Warning: Permanently added '[localhost]:14657' (ECDSA) to the list of known hosts. 2025/06/03 08:24:41 fuzzer started 2025/06/03 08:24:41 dialing manager at localhost:34361 syzkaller login: [ 94.116463] cgroup: Unknown subsys name 'net' [ 94.262213] cgroup: Unknown subsys name 'cpuset' [ 94.309422] cgroup: Unknown subsys name 'rlimit' 2025/06/03 08:24:58 syscalls: 206 2025/06/03 08:24:58 code coverage: enabled 2025/06/03 08:24:58 comparison tracing: enabled 2025/06/03 08:24:58 extra coverage: enabled 2025/06/03 08:24:58 setuid sandbox: enabled 2025/06/03 08:24:58 namespace sandbox: enabled 2025/06/03 08:24:58 Android sandbox: enabled 2025/06/03 08:24:58 fault injection: enabled 2025/06/03 08:24:58 leak checking: enabled 2025/06/03 08:24:58 net packet injection: enabled 2025/06/03 08:24:58 net device setup: enabled 2025/06/03 08:24:58 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/06/03 08:24:58 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/06/03 08:24:58 USB emulation: enabled 2025/06/03 08:24:58 hci packet injection: enabled 2025/06/03 08:24:58 wifi device emulation: enabled 2025/06/03 08:24:58 802.15.4 emulation: enabled 2025/06/03 08:24:58 fetching corpus: 0, signal 0/0 (executing program) 2025/06/03 08:24:59 starting 8 fuzzer processes 08:24:59 executing program 0: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x85c00) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x10001, 0x47) io_uring_register$IORING_UNREGISTER_EVENTFD(r1, 0x5, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x802, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, &(0x7f00000000c0)=0x8001) r3 = syz_open_dev$vcsn(&(0x7f0000000100), 0x80000000, 0x2100) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r3, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r4, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x40, 0x9}}}}, ["", "", "", "", ""]}, 0x28}}, 0x4c890) recvmsg(r1, &(0x7f0000000540)={&(0x7f00000002c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000340)=""/87, 0x57}, {&(0x7f00000003c0)=""/228, 0xe4}], 0x2, &(0x7f0000000500)=""/13, 0xd}, 0x10000) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) epoll_pwait2(r3, &(0x7f0000000580)=[{}], 0x1, &(0x7f0000000600)={r6, r7+60000000}, &(0x7f0000000640)={[0x1000]}, 0x8) r8 = shmget$private(0x0, 0x5000, 0x78000000, &(0x7f0000ff9000/0x5000)=nil) shmat(r8, &(0x7f0000ff9000/0x4000)=nil, 0x8000) r9 = eventfd(0x3f) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r9, &(0x7f0000000680)={0x4}) clock_gettime(0x0, &(0x7f0000000700)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000740)={0x0, 0x0}) futimesat(r1, &(0x7f00000006c0)='./file0\x00', &(0x7f0000000780)={{r10, r11/1000+60000}, {r12, r13/1000+60000}}) 08:24:59 executing program 1: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'sit0\x00', 0x0, 0x6, 0xff, 0x80, 0x5, 0x9, @ipv4={'\x00', '\xff\xff', @local}, @private1, 0x8, 0x20, 0xfffffff8, 0x8}}) r0 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x0, 0x422000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl0\x00', r1, 0x4, 0x3f, 0x65, 0x2, 0x21, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x11}, 0x20, 0x700, 0x7, 0x1}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r3, 0x89f5, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'ip6_vti0\x00', r2, 0x29, 0x1, 0x2, 0x5, 0x66, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, 0x40, 0x80, 0xbd40, 0x100}}) socketpair(0x27, 0x2, 0x3, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl2\x00', r4, 0x2f, 0x7f, 0x9, 0x0, 0x6, @local, @ipv4={'\x00', '\xff\xff', @remote}, 0x8, 0x20, 0x20, 0xf1f2}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4010) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000540)={'syztnl2\x00', &(0x7f00000004c0)={'sit0\x00', r7, 0x4, 0x7, 0x5, 0x8001, 0x1f, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @mcast2, 0x10, 0x0, 0xffffffff, 0x9}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r6, 0x89f6, &(0x7f0000000600)={'sit0\x00', &(0x7f0000000580)={'ip6gre0\x00', r8, 0x29, 0x6, 0x1, 0x7, 0x40, @mcast1, @empty, 0x1, 0x40, 0xae, 0x400}}) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_udp_SIOCINQ(r9, 0x541b, &(0x7f0000000640)) r10 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r6, 0x89fa, &(0x7f0000000700)={'syztnl0\x00', &(0x7f0000000680)={'ip6_vti0\x00', r8, 0x2f, 0x80, 0x5, 0x0, 0x10, @mcast2, @loopback, 0x7800, 0x8, 0x3, 0x9}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r10, 0x89fa, &(0x7f00000007c0)={'syztnl1\x00', &(0x7f0000000740)={'ip6gre0\x00', r11, 0x4, 0x70, 0x4, 0x6, 0x1a, @mcast2, @mcast1, 0x27, 0x4f, 0xffffffff, 0x8}}) r12 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r12, 0x89f9, &(0x7f0000000880)={'ip6tnl0\x00', &(0x7f0000000800)={'ip6gre0\x00', r7, 0x2f, 0x1, 0xb7, 0x7f, 0x4, @mcast2, @dev={0xfe, 0x80, '\x00', 0x2a}, 0x7, 0x8000, 0x3, 0x550}}) r13 = memfd_secret(0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r13, 0x89f8, &(0x7f0000000980)={'syztnl2\x00', &(0x7f0000000900)={'ip6tnl0\x00', 0x0, 0x2f, 0xaf, 0x3, 0x0, 0x58, @dev={0xfe, 0x80, '\x00', 0x12}, @local, 0x700, 0x20, 0x7, 0x2}}) 08:24:59 executing program 2: epoll_pwait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x20, &(0x7f0000000040)={[0x1be]}, 0x8) r0 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0xa0000000}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0xc0000010}) r2 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x6, 0x10, 0xffffffffffffffff, 0x8000000) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000140)=@IORING_OP_CLOSE={0x13, 0x1, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r3}}, 0x400) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000180)={0x2000}) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f00000001c0)='.log\x00', 0x200400, 0x1) write$vga_arbiter(r4, &(0x7f0000000200), 0xf) r5 = syz_open_dev$vcsn(&(0x7f0000000240), 0x8, 0x103000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r4) sendmsg$NL80211_CMD_NEW_MPATH(r5, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000200}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r6, 0x200, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x34}, 0x1, 0x0, 0x0, 0x240000d1}, 0x8090) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r5, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, r7, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x7}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) r8 = memfd_secret(0x0) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r8, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x64, r9, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x20008041}, 0x800) sendmsg$NL80211_CMD_REQ_SET_REG(r4, &(0x7f00000007c0)={&(0x7f00000006c0), 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x20, 0x0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0xb4da51e896ca334a}, 0x20000000) 08:24:59 executing program 3: ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0xfffffffe}) sendmsg$NL80211_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3c}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xc}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1f}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2f}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000014}, 0x200c4005) r0 = syz_open_dev$vcsn(&(0x7f00000001c0), 0x8, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x0, 0x2, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040080}, 0x48040) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) r2 = openat$incfs(r0, &(0x7f0000000340)='.pending_reads\x00', 0x44000, 0x40) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000380)={0x1}) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000440)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000000880)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000480)={0x398, r3, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x1a}}}}, [@NL80211_ATTR_PRIVACY={0x4}, @acl_policy=[@NL80211_ATTR_MAC_ADDRS={0x40, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}], @NL80211_ATTR_P2P_OPPPS={0x5}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3cf}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3c}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}], @NL80211_ATTR_HIDDEN_SSID={0x8, 0x7e, 0x1}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x7}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x5}, @beacon=[@NL80211_ATTR_IE={0x63, 0x2a, [@mesh_id={0x72, 0x6}, @preq={0x82, 0x3b, @not_ext={{}, 0x2, 0x34, 0x401, @device_b, 0x40, "", 0x6, 0x2, 0x3, [{{0x1, 0x0, 0x1}, @device_b, 0x5}, {{0x1}, @device_b, 0x2}, {{}, @broadcast, 0x8}]}}, @sec_chan_ofs={0x3e, 0x1, 0x2}, @rann={0x7e, 0x15, {{0x1, 0x30}, 0x3, 0x1, @device_b, 0x8000, 0x0, 0x3b9}}]}], @crypto_settings=[@NL80211_ATTR_AKM_SUITES={0x20, 0x4c, [0xfac09, 0xfac05, 0xfac03, 0xfac0f, 0xfac02, 0xfac01, 0xfac0a]}, @NL80211_ATTR_PMK={0x102, 0xfe, "c3c42b9afb6ee582842d7afcfe0baeba8bb0c7eb030a82c5bc48e1f82cc1031f71fcf63e405b2739dcbafc908414ddcf6af49c9b6195e2c926fffc00df5b7ab817a7271d245195fe67a0bd039947f99df3ff499297de71028383d2657abc299f42dad33319dc7f47d6c50ce1747faa45bbcacb27910df29a4a1cbac628943a088b77fca5157111880a0c1c3cdef753009a128aacf65cd3bed34f01b834eb21dd5ae26ceee8786910fa217a9279ed14eb36a02a7545afd1ae3868fe92e95492c03d2c911298f692134db2ef5bb6127950999bd8acda463fe9e94bba46e3c62681baa6598ffe16964075a6216c7e0bc67d40046883c425adffceb7636873b1"}, @NL80211_ATTR_PMK={0x102, 0xfe, "8bd4818951e188f7f42ec849f606023caa552e623a6b1ca090d162f422d915ddea6681839866f2eb631423dea033b8f67506bafe77124c8ed4d4b54348bf604478a7bffea2985bb716a94ac9877de54b2deec3baf71dc43985b0f313ed0163bda5c54dcafeb79e792a43ae1382cad94b759574a2a1cf705503762f3f38087b44e246bfcf3aac29a8fe43750f246030ea7fe2062367f46e107fe69983e096481f20fd0092d0b120942e6afc16670c91e7f8efcf5bbb8da927a755f7ed46abaaded60676365b37306225c4ce76601262d2318a4052e1a3813614b8bc7a6f38f3a082b0fe9a2e9ae43b37a344c4b65afce99336e0b68b971e6b5e3d6116d3ae"}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}]]}, 0x398}, 0x1, 0x0, 0x0, 0x20008040}, 0x10) sendmsg$NL80211_CMD_GET_COALESCE(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x20, r3, 0x300, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x4, 0x3c}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20000801}, 0x840) pipe2$9p(&(0x7f00000009c0), 0x4000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r1, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x3c, r3, 0x800, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x26, 0x5b, "60c59c2e5046720528d4e3ba954c6e1e82798a1552ce051c2e4f7441834e9ce7cfd0"}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4091}, 0x4000) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000b00)='./binderfs2/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0xffff) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) 08:24:59 executing program 4: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x64, r0, 0x200, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa4, r1, 0x160c, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x800, 0x2, 0x3, 0x0, {0x316, 0x4, 0x0, 0x1f, 0x0, 0x1, 0x1, 0x3}, 0x300, 0x19a2, 0x2}}, @NL80211_ATTR_USE_MFP={0x8}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x2}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xcbc4}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}], @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0xc, 0x3, 0x3, 0x0, {0x7, 0x8, 0x0, 0x4, 0x0, 0x0, 0x1, 0x1}, 0x800, 0x80000000, 0x60}}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @random="c370665c577f"}]}, 0xa4}}, 0x894) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x20, r4, 0x31, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20044080}, 0x4000010) syz_genetlink_get_family_id$mptcp(&(0x7f0000000500), r3) r6 = syz_open_dev$vcsn(&(0x7f0000000540), 0x8b8, 0x30b081) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r6, 0x3309) r7 = memfd_secret(0x0) sendmsg$NL80211_CMD_SET_REG(r7, &(0x7f0000000740)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000700)={&(0x7f00000005c0)={0x118, r4, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_RULES={0xb0, 0x22, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x64b}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x7}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7f}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x80000001}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x101}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xfffffffd}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xde}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x80000000}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x10000}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x88f}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xbaf0}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x9}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xffff8001}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xffff}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x6}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7f}]}]}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x7d}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x6b}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}, @NL80211_ATTR_REG_RULES={0x18, 0x22, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3f}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x1000}]}]}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x5c}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x6c}]}, 0x118}, 0x1, 0x0, 0x0, 0x20004840}, 0x4000085) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), r3) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0x94, r8, 0x10, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x24, 0x27}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1cc}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @NL80211_ATTR_MESH_CONFIG={0x4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xfffffffe}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_BSS_BASIC_RATES={0x18, 0x24, [{0x6}, {0x12}, {0x30}, {0x16, 0x1}, {0x1b, 0x1}, {0x2, 0x1}, {0x6c}, {0x5}, {0x6c}, {0x18}, {0x2}, {0x4, 0x1}, {0x16}, {0x18}, {0x6c}, {0x3}, {0x16}, {0x12, 0x1}, {0x6c}, {0x1, 0x1}]}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x1) ioctl$MON_IOCG_STATS(r7, 0x80089203, &(0x7f0000000940)) r9 = openat$incfs(r6, &(0x7f0000000980)='.pending_reads\x00', 0x0, 0x21) bind$802154_raw(r9, &(0x7f00000009c0)={0x24, @long}, 0x14) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000a00), 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x50, 0x0, 0x10, 0x70bd2b, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}]}, 0x50}}, 0x24000081) [ 111.925092] audit: type=1400 audit(1748939099.931:7): avc: denied { execmem } for pid=274 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:24:59 executing program 5: ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000000)={0x2}) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000040)={0xffffffffffffffff}) r0 = memfd_secret(0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000580)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000000c0)={0x45c, 0x0, 0x300, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TESTDATA={0xd7, 0x45, "d8b70e4339287da7f0ef23ff47b9494d74c6a914c6feffd89311ec7e153f6bb6cbc172087cd2118f7e396e7621ec81594944decad15281b37ba192c8540d52ce37a9405571e6b83dc790170eff234951dcaedda687b1c6b96560332fdb675e91a6e01b64a21f74f1d12c4c94f13096aa76afe02a005a0941d16dce6ff72e8be8fa611240b2f9496e15dd432a453aa04fc92258a801a122da91eb0a2171360a35ea7adfd247da86e187203f211fe403fe9abd174185b7e0c7ad7f0defb2dbc318ee2d07c90c59c89276ac4efd49bec71538b917"}, @NL80211_ATTR_TESTDATA={0x74, 0x45, "a7265cf67e9dd9d5f1f231de7f42739c6b1ed3dbf86cade0cdf8253e72d4b3f28e4a156e9a23fe45a236a6639788bf9ccd184e11833466382ed1b87fdb807ee9b9b70bd97d3b7f5e17f4de622396b80c58a8db31ee7cd9a3ebb9aa804855b7c72a787e45cd460dea2c9b3e4d433e5cf5"}, @NL80211_ATTR_TESTDATA={0xb5, 0x45, "56a42a14819f4adef434e1e946de5f8b95f0a3ba4ee26574eadfd199efe66f9a3a68bfe23839c16be31e6d7792bb44dcc89fa14cb5a83690207c86c5673f26af5363a69bfff597890c037d0a0490cff32f04c6ceb065633720bf22941d91f0120f8cf1a7aeb74238285652d49d54783071f203e8090d35549d183c55126fe0d7a8bbd3d801f0f241bc5a75cc022c11d742872928177556e139d25cb699249ab0e4ac20e587d601971a6eb308460879fa10"}, @NL80211_ATTR_TESTDATA={0xa9, 0x45, "73c79822a7c203b4baa5ddd5732f015419fcc5bb171ba20fe17ceba89ba562d58d7798677f051b00df4bde00286b7119d87763f4d60d4d341ae6ef3bb28a9333bc255fcbde5db9a3c628dcb95335028c37e745535d6806855e8a0db26e4ea91cf1cfe357e0300027ad005c9ab7804ce23e08fccb50ae2f522666fcdbc85e0a4b51e91c8ce4987f3d9d260c7d6b1d072ae90bc10e4f1a7592f4e6fda4fc0de6add4519d1b8c"}, @NL80211_ATTR_TESTDATA={0xe2, 0x45, "e16d56622c1c9d80f3527084f082b9efa75549ce2c330a55a2e7c5ceea23a620d22de8631677250be6ab4d40fac8d10acd148bfa396057999ea0123dcc60a165e0d129b897317225dc7d27d02ed09a5e8bf32c615de31f3aaed4282a0c7795cd7c9cc007326c2046a511599dc6cda9d2e59f8089cae78fa813b961da69251a35035e2ee20b73fe1fbec47584b8dab53dd03207eab48c74e382c7b206bae1fbb3e860f0fd68e7afb4a9e14df7dda20bcb125fb6cc8b4cd4b45ea26fec3aeb97b9df6bed292a9bdb889b63baae3ba60c1751781aa4e29b4a60a4a6819dab2b"}, @NL80211_ATTR_TESTDATA={0xab, 0x45, "5f021814940a2965c54a8752a7bcb9614686dff0c1c50ba626e8991012269b57c4a2083286616a6ab4701173993050bcd616fb6f1ae239df1f2aea79d1df8f0a3a0f5277cc34a20aabb3c3476c87d61ff436f3acd04eeb73ef4e2c78a6cd0922834564d5a4a330e230fc65673491378cf0b8f195b9f90f18e33d5c8c0539aa6f9a8539710e4c28a15b7d6999b686a9f65bd0845c9cb7803a746f897cabe68f72ca8641057516e5"}]}, 0x45c}}, 0x4008000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000005c0)=0x4d1) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r0) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x50, r1, 0x828, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6a}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x14}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2c}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x15}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x11}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x42}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x8001}, 0x20000000) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r0, 0x40046210, &(0x7f0000000780)) getpgid(0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'batadv0\x00', 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000880)={'ip6gre0\x00', &(0x7f0000000800)={'ip6gre0\x00', r2, 0x4, 0x4, 0x7, 0x7, 0x2, @local, @private0, 0x7800, 0x0, 0x579, 0x9}}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000008c0)={0x1}) r4 = memfd_secret(0x0) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r4, 0x3309) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000900)=@IORING_OP_ASYNC_CANCEL={0xe, 0x2, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0x2) r5 = syz_open_dev$vcsn(&(0x7f0000000940), 0xb4, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000a80)={&(0x7f00000009c0)={0xc0, r1, 0x300, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x3f, 0x80}}}}, [@NL80211_ATTR_TX_RATES={0xa0, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x70, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x46, 0x2, [{0x1, 0xa}, {0x1, 0xa}, {0x7, 0x1}, {0x6, 0x12}, {0x2, 0x1}, {0x4, 0xa}, {0x0, 0xa}, {0x7, 0x8}, {0x3, 0x7}, {0x4, 0x5}, {0x7, 0x9}, {0x2}, {0x4, 0x4}, {0x6, 0xa}, {0x2, 0x8}, {0x7, 0xa}, {0x3}, {}, {0x2, 0x8}, {0x2, 0x4}, {0x6, 0x9}, {0x6, 0x5}, {0x3, 0xa}, {0x7, 0xa}, {0x0, 0x4}, {0x7, 0x8}, {0x7, 0x2}, {0x5, 0x6}, {0x1, 0x9}, {0x5, 0x2}, {0x7, 0x1}, {0x1, 0x9}, {0x5, 0x2}, {0x2, 0x5}, {0x2, 0x9}, {0x6, 0x5}, {0x5, 0x3}, {0x4, 0x4}, {0x1, 0x6}, {0x7, 0x1}, {0x5, 0x3}, {0x2}, {0x3, 0x5}, {0x1, 0x1}, {0x6, 0x3}, {0x4}, {0x5, 0x5}, {0x6, 0xa}, {0x5, 0x9}, {0x6, 0x5}, {0x0, 0x4}, {0x4, 0x7}, {0x3, 0x7}, {0x0, 0x1}, {0x0, 0x7}, {0x7, 0x1}, {0x2, 0x1}, {0x4, 0x5}, {0x0, 0x5}, {0x1, 0x2}, {0x7, 0x9}, {0x7, 0x9}, {0x0, 0x1}, {0x7, 0x8}, {0x1, 0x9}, {0x1, 0x1}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x12, 0x2, [{0x3, 0x2}, {0x2, 0x2}, {0x0, 0x8}, {0x3, 0x8}, {0x6, 0x3}, {0x1, 0x9}, {0x2, 0x9}, {0x4, 0x4}, {0x4, 0x4}, {0x0, 0x6}, {0x0, 0x7}, {0x3, 0x1}, {0x2, 0x5}, {0x7}]}]}, @NL80211_BAND_60GHZ={0x2c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8000, 0x1000, 0x8001, 0x99, 0x4, 0xc000, 0x0, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7ff, 0xffff, 0x4, 0x8, 0x2164, 0x3, 0x7, 0x4]}}]}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4055}, 0x24000001) 08:25:00 executing program 6: syz_usb_disconnect(0xffffffffffffffff) syz_usb_ep_read(0xffffffffffffffff, 0x5, 0x71, &(0x7f0000000000)=""/113) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000000c0)='cgroup.threads\x00', 0x2, 0x0) r2 = fork() write$cgroup_pid(r1, &(0x7f0000000100)=r2, 0x12) socket$packet(0x11, 0x3, 0x300) openat$cgroup_procs(r0, &(0x7f0000000140)='tasks\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x0, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x101}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004040}, 0x801) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000002c0)=r2, 0x12) socketpair(0x25, 0x4, 0x4, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'syztnl1\x00', 0x0, 0x29, 0x20, 0x79, 0x9da0, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @remote}, 0x7, 0x8000, 0xffff, 0x2}}) sendmsg$NL80211_CMD_START_NAN(r5, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x50, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x87d0, 0x5a}}}}, [@NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x3}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x80}, @NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x80}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) openat$cgroup_type(r0, &(0x7f0000000540), 0x2, 0x0) r7 = io_uring_setup(0x2c34, &(0x7f0000000580)={0x0, 0x3018, 0x20, 0x2, 0xaf}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000001, 0x20010, r7, 0x10000000) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) 08:25:00 executing program 7: ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000000)) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000040)={0x0, 0x0, 0x5}) r0 = syz_open_dev$vcsn(&(0x7f0000000080), 0x40, 0x80) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)) write$cgroup_type(r0, &(0x7f0000000100), 0x9) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0xa, &(0x7f0000000140)=[{0x1b04, 0x80, 0x8, 0x8}, {0x400, 0x6, 0xff, 0xd1d0}, {0x254, 0x2, 0x44, 0x1}, {0x7fff, 0x9, 0xf8, 0x7}, {0x8, 0x8, 0x1f, 0x80000000}, {0x8000, 0x6, 0x76, 0x9}, {0x8, 0x3, 0xc5, 0x1}, {0xb4, 0x1, 0x69, 0x10000}, {0x1, 0x8, 0xc0, 0x2}, {0x5, 0x0, 0xff, 0x2}]}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x48) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000240)={0x1}) r2 = syz_io_uring_setup(0x5cb8, &(0x7f0000000280)={0x0, 0xace4, 0x4, 0x2, 0x376, 0x0, r0}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000300), &(0x7f0000000340)) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = accept4$packet(r0, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000003c0)=0x14, 0x0) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x9) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000400)=[r1, r3, r4, r5, 0xffffffffffffffff, r0, r6], 0x7) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4c094}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000580)={0x2, &(0x7f0000000540)=[{0x800, 0x3, 0x20, 0x4a0}, {0x80, 0x1, 0x7, 0x3}]}) write$vga_arbiter(r0, &(0x7f00000005c0)=@target={'target ', {'PCI:', 'f', ':', '4', ':', 'c', '.', '5'}}, 0x13) r7 = memfd_secret(0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000600)={0x0, 0x4, r7, 0xffff}) [ 113.384574] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 113.387076] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 113.389119] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 113.392989] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 113.395406] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 113.462948] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 113.467049] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 113.468706] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 113.473238] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 113.476634] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 113.487657] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 113.493280] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 113.496457] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 113.500586] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 113.518818] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 113.526021] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 113.529345] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 113.530577] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 113.535283] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 113.536474] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 113.539069] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 113.540679] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 113.543425] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 113.548163] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 113.551974] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 113.554573] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 113.555906] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 113.563348] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 113.567639] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 113.569320] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 113.574360] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 113.587010] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 113.590674] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 113.597233] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 113.614114] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 113.622385] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 113.626168] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 113.629546] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 113.652151] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 113.660625] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 115.472346] Bluetooth: hci0: command tx timeout [ 115.599843] Bluetooth: hci4: command tx timeout [ 115.600631] Bluetooth: hci2: command tx timeout [ 115.601278] Bluetooth: hci1: command tx timeout [ 115.664192] Bluetooth: hci6: command tx timeout [ 115.666086] Bluetooth: hci3: command tx timeout [ 115.729483] Bluetooth: hci7: command tx timeout [ 115.730862] Bluetooth: hci5: command tx timeout [ 117.519850] Bluetooth: hci0: command tx timeout [ 117.648930] Bluetooth: hci1: command tx timeout [ 117.649494] Bluetooth: hci2: command tx timeout [ 117.650357] Bluetooth: hci4: command tx timeout [ 117.713269] Bluetooth: hci6: command tx timeout [ 117.714091] Bluetooth: hci3: command tx timeout [ 117.777836] Bluetooth: hci5: command tx timeout [ 117.778412] Bluetooth: hci7: command tx timeout [ 119.568088] Bluetooth: hci0: command tx timeout [ 119.696948] Bluetooth: hci2: command tx timeout [ 119.697535] Bluetooth: hci4: command tx timeout [ 119.698375] Bluetooth: hci1: command tx timeout [ 119.759995] Bluetooth: hci6: command tx timeout [ 119.760611] Bluetooth: hci3: command tx timeout [ 119.825381] Bluetooth: hci5: command tx timeout [ 119.825992] Bluetooth: hci7: command tx timeout [ 121.616135] Bluetooth: hci0: command tx timeout [ 121.744791] Bluetooth: hci1: command tx timeout [ 121.745373] Bluetooth: hci4: command tx timeout [ 121.747567] Bluetooth: hci2: command tx timeout [ 121.808077] Bluetooth: hci3: command tx timeout [ 121.808653] Bluetooth: hci6: command tx timeout [ 121.872104] Bluetooth: hci7: command tx timeout [ 121.873637] Bluetooth: hci5: command tx timeout [ 176.303120] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 176.306915] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 176.313041] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 176.316792] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 176.320035] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 176.358142] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 176.360192] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 176.361644] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 176.365300] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 176.367472] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 176.420138] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 176.423302] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 176.425024] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 176.444220] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 176.453467] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 176.491447] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 176.494327] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 176.496228] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 176.501047] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 176.502005] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 176.504233] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 176.507498] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 176.515455] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 176.517352] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 176.519308] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 176.521300] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 176.527336] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 176.527393] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 176.530257] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 176.534679] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 176.610561] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 176.613195] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 176.619181] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 176.629095] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 176.668186] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 176.723808] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 176.747334] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 176.779269] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 176.821197] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 176.873701] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 178.384854] Bluetooth: hci0: command tx timeout [ 178.447912] Bluetooth: hci1: command tx timeout [ 178.514833] Bluetooth: hci2: command tx timeout [ 178.576851] Bluetooth: hci5: command tx timeout [ 178.639901] Bluetooth: hci4: command tx timeout [ 178.639926] Bluetooth: hci3: command tx timeout [ 178.832171] Bluetooth: hci6: command tx timeout [ 178.960942] Bluetooth: hci7: command tx timeout [ 180.432913] Bluetooth: hci0: command tx timeout [ 180.496941] Bluetooth: hci1: command tx timeout [ 180.560805] Bluetooth: hci2: command tx timeout [ 180.623847] Bluetooth: hci5: command tx timeout [ 180.688219] Bluetooth: hci3: command tx timeout [ 180.689547] Bluetooth: hci4: command tx timeout [ 180.880547] Bluetooth: hci6: command tx timeout [ 181.007838] Bluetooth: hci7: command tx timeout [ 182.480035] Bluetooth: hci0: command tx timeout [ 182.544243] Bluetooth: hci1: command tx timeout [ 182.608132] Bluetooth: hci2: command tx timeout [ 182.671839] Bluetooth: hci5: command tx timeout [ 182.735888] Bluetooth: hci3: command tx timeout [ 182.735966] Bluetooth: hci4: command tx timeout [ 182.927976] Bluetooth: hci6: command tx timeout [ 183.056831] Bluetooth: hci7: command tx timeout [ 184.529911] Bluetooth: hci0: command tx timeout [ 184.592438] Bluetooth: hci1: command tx timeout [ 184.656215] Bluetooth: hci2: command tx timeout [ 184.719863] Bluetooth: hci5: command tx timeout [ 184.784106] Bluetooth: hci4: command tx timeout [ 184.784139] Bluetooth: hci3: command tx timeout [ 184.975913] Bluetooth: hci6: command tx timeout [ 185.104623] Bluetooth: hci7: command tx timeout [ 238.493205] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 238.504284] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 238.506731] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 238.513468] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 238.521572] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 238.708645] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 238.711066] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 238.714032] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 238.719148] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 238.724173] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 238.766092] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 238.770269] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 238.810489] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 238.838235] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 238.857403] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 238.860202] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 238.864124] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 238.873919] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 238.876711] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 238.879492] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 238.881403] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 238.883429] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 238.887137] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 238.890068] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 238.892136] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 238.927317] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 238.940993] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 238.943124] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 238.970318] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 238.971026] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 238.972943] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 238.973919] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 238.987644] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 239.009935] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 239.014518] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 239.018330] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 239.018460] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 239.029293] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 239.052972] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 239.074614] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 240.593857] Bluetooth: hci0: command tx timeout [ 240.785086] Bluetooth: hci1: command tx timeout [ 240.976331] Bluetooth: hci3: command tx timeout [ 241.039879] Bluetooth: hci2: command tx timeout [ 241.103888] Bluetooth: hci6: command tx timeout [ 241.168228] Bluetooth: hci7: command tx timeout [ 241.169102] Bluetooth: hci4: command tx timeout [ 241.169618] Bluetooth: hci5: command tx timeout [ 242.639991] Bluetooth: hci0: command tx timeout [ 242.831928] Bluetooth: hci1: command tx timeout [ 243.023819] Bluetooth: hci3: command tx timeout [ 243.088215] Bluetooth: hci2: command tx timeout [ 243.151971] Bluetooth: hci6: command tx timeout [ 243.215993] Bluetooth: hci7: command tx timeout [ 243.216461] Bluetooth: hci5: command tx timeout [ 243.216951] Bluetooth: hci4: command tx timeout [ 244.687837] Bluetooth: hci0: command tx timeout [ 244.879933] Bluetooth: hci1: command tx timeout [ 245.071875] Bluetooth: hci3: command tx timeout [ 245.136108] Bluetooth: hci2: command tx timeout [ 245.199835] Bluetooth: hci6: command tx timeout [ 245.266016] Bluetooth: hci7: command tx timeout [ 245.266458] Bluetooth: hci4: command tx timeout [ 245.267369] Bluetooth: hci5: command tx timeout [ 246.736105] Bluetooth: hci0: command tx timeout [ 246.929418] Bluetooth: hci1: command tx timeout [ 247.120577] Bluetooth: hci3: command tx timeout [ 247.184008] Bluetooth: hci2: command tx timeout [ 247.247970] Bluetooth: hci6: command tx timeout [ 247.312108] Bluetooth: hci5: command tx timeout [ 247.312553] Bluetooth: hci7: command tx timeout [ 247.313059] Bluetooth: hci4: command tx timeout [ 300.840277] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 300.847662] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 300.855438] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 300.862808] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 300.871681] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 300.914016] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 300.920301] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 300.923070] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 300.933294] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 300.941340] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 301.037564] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 301.043051] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 301.051021] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 301.059364] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 301.071099] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 301.075593] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 301.080413] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 301.087194] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 301.101629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 301.117019] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 301.247599] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 301.251116] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 301.256593] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 301.259047] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 301.266416] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 301.275317] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 301.278435] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 301.302507] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 301.310255] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 301.312040] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 301.328575] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 301.345516] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 301.350503] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 301.361285] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 301.366457] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 301.373241] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 301.376618] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 301.384418] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 301.391550] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 301.395685] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 302.927989] Bluetooth: hci0: command tx timeout [ 302.991824] Bluetooth: hci1: command tx timeout [ 303.121794] Bluetooth: hci3: command tx timeout [ 303.185184] Bluetooth: hci2: command tx timeout [ 303.439887] Bluetooth: hci5: command tx timeout [ 303.440685] Bluetooth: hci4: command tx timeout [ 303.503865] Bluetooth: hci6: command tx timeout [ 303.568893] Bluetooth: hci7: command tx timeout [ 304.976883] Bluetooth: hci0: command tx timeout [ 305.040811] Bluetooth: hci1: command tx timeout [ 305.168872] Bluetooth: hci3: command tx timeout [ 305.231880] Bluetooth: hci2: command tx timeout [ 305.488076] Bluetooth: hci5: command tx timeout [ 305.488590] Bluetooth: hci4: command tx timeout [ 305.552271] Bluetooth: hci6: command tx timeout [ 305.616167] Bluetooth: hci7: command tx timeout [ 307.024006] Bluetooth: hci0: command tx timeout [ 307.089032] Bluetooth: hci1: command tx timeout [ 307.216080] Bluetooth: hci3: command tx timeout [ 307.279997] Bluetooth: hci2: command tx timeout [ 307.536014] Bluetooth: hci5: command tx timeout [ 307.536494] Bluetooth: hci4: command tx timeout [ 307.599884] Bluetooth: hci6: command tx timeout [ 307.664841] Bluetooth: hci7: command tx timeout [ 309.073786] Bluetooth: hci0: command tx timeout [ 309.136793] Bluetooth: hci1: command tx timeout [ 309.263866] Bluetooth: hci3: command tx timeout [ 309.328805] Bluetooth: hci2: command tx timeout [ 309.584841] Bluetooth: hci5: command tx timeout [ 309.585329] Bluetooth: hci4: command tx timeout [ 309.647866] Bluetooth: hci6: command tx timeout [ 309.711872] Bluetooth: hci7: command tx timeout [ 363.370088] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 363.376932] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 363.382602] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 363.401314] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 363.411293] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 363.550738] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 363.554862] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 363.559435] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 363.566598] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 363.571406] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 363.627429] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 363.637480] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 363.641437] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 363.660097] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 363.666270] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 363.744087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 363.754414] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 363.761648] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 363.763534] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 363.769182] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 363.786338] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 363.788486] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 363.807347] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 363.808679] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 363.829471] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 363.986251] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 364.008171] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 364.009975] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 364.014302] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 364.016297] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 364.021574] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 364.023939] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 364.028023] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 364.032146] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 364.042861] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 364.086355] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 364.121416] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 364.158069] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 364.207544] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 364.248558] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 365.456026] Bluetooth: hci0: command tx timeout [ 365.648617] Bluetooth: hci1: command tx timeout [ 365.711813] Bluetooth: hci2: command tx timeout [ 365.903817] Bluetooth: hci3: command tx timeout [ 365.905066] Bluetooth: hci4: command tx timeout [ 366.095822] Bluetooth: hci5: command tx timeout [ 366.160002] Bluetooth: hci6: command tx timeout [ 366.352142] Bluetooth: hci7: command tx timeout [ 367.504030] Bluetooth: hci0: command tx timeout [ 367.695812] Bluetooth: hci1: command tx timeout [ 367.760125] Bluetooth: hci2: command tx timeout [ 367.952463] Bluetooth: hci4: command tx timeout [ 367.953069] Bluetooth: hci3: command tx timeout [ 368.143849] Bluetooth: hci5: command tx timeout [ 368.209975] Bluetooth: hci6: command tx timeout [ 368.400534] Bluetooth: hci7: command tx timeout [ 369.552383] Bluetooth: hci0: command tx timeout [ 369.743868] Bluetooth: hci1: command tx timeout [ 369.809172] Bluetooth: hci2: command tx timeout [ 369.999850] Bluetooth: hci4: command tx timeout [ 370.000302] Bluetooth: hci3: command tx timeout [ 370.192150] Bluetooth: hci5: command tx timeout [ 370.257074] Bluetooth: hci6: command tx timeout [ 370.447885] Bluetooth: hci7: command tx timeout [ 371.599864] Bluetooth: hci0: command tx timeout [ 371.791795] Bluetooth: hci1: command tx timeout [ 371.856801] Bluetooth: hci2: command tx timeout [ 372.048055] Bluetooth: hci4: command tx timeout [ 372.048496] Bluetooth: hci3: command tx timeout [ 372.240124] Bluetooth: hci5: command tx timeout [ 372.303806] Bluetooth: hci6: command tx timeout [ 372.496292] Bluetooth: hci7: command tx timeout VM DIAGNOSIS: 08:30:10 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=0000000000000402 RCX=0000000000000001 RDX=0000000000000000 RSI=ffff888009627d38 RDI=ffffffff84b64b13 RBP=ffffffff85c2a518 RSP=ffff888009627c90 R8 =0000000000000000 R9 =fffffbfff0c83f6a R10=ffffffff8641fb57 R11=0000000000000001 R12=0000000000000296 R13=ffff888009627d38 R14=ffff888009603700 R15=ffff888009603700 RIP=ffffffff84b405ff RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e561b000 00000000 00000000 LDT=0000 fffffe5300000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055daaf1b44c8 CR3=000000002d36e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0070656474666f732e73656c75646f6d XMM01=0070656474666f732e73656c75646f6d XMM02=00000000000000000000ffffffffffff XMM03=00000000000000000000ff00000000ff XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=676f6c206d6f74737563000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000000 RBX=ffff888024c28000 RCX=0000000000000000 RDX=ffffed100120cc9f RSI=0000000000000000 RDI=ffff888024c28014 RBP=ffff8880090664e8 RSP=ffff888024cd7298 R8 =0000000000000000 R9 =ffffed100120cc9e R10=ffff8880090664f7 R11=0000000000000001 R12=ffff8880090664f0 R13=dffffc0000000000 R14=ffffed1002c5f370 R15=ffff8880162f9b80 RIP=ffffffff8150e249 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e571b000 00000000 00000000 LDT=0000 fffffe0100000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ff143de0260 CR3=000000000d01f000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=756e696c2d34365f3638782f62696c2f XMM01=2e6f747079726362696c2f756e672d78 XMM02=00312e312e6f732e6f74707972636269 XMM03=6c2f756e672d78756e696c2d34365f36 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000