 fetching corpus: 6650, signal 176304/188590 (executing program)
2025/08/29 11:17:45 fetching corpus: 6700, signal 176583/188603 (executing program)
2025/08/29 11:17:45 fetching corpus: 6750, signal 176941/188615 (executing program)
2025/08/29 11:17:46 fetching corpus: 6800, signal 177392/188625 (executing program)
2025/08/29 11:17:46 fetching corpus: 6850, signal 177671/188633 (executing program)
2025/08/29 11:17:46 fetching corpus: 6900, signal 178074/188642 (executing program)
2025/08/29 11:17:46 fetching corpus: 6950, signal 178464/188644 (executing program)
2025/08/29 11:17:46 fetching corpus: 7000, signal 178696/188646 (executing program)
2025/08/29 11:17:46 fetching corpus: 7050, signal 178926/188653 (executing program)
2025/08/29 11:17:46 fetching corpus: 7100, signal 179123/188653 (executing program)
2025/08/29 11:17:46 fetching corpus: 7150, signal 179404/188658 (executing program)
2025/08/29 11:17:46 fetching corpus: 7200, signal 179751/188678 (executing program)
2025/08/29 11:17:46 fetching corpus: 7250, signal 180042/188692 (executing program)
2025/08/29 11:17:47 fetching corpus: 7300, signal 180425/188693 (executing program)
2025/08/29 11:17:47 fetching corpus: 7350, signal 180680/188695 (executing program)
2025/08/29 11:17:47 fetching corpus: 7400, signal 180958/188706 (executing program)
2025/08/29 11:17:47 fetching corpus: 7450, signal 181252/188711 (executing program)
2025/08/29 11:17:47 fetching corpus: 7500, signal 181511/188716 (executing program)
2025/08/29 11:17:47 fetching corpus: 7550, signal 181743/188722 (executing program)
2025/08/29 11:17:47 fetching corpus: 7600, signal 182036/188726 (executing program)
2025/08/29 11:17:47 fetching corpus: 7650, signal 182827/188765 (executing program)
2025/08/29 11:17:47 fetching corpus: 7700, signal 183067/188776 (executing program)
2025/08/29 11:17:47 fetching corpus: 7750, signal 183393/188782 (executing program)
2025/08/29 11:17:47 fetching corpus: 7800, signal 183687/188784 (executing program)
2025/08/29 11:17:48 fetching corpus: 7850, signal 183998/188791 (executing program)
2025/08/29 11:17:48 fetching corpus: 7900, signal 184251/188798 (executing program)
2025/08/29 11:17:48 fetching corpus: 7950, signal 184428/188815 (executing program)
2025/08/29 11:17:48 fetching corpus: 8000, signal 184768/188816 (executing program)
2025/08/29 11:17:48 fetching corpus: 8050, signal 185063/188850 (executing program)
2025/08/29 11:17:48 fetching corpus: 8100, signal 185302/188850 (executing program)
2025/08/29 11:17:48 fetching corpus: 8149, signal 185668/188856 (executing program)
2025/08/29 11:17:48 fetching corpus: 8149, signal 185668/188856 (executing program)
2025/08/29 11:17:51 starting 8 fuzzer processes
11:17:51 executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x10001, "53c4a403efdac792332bc333cb10711fea3d243d5e88f2ff61d8dfdf2aee2ec1"})

11:17:51 executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/devices.allow\x00', 0x121802, 0x0)
write$cgroup_devices(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='c *:'], 0x8)

11:17:51 executing program 1:
munmap(&(0x7f0000000000/0x2000)=nil, 0x2000)
rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8)

11:17:51 executing program 5:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')

11:17:51 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000040)={0x7fffffff})
kcmp(0x0, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0xffffffffffffffff)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000180)={0x2, 0x2, 0x8, 0x3, 0x4, 0xffffffff})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4050}, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
connect$bt_l2cap(r1, &(0x7f0000001b00)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)
creat(&(0x7f00000003c0)='./file0\x00', 0x0)

11:17:51 executing program 6:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='uid_map\x00')
write$cgroup_devices(r0, 0x0, 0x0)

11:17:51 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSETLED(r0, 0x80045432, 0x2000000000000000)

11:17:51 executing program 7:
r0 = memfd_create(&(0x7f0000000500)='\x02\xce\x16Td\xa8\x98\x86\xb1:\x8f\xc5\x88{\xbd\xb4\xc2\xb1\x9b\x84\x97R\xcc\xdb<\x01\xfa\x91\x85\xa0\x81\xa9F0!/\x89\xacX\xbd\xcd\x12R|lTn\xac-\xfd\x8b\n\x1a\xbc\xf0^B6\xb6`[/\xafE\xdaYz\xd6\xc7\xbc!\xe5\x89\xc8^\x06np\xc6\xe7\x1d\xe4\xbe\xcaa}\x1c\x12\xf9\xd8\xefw\xe1\xcb\x85\xdb?^\x8f\f\nD\xf2\x1f\x11\xaa\x90>N\xb7\x86\x15\x03=\xcc\xbe\x0f\x0f\x14\x84\xde:;\x0f\xb5\xf1\x86\xf2{y\xe0t\xa2\xe9\x01\x00\x00\x00\x8e:^v\xc9\x8d\xd7E\xb4\vw\xbe\\\x11J\xf4\xae\xc6\x88F\x9c\xaflM\x1dSHjH\xd6\x8d\xa6\xbd\x96\xe4SR\xe6\x118L*\x9b\xb2\tbg\xad\x0fRu\xeb\xe4{GO\xa5M\x80-Y\xc6\x1f%\xb8i|\x86\xa9Zm+\x9fe~\x8a\xe7\xca\f\xad?\xa0t\x13_Rq\x1f\xc6\xd9\x1d#\x8a8q\x1e#c\x8c\x193\xab\xdbE\xe1\xc8d=\xe5\r\xe6\x9a\xe5zc-\f\xe5#\xa2v\x1eY\xf0\xe3\x1c*h\xdbq\x92\xf8a6\x99\x02\xc9}\x14\xfb\x03\xce\xb34\x95/\x18\xacJs0\x9f\x9b>\xae\a2\x01\xa7\x95\xbd\xf2\x99w\x11G\x1c\xd2\xbc\xf0E\x86\xca\x87\xefv\x8e\xad\xb8\xc7u\xc2z\x85\xc1\xd5R\x82\v\x1b\xea\x8f\xad\xc1\x02\x8a$\xd1T\xce\xa6\xa2m\x18K\xd5-\x03\xa0\xeeF^F\vJLx\xdc\xc8\b\xb7\xa1j2l\x8fQ\xc1\x89\xb8\xbef\xc6\x90\r\xae\xd4S\x8f\x7f\xe2[\x1cs\xab&\xa3\x81B<\xc5]n\xfc', 0x3)
write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0xfffffd1f)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x9)

[   79.248033] audit: type=1400 audit(1756466271.402:7): avc:  denied  { execmem } for  pid=273 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[   80.555506] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   80.558841] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   80.561410] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   80.565123] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   80.569347] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   80.571105] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   80.571530] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   80.574496] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   80.574540] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   80.577942] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   80.580840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   80.585045] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   80.589848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   80.595195] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   80.597410] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   80.600846] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   80.603163] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   80.605316] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   80.612664] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   80.621010] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   80.626859] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   80.638268] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   80.647056] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   80.648358] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   80.654355] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   80.664583] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   80.667531] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   80.669606] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   80.672006] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   80.673369] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   80.675548] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   80.675640] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   80.681916] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   80.689754] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   80.691713] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   80.698121] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   80.713035] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   80.716344] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   80.717776] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   80.719782] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   82.639273] Bluetooth: hci2: command tx timeout
[   82.702458] Bluetooth: hci0: command tx timeout
[   82.703083] Bluetooth: hci3: command tx timeout
[   82.765974] Bluetooth: hci5: command tx timeout
[   82.766003] Bluetooth: hci7: command tx timeout
[   82.766283] Bluetooth: hci6: command tx timeout
[   82.767013] Bluetooth: hci4: command tx timeout
[   82.767755] Bluetooth: hci1: command tx timeout
[   84.686820] Bluetooth: hci2: command tx timeout
[   84.749987] Bluetooth: hci0: command tx timeout
[   84.750403] Bluetooth: hci3: command tx timeout
[   84.814904] Bluetooth: hci1: command tx timeout
[   84.815335] Bluetooth: hci4: command tx timeout
[   84.815696] Bluetooth: hci6: command tx timeout
[   84.816646] Bluetooth: hci5: command tx timeout
[   84.817086] Bluetooth: hci7: command tx timeout
[   86.735397] Bluetooth: hci2: command tx timeout
[   86.799082] Bluetooth: hci0: command tx timeout
[   86.799570] Bluetooth: hci3: command tx timeout
[   86.862005] Bluetooth: hci5: command tx timeout
[   86.862434] Bluetooth: hci7: command tx timeout
[   86.863638] Bluetooth: hci6: command tx timeout
[   86.863885] Bluetooth: hci4: command tx timeout
[   86.864160] Bluetooth: hci1: command tx timeout
[   88.783883] Bluetooth: hci2: command tx timeout
[   88.846073] Bluetooth: hci3: command tx timeout
[   88.846530] Bluetooth: hci0: command tx timeout
[   88.910087] Bluetooth: hci6: command tx timeout
[   88.910538] Bluetooth: hci4: command tx timeout
[   88.911721] Bluetooth: hci1: command tx timeout
[   88.912171] Bluetooth: hci5: command tx timeout
[   88.912562] Bluetooth: hci7: command tx timeout
[  117.372642] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  117.373348] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  117.584011] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  117.584622] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  117.872609] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  117.873378] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  118.010668] audit: type=1400 audit(1756466310.164:8): avc:  denied  { open } for  pid=3827 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  118.016943] audit: type=1400 audit(1756466310.165:9): avc:  denied  { kernel } for  pid=3827 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  118.038541] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.039140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  118.225160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.225779] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  118.309745] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.310547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:18:30 executing program 7:
r0 = memfd_create(&(0x7f0000000500)='\x02\xce\x16Td\xa8\x98\x86\xb1:\x8f\xc5\x88{\xbd\xb4\xc2\xb1\x9b\x84\x97R\xcc\xdb<\x01\xfa\x91\x85\xa0\x81\xa9F0!/\x89\xacX\xbd\xcd\x12R|lTn\xac-\xfd\x8b\n\x1a\xbc\xf0^B6\xb6`[/\xafE\xdaYz\xd6\xc7\xbc!\xe5\x89\xc8^\x06np\xc6\xe7\x1d\xe4\xbe\xcaa}\x1c\x12\xf9\xd8\xefw\xe1\xcb\x85\xdb?^\x8f\f\nD\xf2\x1f\x11\xaa\x90>N\xb7\x86\x15\x03=\xcc\xbe\x0f\x0f\x14\x84\xde:;\x0f\xb5\xf1\x86\xf2{y\xe0t\xa2\xe9\x01\x00\x00\x00\x8e:^v\xc9\x8d\xd7E\xb4\vw\xbe\\\x11J\xf4\xae\xc6\x88F\x9c\xaflM\x1dSHjH\xd6\x8d\xa6\xbd\x96\xe4SR\xe6\x118L*\x9b\xb2\tbg\xad\x0fRu\xeb\xe4{GO\xa5M\x80-Y\xc6\x1f%\xb8i|\x86\xa9Zm+\x9fe~\x8a\xe7\xca\f\xad?\xa0t\x13_Rq\x1f\xc6\xd9\x1d#\x8a8q\x1e#c\x8c\x193\xab\xdbE\xe1\xc8d=\xe5\r\xe6\x9a\xe5zc-\f\xe5#\xa2v\x1eY\xf0\xe3\x1c*h\xdbq\x92\xf8a6\x99\x02\xc9}\x14\xfb\x03\xce\xb34\x95/\x18\xacJs0\x9f\x9b>\xae\a2\x01\xa7\x95\xbd\xf2\x99w\x11G\x1c\xd2\xbc\xf0E\x86\xca\x87\xefv\x8e\xad\xb8\xc7u\xc2z\x85\xc1\xd5R\x82\v\x1b\xea\x8f\xad\xc1\x02\x8a$\xd1T\xce\xa6\xa2m\x18K\xd5-\x03\xa0\xeeF^F\vJLx\xdc\xc8\b\xb7\xa1j2l\x8fQ\xc1\x89\xb8\xbef\xc6\x90\r\xae\xd4S\x8f\x7f\xe2[\x1cs\xab&\xa3\x81B<\xc5]n\xfc', 0x3)
write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0xfffffd1f)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x9)

[  118.403132] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.403769] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:18:30 executing program 1:
munmap(&(0x7f0000000000/0x2000)=nil, 0x2000)
rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8)

[  118.498633] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.500757] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:18:30 executing program 1:
munmap(&(0x7f0000000000/0x2000)=nil, 0x2000)
rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8)

11:18:30 executing program 1:
munmap(&(0x7f0000000000/0x2000)=nil, 0x2000)
rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8)

[  118.646277] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.646875] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:18:30 executing program 7:
r0 = memfd_create(&(0x7f0000000500)='\x02\xce\x16Td\xa8\x98\x86\xb1:\x8f\xc5\x88{\xbd\xb4\xc2\xb1\x9b\x84\x97R\xcc\xdb<\x01\xfa\x91\x85\xa0\x81\xa9F0!/\x89\xacX\xbd\xcd\x12R|lTn\xac-\xfd\x8b\n\x1a\xbc\xf0^B6\xb6`[/\xafE\xdaYz\xd6\xc7\xbc!\xe5\x89\xc8^\x06np\xc6\xe7\x1d\xe4\xbe\xcaa}\x1c\x12\xf9\xd8\xefw\xe1\xcb\x85\xdb?^\x8f\f\nD\xf2\x1f\x11\xaa\x90>N\xb7\x86\x15\x03=\xcc\xbe\x0f\x0f\x14\x84\xde:;\x0f\xb5\xf1\x86\xf2{y\xe0t\xa2\xe9\x01\x00\x00\x00\x8e:^v\xc9\x8d\xd7E\xb4\vw\xbe\\\x11J\xf4\xae\xc6\x88F\x9c\xaflM\x1dSHjH\xd6\x8d\xa6\xbd\x96\xe4SR\xe6\x118L*\x9b\xb2\tbg\xad\x0fRu\xeb\xe4{GO\xa5M\x80-Y\xc6\x1f%\xb8i|\x86\xa9Zm+\x9fe~\x8a\xe7\xca\f\xad?\xa0t\x13_Rq\x1f\xc6\xd9\x1d#\x8a8q\x1e#c\x8c\x193\xab\xdbE\xe1\xc8d=\xe5\r\xe6\x9a\xe5zc-\f\xe5#\xa2v\x1eY\xf0\xe3\x1c*h\xdbq\x92\xf8a6\x99\x02\xc9}\x14\xfb\x03\xce\xb34\x95/\x18\xacJs0\x9f\x9b>\xae\a2\x01\xa7\x95\xbd\xf2\x99w\x11G\x1c\xd2\xbc\xf0E\x86\xca\x87\xefv\x8e\xad\xb8\xc7u\xc2z\x85\xc1\xd5R\x82\v\x1b\xea\x8f\xad\xc1\x02\x8a$\xd1T\xce\xa6\xa2m\x18K\xd5-\x03\xa0\xeeF^F\vJLx\xdc\xc8\b\xb7\xa1j2l\x8fQ\xc1\x89\xb8\xbef\xc6\x90\r\xae\xd4S\x8f\x7f\xe2[\x1cs\xab&\xa3\x81B<\xc5]n\xfc', 0x3)
write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0xfffffd1f)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x9)

[  118.714550] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.715149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:18:30 executing program 1:
timer_create(0x8, &(0x7f0000000100)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f00000002c0))
clock_gettime(0x0, &(0x7f0000000400)={0x0, <r0=>0x0})
timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, r0+10000000}, {0x77359400}}, 0x0)
timer_gettime(0x0, &(0x7f0000000140))

11:18:31 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000040)={0x7fffffff})
kcmp(0x0, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0xffffffffffffffff)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000180)={0x2, 0x2, 0x8, 0x3, 0x4, 0xffffffff})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4050}, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
connect$bt_l2cap(r1, &(0x7f0000001b00)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)
creat(&(0x7f00000003c0)='./file0\x00', 0x0)

11:18:31 executing program 1:
timer_create(0x8, &(0x7f0000000100)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f00000002c0))
clock_gettime(0x0, &(0x7f0000000400)={0x0, <r0=>0x0})
timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, r0+10000000}, {0x77359400}}, 0x0)
timer_gettime(0x0, &(0x7f0000000140))

[  118.889953] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.890537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  118.986386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  118.987020] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  119.049343] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  119.050096] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  119.100361] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  119.101004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  119.151018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  119.151600] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  119.182899] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  119.183529] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:18:31 executing program 3:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000021000100000000000000000002"], 0x28}], 0x1}, 0x0)

11:18:31 executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/devices.allow\x00', 0x121802, 0x0)
write$cgroup_devices(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='c *:'], 0x8)

11:18:31 executing program 1:
timer_create(0x8, &(0x7f0000000100)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f00000002c0))
clock_gettime(0x0, &(0x7f0000000400)={0x0, <r0=>0x0})
timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, r0+10000000}, {0x77359400}}, 0x0)
timer_gettime(0x0, &(0x7f0000000140))

11:18:31 executing program 0:
openat$vcsa(0xffffffffffffff9c, 0x0, 0x51de00, 0x0)

11:18:31 executing program 5:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')

11:18:31 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000040)={0x7fffffff})
kcmp(0x0, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0xffffffffffffffff)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000180)={0x2, 0x2, 0x8, 0x3, 0x4, 0xffffffff})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4050}, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
connect$bt_l2cap(r1, &(0x7f0000001b00)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)
creat(&(0x7f00000003c0)='./file0\x00', 0x0)

11:18:31 executing program 6:
r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0)
ioctl$BLKIOMIN(r0, 0x80081270, &(0x7f00000029c0))

11:18:31 executing program 7:
r0 = memfd_create(&(0x7f0000000500)='\x02\xce\x16Td\xa8\x98\x86\xb1:\x8f\xc5\x88{\xbd\xb4\xc2\xb1\x9b\x84\x97R\xcc\xdb<\x01\xfa\x91\x85\xa0\x81\xa9F0!/\x89\xacX\xbd\xcd\x12R|lTn\xac-\xfd\x8b\n\x1a\xbc\xf0^B6\xb6`[/\xafE\xdaYz\xd6\xc7\xbc!\xe5\x89\xc8^\x06np\xc6\xe7\x1d\xe4\xbe\xcaa}\x1c\x12\xf9\xd8\xefw\xe1\xcb\x85\xdb?^\x8f\f\nD\xf2\x1f\x11\xaa\x90>N\xb7\x86\x15\x03=\xcc\xbe\x0f\x0f\x14\x84\xde:;\x0f\xb5\xf1\x86\xf2{y\xe0t\xa2\xe9\x01\x00\x00\x00\x8e:^v\xc9\x8d\xd7E\xb4\vw\xbe\\\x11J\xf4\xae\xc6\x88F\x9c\xaflM\x1dSHjH\xd6\x8d\xa6\xbd\x96\xe4SR\xe6\x118L*\x9b\xb2\tbg\xad\x0fRu\xeb\xe4{GO\xa5M\x80-Y\xc6\x1f%\xb8i|\x86\xa9Zm+\x9fe~\x8a\xe7\xca\f\xad?\xa0t\x13_Rq\x1f\xc6\xd9\x1d#\x8a8q\x1e#c\x8c\x193\xab\xdbE\xe1\xc8d=\xe5\r\xe6\x9a\xe5zc-\f\xe5#\xa2v\x1eY\xf0\xe3\x1c*h\xdbq\x92\xf8a6\x99\x02\xc9}\x14\xfb\x03\xce\xb34\x95/\x18\xacJs0\x9f\x9b>\xae\a2\x01\xa7\x95\xbd\xf2\x99w\x11G\x1c\xd2\xbc\xf0E\x86\xca\x87\xefv\x8e\xad\xb8\xc7u\xc2z\x85\xc1\xd5R\x82\v\x1b\xea\x8f\xad\xc1\x02\x8a$\xd1T\xce\xa6\xa2m\x18K\xd5-\x03\xa0\xeeF^F\vJLx\xdc\xc8\b\xb7\xa1j2l\x8fQ\xc1\x89\xb8\xbef\xc6\x90\r\xae\xd4S\x8f\x7f\xe2[\x1cs\xab&\xa3\x81B<\xc5]n\xfc', 0x3)
write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0xfffffd1f)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x9)

[  119.379949] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
11:18:31 executing program 1:
timer_create(0x8, &(0x7f0000000100)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f00000002c0))
clock_gettime(0x0, &(0x7f0000000400)={0x0, <r0=>0x0})
timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, r0+10000000}, {0x77359400}}, 0x0)
timer_gettime(0x0, &(0x7f0000000140))

11:18:31 executing program 5:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')

11:18:31 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000040)={0x7fffffff})
kcmp(0x0, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0xffffffffffffffff)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000180)={0x2, 0x2, 0x8, 0x3, 0x4, 0xffffffff})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4050}, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
connect$bt_l2cap(r1, &(0x7f0000001b00)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)
creat(&(0x7f00000003c0)='./file0\x00', 0x0)

11:18:31 executing program 4:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/devices.allow\x00', 0x121802, 0x0)
write$cgroup_devices(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='c *:'], 0x8)

[  119.424823] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI
[  119.425762] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  119.426473] CPU: 0 UID: 0 PID: 3927 Comm: syz-executor.3 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  119.428316] Tainted: [W]=WARN
[  119.429171] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  119.430967] RIP: 0010:perf_tp_event+0x175/0xe70
[  119.432521] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  119.436306] RSP: 0018:ffff888013edf800 EFLAGS: 00010212
[  119.436735] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900017f9000
[  119.437310] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  119.437872] RBP: ffff888013edfa70 R08: ffff88806ce31340 R09: ffffe8ffffc16450
[  119.438474] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[  119.439065] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  119.439633] FS:  00007fa74e020700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  119.440276] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  119.440741] CR2: 00007f20692e53a4 CR3: 0000000043a24000 CR4: 0000000000350ef0
[  119.441323] Call Trace:
[  119.441535]  <TASK>
[  119.441724]  ? __pfx_perf_tp_event+0x10/0x10
[  119.442088]  ? lock_is_held_type+0x9e/0x120
[  119.442445]  ? perf_trace_lock+0xb5/0x5d0
[  119.442782]  ? perf_trace_lock+0xb5/0x5d0
[  119.443116]  ? tracing_gen_ctx_irq_test+0x167/0x1f0
[  119.443516]  ? perf_swevent_event+0x63/0x3f0
[  119.443874]  ? perf_tp_event+0x807/0xe70
[  119.444204]  ? perf_trace_run_bpf_submit+0xef/0x180
[  119.444609]  ? __pfx_perf_tp_event+0x10/0x10
[  119.444976]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  119.445450]  ? do_raw_spin_unlock+0x53/0x220
[  119.445813]  ? perf_trace_run_bpf_submit+0xef/0x180
[  119.446232]  perf_trace_run_bpf_submit+0xef/0x180
[  119.446652]  perf_trace_lock+0x337/0x5d0
[  119.447001]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.447371]  ? lock_acquire+0x15e/0x2f0
[  119.447695]  ? futex_ref_get+0x48/0x300
[  119.448019]  ? futex_ref_get+0x114/0x300
[  119.448342]  ? futex_hash+0x15c/0x390
[  119.448652]  lock_release+0x1ab/0x290
[  119.448988]  ? futex_hash+0x15c/0x390
[  119.449300]  futex_ref_get+0x119/0x300
[  119.449615]  ? futex_hash+0x15c/0x390
[  119.449920]  futex_hash+0x70/0x390
[  119.450214]  futex_wake+0x143/0x540
[  119.450512]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.450885]  ? __pfx_futex_wake+0x10/0x10
[  119.451227]  ? __do_sys_perf_event_open+0x44d/0x2c20
[  119.451634]  ? lock_release+0xc8/0x290
[  119.451957]  do_futex+0x26d/0x370
[  119.452246]  ? __pfx_do_futex+0x10/0x10
[  119.452573]  __x64_sys_futex+0x1c9/0x4d0
[  119.452912]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  119.453387]  ? __pfx___x64_sys_futex+0x10/0x10
[  119.453757]  ? xfd_validate_state+0x55/0x180
[  119.454129]  do_syscall_64+0xbf/0x360
[  119.454440]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  119.454853] RIP: 0033:0x7fa750aaab19
[  119.455159] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  119.456592] RSP: 002b:00007fa74e020218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  119.457223] RAX: ffffffffffffffda RBX: 00007fa750bbdf68 RCX: 00007fa750aaab19
[  119.457818] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fa750bbdf6c
[  119.458389] RBP: 00007fa750bbdf60 R08: 000000000000000e R09: 0000000000000000
[  119.458953] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fa750bbdf6c
[  119.459520] R13: 00007ffc39b478bf R14: 00007fa74e020300 R15: 0000000000022000
[  119.460099]  </TASK>
[  119.460291] Modules linked in:
[  119.460564] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
[  119.461551] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  119.462156] CPU: 1 UID: 0 PID: 3931 Comm: syz-executor.2 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  119.463120] Tainted: [D]=DIE, [W]=WARN
[  119.463437] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  119.464090] RIP: 0010:perf_tp_event+0x175/0xe70
[  119.464480] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  119.465929] RSP: 0018:ffff888016db7800 EFLAGS: 00010212
[  119.466352] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  119.466917] RDX: ffff8880446ab700 RSI: ffffffff818995b7 RDI: 0000000000000191
[  119.467483] RBP: ffff888016db7a70 R08: ffff88806cf31340 R09: ffffe8ffffd16450
[  119.468046] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[  119.468612] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  119.469205] FS:  000055558d4d0400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  119.469884] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  119.470342] CR2: 000055558d4d1c18 CR3: 000000000cb59000 CR4: 0000000000350ef0
[  119.470908] Call Trace:
[  119.471124]  <TASK>
[  119.471312]  ? arch_scale_cpu_capacity+0x17/0xa0
[  119.471705]  ? __pfx_perf_tp_event+0x10/0x10
[  119.472061]  ? __asan_memset+0x24/0x50
[  119.472390]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.472760]  ? __pfx___mutex_lock+0x10/0x10
[  119.473126]  ? perf_trace_lock+0xb5/0x5d0
[  119.473462]  ? kvm_sched_clock_read+0x16/0x30
[  119.473830]  ? sched_clock+0x37/0x60
[  119.474143]  ? sched_clock_cpu+0x6c/0x4e0
[  119.474488]  ? perf_trace_run_bpf_submit+0xef/0x180
[  119.474891]  perf_trace_run_bpf_submit+0xef/0x180
[  119.475315]  perf_trace_lock+0x337/0x5d0
[  119.475729]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.476196]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.476677]  ? get_futex_key+0x592/0x14a0
[  119.477067]  ? futex_ref_get+0x114/0x300
[  119.477399]  ? futex_hash+0x15c/0x390
[  119.477706]  lock_release+0x1ab/0x290
[  119.478019]  ? futex_hash+0x15c/0x390
[  119.478326]  futex_ref_get+0x119/0x300
[  119.478639]  ? futex_hash+0x15c/0x390
[  119.478945]  futex_hash+0x70/0x390
[  119.479234]  futex_wake+0x143/0x540
[  119.479534]  ? put_pid+0x1f/0x30
[  119.479809]  ? kernel_clone+0x204/0x7f0
[  119.480130]  ? __pfx_futex_wake+0x10/0x10
[  119.480465]  ? __pfx_kernel_clone+0x10/0x10
[  119.480810]  ? perf_trace_lock+0xb5/0x5d0
[  119.481162]  ? __pfx___handle_mm_fault+0x10/0x10
[  119.481546]  do_futex+0x26d/0x370
[  119.481831]  ? __pfx_do_futex+0x10/0x10
[  119.482155]  ? __pfx___do_sys_clone+0x10/0x10
[  119.482516]  ? handle_mm_fault+0x590/0x9b0
[  119.482863]  __x64_sys_futex+0x1c9/0x4d0
[  119.483193]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  119.483665]  ? __pfx___x64_sys_futex+0x10/0x10
[  119.484045]  do_syscall_64+0xbf/0x360
[  119.484354]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  119.484766] RIP: 0033:0x7f1261074b19
[  119.485072] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  119.486501] RSP: 002b:00007ffdaa7806d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  119.487098] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1261074b19
[  119.487662] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1261187f68
[  119.488226] RBP: 00007f1261187f60 R08: 00007f125e5ea700 R09: 0000000000000000
[  119.488787] R10: 00007f125e5ea700 R11: 0000000000000246 R12: 00007f126118c090
[  119.489359] R13: 00007ffdaa7807e0 R14: 00007f1261187f60 R15: 000000000001d228
[  119.489929]  </TASK>
[  119.490119] Modules linked in:
[  119.490380] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#3] SMP KASAN NOPTI
[  119.491252] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  119.491939] CPU: 0 UID: 0 PID: 3927 Comm: syz-executor.3 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  119.492883] Tainted: [D]=DIE, [W]=WARN
[  119.493186] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  119.493831] RIP: 0010:perf_tp_event+0x175/0xe70
[  119.494210] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  119.495625] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012
[  119.496048] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[  119.496629] RDX: ffff8880446ad280 RSI: ffffffff818995b7 RDI: 0000000100000190
[  119.497207] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc16450
[  119.497766] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[  119.498323] R13: 000000000000002c R14: ffff88806ce31490 R15: dffffc0000000000
[  119.498885] FS:  00007fa74e020700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  119.499522] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  119.499980] CR2: 00007f20692e53a4 CR3: 0000000043a24000 CR4: 0000000000350ef0
[  119.500542] Call Trace:
[  119.500751]  <IRQ>
[  119.500936]  ? arch_stack_walk+0x86/0xf0
[  119.501267]  ? __pfx_perf_tp_event+0x10/0x10
[  119.501625]  ? __lock_acquire+0xc65/0x1b70
[  119.501967]  ? trace_rcu_utilization+0x26/0x190
[  119.502347]  ? rcu_sched_clock_irq+0x7a0/0x2b40
[  119.502726]  ? __lock_acquire+0x694/0x1b70
[  119.503068]  ? kvm_sched_clock_read+0x16/0x30
[  119.503434]  ? sched_clock+0x37/0x60
[  119.503743]  ? lock_is_held_type+0x9e/0x120
[  119.504095]  ? perf_trace_run_bpf_submit+0xef/0x180
[  119.504494]  perf_trace_run_bpf_submit+0xef/0x180
[  119.504892]  perf_trace_lock+0x337/0x5d0
[  119.505223]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.505590]  ? check_preempt_wakeup_fair+0x406/0x950
[  119.505995]  ? hrtimer_interrupt+0x114/0x830
[  119.506348]  lock_release+0x1ab/0x290
[  119.506657]  ktime_get_update_offsets_now+0xab/0x3c0
[  119.507066]  ? hrtimer_interrupt+0x114/0x830
[  119.507424]  hrtimer_interrupt+0x114/0x830
[  119.507761]  ? __pfx_sched_ttwu_pending+0x10/0x10
[  119.508152]  ? trace_csd_function_exit+0x134/0x190
[  119.508550]  ? __flush_smp_call_function_queue+0x443/0x740
[  119.509007]  __sysvec_apic_timer_interrupt+0xbb/0x330
[  119.509436]  sysvec_apic_timer_interrupt+0x6b/0x80
[  119.509848]  </IRQ>
[  119.510041]  <TASK>
[  119.510230]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  119.510648] RIP: 0010:oops_exit+0x0/0x50
[  119.510975] Code: f1 39 00 be ff ff ff ff 48 c7 c7 50 ac 43 86 e8 c6 0f f9 ff 5b e9 20 f1 39 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 06 f1 39 00 8b 1d c0 ed 4e 06 31 ff 89 de e8 27
[  119.512457] RSP: 0018:ffff888013edf690 EFLAGS: 00000202
[  119.512888] RAX: 000000000002b6bb RBX: 0000000000000212 RCX: ffffc900017f9000
[  119.513493] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007
[  119.514050] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f11c90
[  119.514608] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888013edf758
[  119.515167] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000
[  119.515737]  ? oops_end+0x4a/0xe0
[  119.516029]  oops_end+0x65/0xe0
[  119.516311]  exc_general_protection+0x1a2/0x330
[  119.516692]  asm_exc_general_protection+0x26/0x30
[  119.517088] RIP: 0010:perf_tp_event+0x175/0xe70
[  119.517467] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  119.518883] RSP: 0018:ffff888013edf800 EFLAGS: 00010212
[  119.519308] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900017f9000
[  119.519867] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  119.520454] RBP: ffff888013edfa70 R08: ffff88806ce31340 R09: ffffe8ffffc16450
[  119.521050] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[  119.521613] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  119.522196]  ? perf_tp_event+0x167/0xe70
[  119.522541]  ? __pfx_perf_tp_event+0x10/0x10
[  119.522916]  ? lock_is_held_type+0x9e/0x120
[  119.523264]  ? perf_trace_lock+0xb5/0x5d0
[  119.523596]  ? perf_trace_lock+0xb5/0x5d0
[  119.523932]  ? tracing_gen_ctx_irq_test+0x167/0x1f0
[  119.524342]  ? perf_swevent_event+0x63/0x3f0
[  119.524712]  ? perf_tp_event+0x807/0xe70
[  119.525047]  ? perf_trace_run_bpf_submit+0xef/0x180
[  119.525448]  ? __pfx_perf_tp_event+0x10/0x10
[  119.525803]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  119.526282]  ? do_raw_spin_unlock+0x53/0x220
[  119.526642]  ? perf_trace_run_bpf_submit+0xef/0x180
[  119.527043]  perf_trace_run_bpf_submit+0xef/0x180
[  119.527433]  perf_trace_lock+0x337/0x5d0
[  119.527760]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.528130]  ? lock_acquire+0x15e/0x2f0
[  119.528449]  ? futex_ref_get+0x48/0x300
[  119.528768]  ? futex_ref_get+0x114/0x300
[  119.529098]  ? futex_hash+0x15c/0x390
[  119.529404]  lock_release+0x1ab/0x290
[  119.529712]  ? futex_hash+0x15c/0x390
[  119.530019]  futex_ref_get+0x119/0x300
[  119.530328]  ? futex_hash+0x15c/0x390
[  119.530634]  futex_hash+0x70/0x390
[  119.530927]  futex_wake+0x143/0x540
[  119.531220]  ? __pfx_perf_trace_lock+0x10/0x10
[  119.531589]  ? __pfx_futex_wake+0x10/0x10
[  119.531929]  ? __do_sys_perf_event_open+0x44d/0x2c20
[  119.532339]  ? lock_release+0xc8/0x290
[  119.532653]  do_futex+0x26d/0x370
[  119.532944]  ? __pfx_do_futex+0x10/0x10
[  119.533265]  __x64_sys_futex+0x1c9/0x4d0
[  119.533591]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  119.534082]  ? __pfx___x64_sys_futex+0x10/0x10
[  119.534464]  ? xfd_validate_state+0x55/0x180
[  119.534838]  do_syscall_64+0xbf/0x360
[  119.535146]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  119.535554] RIP: 0033:0x7fa750aaab19
[  119.535848] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  119.537306] RSP: 002b:00007fa74e020218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  119.537915] RAX: ffffffffffffffda RBX: 00007fa750bbdf68 RCX: 00007fa750aaab19
[  119.538482] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fa750bbdf6c
[  119.539043] RBP: 00007fa750bbdf60 R08: 000000000000000e R09: 0000000000000000
[  119.539625] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fa750bbdf6c
[  119.540201] R13: 00007ffc39b478bf R14: 00007fa74e020300 R15: 0000000000022000
[  119.540771]  </TASK>
[  119.540979] Modules linked in:
[  119.541256] ---[ end trace 0000000000000000 ]---
[  119.541258] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#4] SMP KASAN NOPTI
[  119.541642] RIP: 0010:perf_tp_event+0x175/0xe70
[  119.542510] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  119.542879] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  119.543495] CPU: 1 UID: 0 PID: 3931 Comm: syz-executor.2 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  119.544920] RSP: 0018:ffff888013edf800 EFLAGS: 00010212
[  119.545848] Tainted: [D]=DIE, [W]=WARN
[  119.546258] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900017f9000
[  119.546560] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  119.547112] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  119.547761] RIP: 0010:perf_tp_event+0x175/0xe70
[  119.548312] RBP: ffff888013edfa70 R08: ffff88806ce31340 R09: ffffe8ffffc16450
[  119.548678] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  119.549238] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[  119.550660] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012
[  119.551218] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  119.551634] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  119.552219] FS:  00007fa74e020700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  119.552793] RDX: ffff8880446ab700 RSI: ffffffff818995b7 RDI: 0000000000000191
[  119.553455] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  119.554025] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd16450
[  119.554480] CR2: 00007f20692e53a4 CR3: 0000000043a24000 CR4: 0000000000350ef0
[  119.555030] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[  119.555585] Kernel panic - not syncing: Fatal exception in interrupt
[  120.599532] Shutting down cpus with NMI
[  120.600574] Kernel Offset: disabled
[  120.600876] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

VM DIAGNOSIS:
11:18:31  Registers:
info registers vcpu 0
RAX=0000000000000031 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888013edf158
R8 =0000000000000000 R9 =ffffed100175f046 R10=0000000000000031 R11=30376578302f4952
R12=0000000000000031 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0
RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007fa74e020700 00000000 00000000
GS =0000 ffff8880e55dd000 00000000 00000000
LDT=0000 fffffe7c00000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f20692e53a4 CR3=0000000043a24000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007fa750b917c000007fa750b917c8
XMM02=00007fa750b917e000007fa750b917c0 XMM03=00007fa750b917c800007fa750b917c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84bdec0e RDX=fffffbfff0f0ec09
RSI=0000000000000004 RDI=ffffffff87876044 RBP=ffffffff87876044 RSP=ffff888016db75b0
R8 =0000000000000000 R9 =fffffbfff0f0ec08 R10=ffffffff87876047 R11=202c746c75616620
R12=1ffff11002db6eb7 R13=0000000000000007 R14=fffffbfff0f0ec08 R15=ffff888016db75e8
RIP=ffffffff84bdeda0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 000055558d4d0400 00000000 00000000
GS =0000 ffff8880e56dd000 00000000 00000000
LDT=0000 fffffe5800000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055558d4d1c18 CR3=000000000cb59000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f126115b7c000007f126115b7c8
XMM02=00007f126115b7e000007f126115b7c0 XMM03=00007f126115b7c800007f126115b7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000