alloc_bprm+0x2e3/0x6e0
 kernel_execve+0xb0/0x3d0
 call_usermodehelper_exec_async+0x25f/0x4e0
 ret_from_fork+0x34b/0x430
 ret_from_fork_asm+0x1a/0x30
BUG: Bad rss-counter state mm:000000001064c0ec type:MM_SHMEMPAGES val:15 Comm:modprobe Pid:4044
random: crng reseeded on system resumption
faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
random: crng reseeded on system resumption
audit: type=1400 audit(1756793244.226:14): avc:  denied  { write } for  pid=4062 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
BUG: Bad rss-counter state mm:000000001e986e94 type:MM_SHMEMPAGES val:13 Comm:modprobe Pid:4057
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 UID: 0 PID: 4064 Comm: syz-executor.4 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff88801e98f9c8 EFLAGS: 00010013
RAX: dffffc0000000000 RBX: ffff888018cdb840 RCX: ffffffff817e42fe
RDX: 0000000000000001 RSI: ffffffff817e43d6 RDI: 000000000000000e
RBP: ffffe8ffffd0ce58 R08: ffffffff85ca4140 R09: ffffed1003d31f80
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000006 R14: ffff888018cdb8a0 R15: ffff888018cdb8d8
FS:  00007f6528a45700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f295054f610 CR3: 000000000ea23000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 event_sched_in+0x446/0xb60
 merge_sched_in+0xb4d/0x1810
 visit_groups_merge.constprop.0.isra.0+0x8d1/0x1150
 ctx_sched_in+0x579/0x9b0
 perf_event_sched_in+0x5d/0x90
 __perf_event_task_sched_in+0x2ec/0x5e0
 finish_task_switch.isra.0+0x410/0x840
 __schedule+0xe86/0x3590
 schedule+0xdb/0x390
 exit_to_user_mode_loop+0x69/0x110
 do_syscall_64+0x2f7/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f652b4cfb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6528a45218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f652b5e2f68 RCX: 00007f652b4cfb19
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f652b5e2f6c
RBP: 00007f652b5e2f60 R08: 000000000000000e R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 00007f652b5e2f6c
R13: 00007ffe54eab22f R14: 00007f6528a45300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff88801e98f9c8 EFLAGS: 00010013
RAX: dffffc0000000000 RBX: ffff888018cdb840 RCX: ffffffff817e42fe
RDX: 0000000000000001 RSI: ffffffff817e43d6 RDI: 000000000000000e
RBP: ffffe8ffffd0ce58 R08: ffffffff85ca4140 R09: ffffed1003d31f80
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000006 R14: ffff888018cdb8a0 R15: ffff888018cdb8d8
FS:  00007f6528a45700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f295054f610 CR3: 000000000ea23000 CR4: 0000000000350ef0
note: syz-executor.4[4064] exited with irqs disabled
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 3a                	test   %edi,(%rdx)
   4:	01 00                	add    %eax,(%rax)
   6:	00 4c 89 75          	add    %cl,0x75(%rcx,%rcx,4)
   a:	00 4d 85             	add    %cl,-0x7b(%rbp)
   d:	ed                   	in     (%dx),%eax
   e:	74 2a                	je     0x3a
  10:	e8 da b2 f5 ff       	callq  0xfff5b2ef
  15:	49 8d 7d 08          	lea    0x8(%r13),%rdi
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 df 00 00 00    	jne    0x113
  34:	4d 89 75 08          	mov    %r14,0x8(%r13)
  38:	eb 03                	jmp    0x3d
  3a:	45 31 e4             	xor    %r12d,%r12d
  3d:	e8                   	.byte 0xe8
  3e:	ad                   	lods   %ds:(%rsi),%eax
  3f:	b2                   	.byte 0xb2