Debian GNU/Linux 11 syzkaller ttyS0

Warning: Permanently added '[localhost]:48184' (ECDSA) to the list of known hosts.
2023/08/23 06:04:12 fuzzer started
2023/08/23 06:04:13 dialing manager at localhost:33549
syzkaller login: [   94.784331] cgroup: Unknown subsys name 'net'
[   95.006261] cgroup: Unknown subsys name 'rlimit'
[  106.885747] kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
2023/08/23 06:04:26 syscalls: 240
2023/08/23 06:04:26 code coverage: enabled
2023/08/23 06:04:26 comparison tracing: enabled
2023/08/23 06:04:26 extra coverage: enabled
2023/08/23 06:04:26 setuid sandbox: enabled
2023/08/23 06:04:26 namespace sandbox: enabled
2023/08/23 06:04:26 Android sandbox: enabled
2023/08/23 06:04:26 fault injection: enabled
2023/08/23 06:04:26 leak checking: enabled
2023/08/23 06:04:26 net packet injection: enabled
2023/08/23 06:04:26 net device setup: enabled
2023/08/23 06:04:26 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2023/08/23 06:04:26 devlink PCI setup: PCI device 0000:00:10.0 is not available
2023/08/23 06:04:26 USB emulation: enabled
2023/08/23 06:04:26 hci packet injection: enabled
2023/08/23 06:04:26 wifi device emulation: enabled
2023/08/23 06:04:26 802.15.4 emulation: enabled
2023/08/23 06:04:26 fetching corpus: 0, signal 0/0 (executing program)
2023/08/23 06:04:27 starting 8 fuzzer processes
06:04:27 executing program 0:
sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc0000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xf4, 0x464, 0x401, 0x70bd25, 0x25dfdbff, "f7904a62c48218cd8529addb4e7432c9e45f3baa42c678f632bd94e19fa41942bfd390b9b1d7e866812497e96ad33756edb15334a844ce382f78ad848093771d6a21cbc4cc3bfc8433481d9507fa694978738c64dccd718e460111aa6a4e30f245d1d87fcc8b012b6ed4831d423fc8eec4cd786efe581a1c6980c229414ba2a85dffb4767db4d06e25a215fd688b25e1ad9f6852bf9574fd54e0db52d4c38b00e8899d268e0998a36dc5ee79e1de8ffb48706c3a4fd2fe48f6a156bc83994c14f26c91f03b418d364d88a11218c11e915386f2ea92615c01152471f3b217ebccb9", ["", "", "", ""]}, 0xf4}, 0x1, 0x0, 0x0, 0x4000040}, 0x4050)
sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x10, 0x3f6, 0x0, 0x70bd2d, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8080}, 0x0)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x60, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x40)
r0 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000440), 0xffffffffffffffff)
sendmsg$NET_DM_CMD_START(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [""]}, 0x14}}, 0x40080)
ioctl$TIOCL_PASTESEL(0xffffffffffffffff, 0x541c, &(0x7f0000000540))
sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x10, 0x3fb, 0x100, 0x70bd27, 0x25dfdbfe, "", ["", "", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4}, 0xc0)
r1 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$KDDELIO(r1, 0x4b35, 0x3)
socketpair(0xb, 0x4, 0x2, &(0x7f0000000680)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000780)={'tunl0\x00', &(0x7f0000000700)={'erspan0\x00', <r3=>0x0, 0x8000, 0x7800, 0x0, 0x9, {{0x17, 0x4, 0x3, 0x3, 0x5c, 0x68, 0x0, 0x8, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x22}, @local, {[@cipso={0x86, 0x21, 0x0, [{0x7, 0xb, "c4623331b240d9c5ef"}, {0x1, 0x4, "a7bc"}, {0x7, 0x7, "86874f59e6"}, {0x2, 0x5, "769fbe"}]}, @lsrr={0x83, 0xf, 0x9e, [@private=0xa010102, @local, @local]}, @timestamp_addr={0x44, 0x14, 0x7c, 0x1, 0x4, [{@remote, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xdde6}]}, @ra={0x94, 0x4}]}}}}})
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x1c, 0x0, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x4004)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_NEW_SEC_DEV(r4, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x20, 0x0, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x20}}, 0x800)
ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000980))
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x50, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x811}, 0x40040)
r5 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000b40), r4)
sendmsg$NET_DM_CMD_START(r4, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x14, r5, 0x800, 0x70bd28, 0x25dfdbfc, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x4800)
ioctl$TIOCL_SELLOADLUT(r1, 0x541c, &(0x7f0000000c40)={0x5, 0xfffffffffffffc00, 0xf0fd, 0xfffffffffffffff9, 0x7f})

06:04:27 executing program 1:
sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3112106c}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000000)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xffffd4e6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x400d1}, 0x4000800)
sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x64, 0x453, 0x400, 0x70bd28, 0x25dfdbfe, "7351e439497302fd21ed1c56bdec258aa8605174220e4f68547cebc45d60380d3098944e093be7a857bb1fe5597c59b35b7732686f3c0e5869f681ece715874329312f3fcd502dfdc8917a6e2636375460ef", ["", ""]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x20001)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x80000001}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0xd0)
sendmsg$AUDIT_SIGNAL_INFO(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x10, 0x3f2, 0x4, 0x70bd29, 0x25dfdbfe, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x48000}, 0x4040840)
bind$802154_raw(0xffffffffffffffff, &(0x7f0000000580)={0x24, @long={0x3, 0x3}}, 0x14)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000005c0), 0x200241, 0x0)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x2c, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x10001}]}, 0x2c}}, 0x10)
setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000740)=0xfff, 0x2)
r2 = syz_io_uring_complete(0x0)
ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000780)=0x1)
sendmsg$BATADV_CMD_SET_VLAN(r2, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000004}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x5c, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x119c}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7fff}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x4040000)
setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000900)=0x3, 0x4)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), 0xffffffffffffffff)
unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000980)='./binderfs2/custom0\x00')
sendmsg$802154_raw(r2, &(0x7f0000000a80)={&(0x7f00000009c0)={0x24, @none={0x0, 0xffff}}, 0x14, &(0x7f0000000a40)={&(0x7f0000000a00)="d0f669228d6a713ffa798d794b4ba56e97bc523bfef40d0b0cbb6fc3bf238adce62e0e4e3956", 0x26}, 0x1, 0x0, 0x0, 0x801}, 0x90)
sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000c40)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b00)={0xe8, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00'}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x38}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}]}, 0xe8}}, 0x1)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000cc0), r0)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d00)={0x50, r3, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfc22}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xc1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffffd}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000090}, 0x40)

06:04:27 executing program 2:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0)
r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x90, 0x0, &(0x7f0000000200)=[@release={0x40046306, 0x3}, @release={0x40046306, 0x1}, @dead_binder_done, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/169, 0xa9, 0x2, 0x3c}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/1, 0x1, 0x1, 0x8}, @flat=@weak_binder={0x77622a85, 0x200b}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}, 0x400}, @free_buffer={0x40086303, r1}, @dead_binder_done, @release={0x40046306, 0x1}, @register_looper, @register_looper], 0x41, 0x0, &(0x7f00000002c0)="9febef3aa8160837ff3069587cbe89286606ba8b29dc6b5333671e64dd93ef28f725d4a70e629a9162fb6343da5231c041e430e0c004cc24c34d96038270c883d2"})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000600)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000005c0)={&(0x7f00000003c0)={0x1d4, 0x2, 0x2, 0x201, 0x0, 0x0, {0x5, 0x0, 0x9}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xffffffff}, @CTA_EXPECT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT={0x1ac, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010102}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @rand_addr=0x64010100}}}]}, @CTA_EXPECT_NAT_TUPLE={0x88, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @multicast1}}}]}, @CTA_EXPECT_NAT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @mcast2}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_TUPLE={0x84, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x37}}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @empty}}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_DIR={0x8}]}]}, 0x1d4}, 0x1, 0x0, 0x0, 0x20000045}, 0x800)
sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x7c, 0x2, 0x2, 0x5, 0x0, 0x0, {0x1, 0x0, 0x1}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1ff}, @CTA_EXPECT_MASTER={0x48, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x33}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x8, 0x2, @local}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @loopback}}}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x2}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x709}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40004084}, 0x0)
sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000c40)={&(0x7f00000007c0)={0x448, 0x3f3, 0x100, 0x70bd2b, 0x25dfdbfd, {0x6, 0x0, 0x37, [0x5, 0x1, 0x0, 0xa549, 0x9, 0xfffffff8, 0x82, 0x0, 0xe791, 0x0, 0x3, 0x3e, 0x100, 0x40, 0x6, 0x7e, 0x2, 0x3f, 0x8, 0x0, 0x0, 0x0, 0x101, 0x800000, 0x10001, 0x1, 0x7ff, 0x9, 0x0, 0x1, 0xc000, 0x9, 0x5, 0x0, 0x9, 0x9, 0x0, 0x7, 0x1000, 0x2, 0x9c3d, 0x3ff, 0x3, 0x1, 0x101, 0x7fff, 0x5, 0x520, 0x3, 0x3, 0xfff, 0xf7b1, 0x3, 0x5, 0x6d3, 0x3c, 0x2, 0x2, 0x10001, 0xfffffffa, 0x3, 0x4, 0x3ff, 0x200], [0x3, 0x1, 0x66b3, 0xf2d, 0x7f, 0x5, 0x10001, 0x2, 0x5, 0x10001, 0x3, 0x0, 0xc38, 0x9067, 0x2, 0x4, 0x40, 0x9, 0x7, 0x7, 0x1, 0x6, 0xffffff7f, 0x2, 0x6, 0x6, 0x200, 0xa241, 0x1, 0x1, 0x8000, 0x1, 0xfffffffe, 0x2, 0x746, 0x0, 0x2, 0x0, 0xfffffe00, 0x401, 0x1ef, 0x2, 0x0, 0x400, 0x7, 0x31, 0x8, 0x2, 0x8, 0x7, 0x1, 0x198, 0x101, 0x0, 0xfffff18f, 0x0, 0x81, 0x733, 0x1, 0x9, 0x6, 0x3, 0x3ff, 0x5], [0x9, 0x4d, 0x8000, 0x1f, 0xfffffe01, 0x8, 0x5af, 0x9, 0x9f43, 0x1000, 0x80000000, 0x8, 0x273, 0xffff0000, 0x1, 0x6, 0x6, 0xffffffff, 0x8, 0xfffffffb, 0xfffffffa, 0x5, 0x3413, 0x4, 0x1, 0x4, 0x8, 0x9, 0x4, 0x7, 0x8, 0x1ff, 0x1, 0x32c6, 0xff, 0x6, 0x0, 0x40000, 0x4, 0x771, 0xaf33, 0x10000, 0x9, 0x6, 0x2, 0x8, 0x9, 0xffffd6f2, 0xff, 0x80, 0x1f, 0x5, 0x8, 0x8, 0x5, 0x6, 0x3, 0x16214a26, 0xf0c, 0x800, 0x8f, 0x6, 0x1000, 0x5be4], [0x0, 0x2, 0x9, 0x2, 0x1, 0x1, 0x3ff, 0xfff, 0xfe76, 0x3, 0x7, 0x2, 0x4, 0x10001, 0x1, 0x47a, 0x5, 0xffff, 0x0, 0x9, 0x5, 0x2, 0x3ff, 0x2, 0x8, 0x7fff, 0x402c, 0x0, 0x1ff, 0x0, 0x39, 0x2, 0x9, 0x9, 0x2, 0x9, 0x1, 0x3, 0x8000, 0x4, 0x2, 0x5, 0xfffffffa, 0x1, 0xcd6f, 0x40, 0x4, 0x8, 0x100, 0x7, 0x80000001, 0x99, 0x980, 0x18, 0x5, 0x8001, 0x6f25b5d5, 0xffffffff, 0x6, 0x2801, 0x7ff, 0x6, 0xfffff801, 0x1], 0x25, ['\xcf\'.\x00', '\\&[]\\\x00', ']-%-\x00', './binderfs/binder1\x00', '\x00', '\xff\xff']}, ["", "", "", "", "", "", "", ""]}, 0x448}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000)
sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000e00)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d00)={0xc0, 0x453, 0x400, 0x70bd2a, 0x25dfdbfc, "375e33979df29d7c8dde6fc7304ed3c848e5d3c757bad5d22385829f47ceee06294a25fe9d68b2430b9f5cdaba360494298fbad241e19b87a227b2ed50af02e75694d025e20f61a4de796c50b95f03f96f96935d60ec0955baf1bc6facffbe785d8ab62a906c7b764a6a797c093cf62303be70e3613915ca01fdd72d2a488cace38d5fcf110da427ce9594f5c98de6410d229e5bd76b572d5c2761ce2ab98b6672e66681284bb5be2ec19f7877", ["", ""]}, 0xc0}, 0x1, 0x0, 0x0, 0x1}, 0x4000)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000e40)='./binderfs2/custom0\x00', 0x0, 0x0)
r4 = gettid()
ioctl$BINDER_FREEZE(r3, 0x400c620e, &(0x7f0000000e80)={r4, 0x0, 0x8001})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000ec0)={'batadv_slave_0\x00', <r5=>0x0})
ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x1000)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040091}, 0x4000880)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000001000)='./binderfs2/binder1\x00', 0x2, 0x0)
r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r6, 0x0, &(0x7f0000001040)="e859ca1090b66a0079481b866b6c0f6f6f8461feb979955637314087f606314c9e8926cceebfc41fa8f4f52bbc577d5f3b4e0fa758e7626c1dbb78a853c5072a76b0e0de4acd0bf0eff2d8bed858d08614fa127941c43179fea3ead35dc6deab4e09de382d39f0aaec120fe41bcf70e881cb16951c8d3e7cb98a8461f4a8f68adb3b024fb2a8580448d563597d4eedb87367d4d061039a158033cc2dc505d83473285147148d07e247c569990b749afee25d01fc9eb3fec3895edc3a4acff43a3d920246adb6891aa05df9b541bd6a81cfe09af9c1babfd9f66d")
r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001180), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000001280)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001240)={&(0x7f00000011c0)={0x64, r7, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x7}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40044}, 0x2000)
sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000001400)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000013c0)={&(0x7f0000001340)={0x68, r7, 0x20, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x43}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x16}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)

[  108.047565] audit: type=1400 audit(1692770667.842:6): avc:  denied  { execmem } for  pid=269 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
06:04:27 executing program 3:
r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x8c100, 0x0)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', <r3=>0x0})
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, r2, 0x1, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8000}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x20004800)
sendmsg$AUDIT_USER(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x24000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, 0x3ed, 0x300, 0x70bd28, 0x25dfdbfe, "578d13866c0ff727dcc7eeee36d599b51a553583", ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040000)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r4, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x175c}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8845}, 0x20008080)
inotify_add_watch(r1, &(0x7f0000000480)='./file0\x00', 0x10000400)
r5 = socket(0x1f, 0x1, 0x94)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r5, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, r2, 0x300, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1ff}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x80}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x8800)
ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0)
ioctl$TIOCMSET(r1, 0x5418, &(0x7f00000005c0)=0x458b)
r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000640), 0xffffffffffffffff)
sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x14, r6, 0x200, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x804)
r7 = socket$nl_audit(0x10, 0x3, 0x9)
sendmsg$AUDIT_USER_AVC(r7, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x80, 0x453, 0x200, 0x70bd26, 0x25dfdbfb, "afdf06040d442b6455ebf2bb1651cbde3613873af6ca09ba02c5526485da7e9d67e3d000fdbeadbb53ae50725edd4161e78423b68ae322f97ec94b9574589ecc68fdd7ebcd2a1b3776602c8ff1a20b8ea3e21c884f2d585cab3218cb20dc45c6ad72b07dc723114b25ac01c971", ["", "", "", "", ""]}, 0x80}, 0x1, 0x0, 0x0, 0x4000090}, 0x20000881)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000880)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0)
sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x30, 0x3ed, 0x10, 0x70bd2a, 0x25dfdbfc, "f740bf82021edb00b82543c3f76a3053a4c654a31228da694d359e302170", ["", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44000}, 0x1)

06:04:27 executing program 4:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0xc050}, 0x4000000)
r1 = syz_io_uring_complete(0x0)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x5c, r2, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x20}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004}, 0x8000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r3, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x800)
r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x4c, r4, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x48084)
r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000540), 0x301040, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000005c0)={'batadv0\x00', <r6=>0x0})
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000006c0)={'gretap0\x00', &(0x7f0000000600)={'ip_vti0\x00', <r7=>0x0, 0x20, 0x20, 0xceb, 0x7, {{0x1a, 0x4, 0x0, 0x1c, 0x68, 0x66, 0x0, 0x4, 0x29, 0x0, @remote, @remote, {[@ssrr={0x89, 0xf, 0x7f, [@empty, @multicast2, @dev={0xac, 0x14, 0x14, 0x28}]}, @lsrr={0x83, 0x17, 0x45, [@remote, @local, @multicast2, @loopback, @multicast2]}, @ra={0x94, 0x4}, @ssrr={0x89, 0x23, 0x78, [@rand_addr=0x64010102, @multicast1, @broadcast, @local, @empty, @multicast2, @dev={0xac, 0x14, 0x14, 0x14}, @dev={0xac, 0x14, 0x14, 0xd}]}, @noop, @generic={0xcc, 0x4, "1ab3"}]}}}}})
sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f00000007c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x44, r0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x7}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r7}]}, 0x44}}, 0x8000)
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000800)={'wpan0\x00'})
r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000880), r5)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r5, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x24, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x9}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x800)
sendmsg$AUDIT_DEL_RULE(r1, &(0x7f0000000e40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x371d4dcda8d319ec}, 0xc, &(0x7f0000000e00)={&(0x7f00000009c0)={0x434, 0x3f4, 0x4, 0x70bd28, 0x25dfdbfe, {0x7, 0x0, 0x26, [0x1, 0xfffffffa, 0x2, 0xc0000000, 0x6, 0x0, 0x4, 0x579a, 0xe6, 0x9, 0x8001, 0x9, 0xfbf1, 0x800, 0x1, 0x7, 0x401, 0x1, 0x81, 0xffffffff, 0x0, 0x2, 0x7, 0x3, 0x2, 0x7f, 0xb50d, 0x4, 0xffff, 0xfff, 0x800, 0x1, 0x7f, 0xdc1, 0x9, 0x7, 0x1, 0xba6, 0xfffffffd, 0xfffffffa, 0x9, 0x3, 0x7fff, 0x7, 0x3, 0x7, 0x0, 0x7fd2847c, 0x81, 0x8, 0xfffffffd, 0x8, 0xfff, 0x3f, 0x5, 0x800, 0x8, 0x100, 0x5, 0x1ff, 0x7ff, 0x6, 0x1, 0x7], [0x2, 0x4, 0x1, 0x1, 0xe62, 0x8001, 0x9, 0x9, 0xcd1, 0x80, 0x7ff, 0x1f, 0x47, 0xad, 0xff, 0x9, 0x4, 0x10001, 0xffffffff, 0xfffffffa, 0x3, 0x7fff, 0x7f, 0x7, 0x3, 0xfffffffe, 0x8, 0x5837d9cc, 0x8, 0x8, 0xbed9, 0x0, 0x20, 0x3ff, 0x2, 0x80000000, 0x316245be, 0xfffffffb, 0x2, 0x2, 0x8, 0x4, 0x4ce, 0x4, 0x4, 0x7fffffff, 0x5b880, 0x40, 0x2bb, 0x1f, 0xffffff97, 0x7, 0x1, 0x7, 0x3147, 0x4, 0x80000001, 0x0, 0x4, 0x39, 0x9, 0x9, 0x6, 0x7], [0xae6, 0x81, 0x5, 0x7, 0x39eb658f, 0x4, 0x6, 0x2, 0xffffffff, 0x800, 0x3, 0x7, 0x80000001, 0x9, 0x1, 0x800, 0x76b, 0x0, 0xf7d, 0x80, 0x1, 0xe3, 0xffff, 0x7, 0x9, 0x9, 0x20, 0x5, 0x8eb, 0x1200000, 0x4, 0x7, 0x2b18, 0x2, 0x684c, 0xfffffffb, 0x0, 0x2, 0x3c3, 0x318, 0x0, 0xdad, 0x4, 0x3a8, 0xa3, 0x7e, 0x54bdeb73, 0x7, 0x1, 0x1, 0x2, 0x8, 0xffffb320, 0x4, 0x4, 0x10001, 0x401, 0x9b9, 0x2, 0x4, 0x0, 0x0, 0xe1, 0xfff], [0x2575, 0x9, 0x1, 0x10001, 0x9, 0x1, 0x3ff, 0x7fff, 0x2c, 0x4, 0x0, 0x0, 0x1, 0x7ff, 0xffff, 0x7ff, 0x1369, 0x8, 0x0, 0x3, 0x1200, 0x401, 0x80000000, 0x24592991, 0x5a, 0x6, 0x194, 0x0, 0x80000001, 0x1, 0x2, 0x0, 0x4, 0x1, 0x800000, 0x7, 0x8000, 0x9, 0x5, 0x25, 0x0, 0x400, 0x7, 0xffffffff, 0x1, 0x764, 0x10a2, 0x6, 0xffff0000, 0xfffff001, 0x8, 0x3, 0x6, 0x4, 0x0, 0xa1b, 0x2, 0x1, 0x5, 0x2, 0x101, 0xffffffff, 0x1, 0x7], 0x12, ['ip_vti0\x00', '\xbc\x00', 'batadv\x00', '\x00']}, ["", "", "", ""]}, 0x434}, 0x1, 0x0, 0x0, 0x20000000}, 0x2000c080)
sendmsg$BATADV_CMD_GET_GATEWAYS(r5, &(0x7f0000000f40)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x14, r8, 0x7d6f7d840a5d8d6, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x480d0)
r9 = syz_io_uring_complete(0x0)
sendmsg$AUDIT_GET(r9, &(0x7f0000001040)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x10, 0x3e8, 0x100, 0x70bd2d, 0x9, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20004400}, 0x48044)

06:04:27 executing program 5:
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
r0 = gettid()
ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000040)={r0, 0x0, 0xd6})
syz_open_dev$ptys(0xc, 0x3, 0x1)
ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, &(0x7f0000000480)={0x2, 0x1, 0x4, 0x3, 0x147, &(0x7f0000000080)="8258ded26b5af8bd41bf2ce23675ffd51829346906c3f4bb0b4b883b091febab5017d9032d1746572609f6ce993d12424995db02edeb9bd73ced86b2128e1eddcd6a7cbcfe22b4f80cb3c745de0c66dba5c2e17bec34d039c13262d1a0e9e45eef1778ad4d2d81ef72daf8de3e9820336078af9fb6d13fbe9bf1437c48bb32769e3991ee2748f5d2b7b1ae099b9bb2ab9ef63787ad3a829c880327a7606f60b478a7f1413eafac07749985a47145312d846008f55ff8b2104675f8e7a30e162e80c168d20aed0c9c0f283b188a35d420a998002a10b9dfbbc174d86e79c22993e3236f1eb990cf8b1ec8392cfa0bc1c18c8ee8d16941df52a704248415e9fcbb3d44864a4826e697aae7ff09ed817579a5bc3c8f2cfbcb6a5cf18f69448a398e7cf85e941b9266db1057bbb4c2cabe2308eda04bf4488d7c2b8889b87493eae690f9ab7edb560bb2833766e2de9cf2b683ceed077ef80bff906abe38c51c6d0faf42e4b2843cf551bed32f216d2ae6f4a8cfc231439b83b5d824e1c9c1ee367c8261f6f38fdeb6f97af709f34c9fc60a190d3d03ae865edb137f56317a20540fee03c2e3fb80e9b075b8a43e9c70f867bdc071d6cca4e310e6115816f5f94e0a1089d63656d2428b23def12bee8b6eb5983bf98a7b72173d3b6a143494333d1b047463f6dab3003664204252917d144114fa8ab3a095285464e712462767244a6652c357e9d4a413aa19dca2b24862dee438d9b388f884d6773100ccc2ef376fa19d4d861f9d4e699a5860df9f5fd6d958cf547864eeb2ac7e5c6955c094b9215ca1f587fc4c7686ccb269d66580582e4fce5d7631f160100f6e323ad05702750f62a1586276b64cbebd4df4aec4f28538e4aceb7578f8009d460f384158d6360c82d3f0498af3aabecff27a06d4317f115e63e3de2bb5f2e601aa1c826b7c947595c93c26627f6a8fdbc5353de1fcf9d1d07faf17ccb9abe3d789442780cfe87f356ebf044e9456ebdfef97af152dae83bf288d089591dd7d675b39e721010cef292920d37045cfeee974b0d046dfdc113bfc11315c4f883a8cc8a3c2f2328de9053bc8624d9c9deee98c848c5894a8ab6f4723509be4eb89a3017fb0c876e29f4c0be4a0959593ffb34a8a019610e007a2c85d40fe580fde72c7d9a1c9f2bafdc8ee0e083479d075b8896360815545af45735ec8dc9f1d8af0377ebf613c9572d618a59d17890af70f781fbb45d1a7314bf2cd532de1133e4e27917fe7526e7e9778c77ddc53085858fbd103ff7cdf23accdc839d6061e324787670ef1bbc279bcdc3e3aeade392a4de489b87422ff63629d4735316210d44d148a51aaf0ab3cb68203ec0d1d777f13f9f66f0e7578b84166b15b87036c7acca8b186e591b00f79b3b86bbf8f0cd5865ba7d9ad2c1a192c2cd8a7314b594f451beed12556cd"})
syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000680)={'ip_vti0\x00', &(0x7f0000000500)={'ip_vti0\x00', <r1=>0x0, 0x10, 0x8000, 0x0, 0x2, {{0x4e, 0x4, 0x1, 0x2e, 0x138, 0x66, 0x0, 0xa4, 0x2f, 0x0, @multicast2, @broadcast, {[@noop, @timestamp_addr={0x44, 0x54, 0xd3, 0x1, 0x2, [{@dev={0xac, 0x14, 0x14, 0x1c}, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x15}, {@broadcast, 0x8}, {@empty, 0x5d}, {@empty, 0x3}, {@local, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, {@remote, 0x1}, {@multicast1, 0x3}, {@dev={0xac, 0x14, 0x14, 0x11}, 0x8}]}, @generic={0x82, 0x12, "35147a59cfcd1f289d5e8436c44ac6f0"}, @timestamp_prespec={0x44, 0x2c, 0x15, 0x3, 0x4, [{@rand_addr=0x64010101, 0x2000000}, {@empty, 0x7fff}, {@multicast2, 0x4}, {@multicast1, 0x7}, {@private=0xa010102, 0x1}]}, @cipso={0x86, 0x22, 0x3, [{0x5, 0xb, "4b8844f40cef50dddb"}, {0x0, 0x8, "095e2d762cdf"}, {0x5, 0x7, "38e643b23e"}, {0x5, 0x2}]}, @lsrr={0x83, 0xb, 0x5e, [@loopback, @multicast1]}, @generic={0x83, 0x2}, @timestamp_prespec={0x44, 0x24, 0x9a, 0x3, 0x1, [{@loopback, 0x5}, {@remote}, {@multicast1, 0x4}, {@multicast2, 0x2}]}, @generic={0x44, 0xa, "25b9a4f3fc207b43"}, @timestamp_addr={0x44, 0x34, 0x4b, 0x1, 0xb, [{@empty, 0xe96}, {@dev={0xac, 0x14, 0x14, 0xa}, 0xb2cd}, {@private=0xa010102, 0xff}, {@rand_addr=0x64010101, 0xfffff05b}, {@dev={0xac, 0x14, 0x14, 0x38}, 0x3f}, {@broadcast, 0x4}]}]}}}}})
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x74, 0x0, 0x800, 0x70bd28, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x9, 0x0}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xb6}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x20}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x74}}, 0x41)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000007c0)='./binderfs/custom0\x00', 0x2, 0x0)
ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r2, 0x40046210, &(0x7f0000000800)=0x1)
r3 = syz_io_uring_complete(0x0)
ioctl$TUNSETLINK(r3, 0x400454cd, 0x323)
ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r2, 0x40046210, &(0x7f0000000840))
r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880), 0xb2480, 0x0)
r5 = gettid()
ioctl$BINDER_FREEZE(r4, 0x400c620e, &(0x7f00000008c0)={r5, 0x1, 0x8})
ioctl$TCGETS(r4, 0x5401, &(0x7f0000000900))
accept$inet6(r4, &(0x7f0000000940)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000980)=0x1c)
sendmsg$BATADV_CMD_SET_HARDIF(r4, &(0x7f0000000a80)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x1c, 0x0, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000083}, 0x40000)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000c40)={0x58, 0x0, &(0x7f0000000b80)=[@enter_looper, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000ac0)={@fda={0x66646185, 0x0, 0x0, 0x23}, @fda={0x66646185, 0x4, 0x2, 0x4}, @fda={0x66646185, 0x7, 0x0, 0x3f}}, &(0x7f0000000b40)={0x0, 0x20, 0x40}}}, @request_death], 0x3c, 0x0, &(0x7f0000000c00)="339ba4200470b1a31195804ea6016e686eb52baa0a6c3bb776627700643b089fd46b4a88272bc11d62e9f6954e5b2d3f4dcfb1810e2bc399fa5d391d"})

06:04:27 executing program 6:
openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1f}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x20004090)
ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f00000001c0)={0x7, 0x9, 0xfffffffb, 0x4, 0x2, "309f6c412b30dacf85c2c614a0265d2b70d1fb"})
r1 = syz_open_pts(0xffffffffffffffff, 0x10000)
ioctl$TCXONC(r1, 0x540a, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r0, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x40}]}, 0x1c}}, 0x8800)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x54, r0, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0)
ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0)
sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10009000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x74, 0x3ed, 0x1, 0x70bd28, 0x25dfdbfb, "864a323e5da550e9d5d471b280a7c113f23a5336d1122193230f6fb2ecb41d5fe3df051490dabab85e7e64aa4877f86b597fed919f8ca853b773cade74a4a0d317954250e36c330fab8eb04d6ceffa63c4e90a0fae0b2a065d152ccc34563a2cf704", ["", "", "", "", "", "", "", "", ""]}, 0x74}, 0x1, 0x0, 0x0, 0x48010}, 0x20000010)
r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000580), 0x141000, 0x0)
ioctl$KDGETLED(r3, 0x4b31, &(0x7f00000005c0))
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000640), r2)
sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000600), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x3c, r4, 0x1, 0x70bd25, 0x200, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x7ff}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x36}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xa9c9}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040000)
r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000740)='./cgroup.net/syz1\x00', 0x200002, 0x0)
openat$cgroup_type(r5, &(0x7f0000000780), 0x2, 0x0)
ioctl$TIOCMIWAIT(r3, 0x545c, 0x0)
socketpair(0x1a, 0x5, 0x0, &(0x7f00000007c0)={<r6=>0xffffffffffffffff})
sendmsg$BATADV_CMD_SET_VLAN(r6, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x1c, r0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)

06:04:28 executing program 7:
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'ip_vti0\x00', &(0x7f0000000000)={'tunl0\x00', 0x0, 0x1, 0x7, 0x2, 0xfffffff7, {{0x7, 0x4, 0x3, 0x9, 0x1c, 0x64, 0x0, 0x83, 0x4, 0x0, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x3f}, {[@ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4, 0x1}]}}}}})
r0 = syz_open_dev$ptys(0xc, 0x3, 0x1)
ioctl$TCSBRK(r0, 0x5409, 0xfffffffffffffff8)
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000080))
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00'})
r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x5)
ioctl$TCXONC(r1, 0x540a, 0x0)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x400101, 0x0)
ioctl$TIOCL_PASTESEL(r2, 0x541c, &(0x7f0000000140))
ioctl$TIOCL_PASTESEL(r2, 0x541c, &(0x7f0000000180))
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x3, 0x0)
ioctl$PIO_FONTRESET(r3, 0x4b6d, 0x0)
ioctl$TIOCL_GETSHIFTSTATE(r3, 0x541c, &(0x7f0000000200)={0x6, 0x1})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv0\x00', <r4=>0x0})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000280)={@dev={0xfe, 0x80, '\x00', 0x31}, 0x69, r4})
ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f00000002c0))
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6e1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x8090}, 0x8010)
ioctl$TIOCGISO7816(r1, 0x80285442, &(0x7f0000000440))
sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580), 0x400000, 0x0)

[  109.275307] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  109.278099] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  109.282438] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  109.289534] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  109.293439] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  109.295434] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  109.481029] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  109.490507] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  109.506660] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  109.525410] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  109.528514] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  109.530869] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  109.546409] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  109.548432] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  109.557913] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  109.560920] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  109.576649] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  109.614705] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  109.643059] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  109.646618] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  109.648536] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  109.654488] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  109.672694] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[  109.680548] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  111.360522] Bluetooth: hci0: command 0x0409 tx timeout
[  111.361463] Bluetooth: hci1: Opcode 0x c03 failed: -110
[  111.488861] Bluetooth: hci3: Opcode 0x c03 failed: -110
[  111.552538] Bluetooth: hci5: Opcode 0x c03 failed: -110
[  111.617334] Bluetooth: hci6: Opcode 0x c03 failed: -110
[  111.618140] Bluetooth: hci4: command 0x0409 tx timeout
[  111.681101] Bluetooth: hci2: command 0x0409 tx timeout
[  111.745062] Bluetooth: hci7: command 0x0409 tx timeout
[  113.408657] Bluetooth: hci0: command 0x041b tx timeout
[  113.664690] Bluetooth: hci4: command 0x041b tx timeout
[  113.728096] Bluetooth: hci2: command 0x041b tx timeout
[  113.792125] Bluetooth: hci7: command 0x041b tx timeout
[  114.320303] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  114.327089] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  114.328360] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  114.340073] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  114.341656] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  114.342879] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  114.979874] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  114.983984] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  114.986397] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  115.000745] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  115.022552] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[  115.041315] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  115.457046] Bluetooth: hci0: command 0x040f tx timeout
[  115.712048] Bluetooth: hci4: command 0x040f tx timeout
[  115.777054] Bluetooth: hci2: command 0x040f tx timeout
[  115.840034] Bluetooth: hci7: command 0x040f tx timeout
[  116.416109] Bluetooth: hci1: command 0x0409 tx timeout
[  116.800424] Bluetooth: hci3: Opcode 0x c03 failed: -110
[  116.928332] Bluetooth: hci5: Opcode 0x c03 failed: -110
[  117.120778] Bluetooth: hci6: command 0x0409 tx timeout
[  117.504071] Bluetooth: hci0: command 0x0419 tx timeout
[  117.760230] Bluetooth: hci4: command 0x0419 tx timeout
[  117.824697] Bluetooth: hci2: command 0x0419 tx timeout
[  117.888877] Bluetooth: hci7: command 0x0419 tx timeout
[  118.464425] Bluetooth: hci1: command 0x041b tx timeout
[  119.171028] Bluetooth: hci6: command 0x041b tx timeout
[  119.578224] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  119.580456] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  119.581743] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  119.605304] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  119.622566] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  119.648446] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  119.900443] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  119.903542] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  119.912248] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  119.934403] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  119.966330] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  119.969498] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  120.512358] Bluetooth: hci1: command 0x040f tx timeout
[  121.217539] Bluetooth: hci6: command 0x040f tx timeout
[  121.728280] Bluetooth: hci3: command 0x0409 tx timeout
[  122.049327] Bluetooth: hci5: command 0x0409 tx timeout
[  122.563018] Bluetooth: hci1: command 0x0419 tx timeout
[  123.265265] Bluetooth: hci6: command 0x0419 tx timeout
[  123.777329] Bluetooth: hci3: command 0x041b tx timeout
[  124.097306] Bluetooth: hci5: command 0x041b tx timeout
[  125.826894] Bluetooth: hci3: command 0x040f tx timeout
[  126.145449] Bluetooth: hci5: command 0x040f tx timeout
[  127.872607] Bluetooth: hci3: command 0x0419 tx timeout
[  128.193056] Bluetooth: hci5: command 0x0419 tx timeout
[  171.696939] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  171.703831] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  171.704822] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  171.719518] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  171.724225] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  171.725899] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  172.111220] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  172.128665] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  172.136944] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  172.165709] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  172.187572] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[  172.192499] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  173.696062] Bluetooth: hci0: Opcode 0x c03 failed: -110
[  173.824301] Bluetooth: hci2: command 0x0409 tx timeout
[  174.016055] Bluetooth: hci4: Opcode 0x c03 failed: -110
[  174.208766] Bluetooth: hci7: command 0x0409 tx timeout
[  175.638579] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  175.642571] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  175.646497] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  175.653280] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  175.658742] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  175.660283] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  175.873047] Bluetooth: hci2: command 0x041b tx timeout
[  176.043529] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  176.044970] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  176.049360] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  176.071200] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  176.080199] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  176.092381] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  176.256277] Bluetooth: hci7: command 0x041b tx timeout
[  177.729433] Bluetooth: hci0: command 0x0409 tx timeout
[  177.920075] Bluetooth: hci2: command 0x040f tx timeout
[  178.176100] Bluetooth: hci1: command 0x0409 tx timeout
[  178.240430] Bluetooth: hci4: Opcode 0x c03 failed: -110
[  178.304078] Bluetooth: hci7: command 0x040f tx timeout
[  178.624082] Bluetooth: hci6: Opcode 0x c03 failed: -110
[  179.777045] Bluetooth: hci0: command 0x041b tx timeout
[  179.968486] Bluetooth: hci2: command 0x0419 tx timeout
[  180.227514] Bluetooth: hci1: command 0x041b tx timeout
[  180.353805] Bluetooth: hci7: command 0x0419 tx timeout
[  181.686846] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  181.688985] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  181.693398] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  181.704605] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  181.711618] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  181.715330] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  181.824111] Bluetooth: hci0: command 0x040f tx timeout
[  181.927705] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  181.957432] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  181.960959] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  181.970514] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  181.974960] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  181.979918] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  181.990428] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  182.014628] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[  182.027450] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  182.038974] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  182.043492] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  182.044757] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  182.274089] Bluetooth: hci1: command 0x040f tx timeout
[  182.976429] Bluetooth: hci3: Opcode 0x c03 failed: -110
[  183.744371] Bluetooth: hci4: command 0x0409 tx timeout
[  183.872135] Bluetooth: hci0: command 0x0419 tx timeout
[  184.130181] Bluetooth: hci5: command 0x0409 tx timeout
[  184.321371] Bluetooth: hci1: command 0x0419 tx timeout
[  184.321839] Bluetooth: hci6: command 0x0409 tx timeout
[  185.792159] Bluetooth: hci4: command 0x041b tx timeout
[  185.952514] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  185.955985] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  185.960680] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  185.972110] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  185.977420] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  185.979206] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  186.176034] Bluetooth: hci5: command 0x041b tx timeout
[  186.368106] Bluetooth: hci6: command 0x041b tx timeout
[  187.840232] Bluetooth: hci4: command 0x040f tx timeout
[  188.032086] Bluetooth: hci3: command 0x0409 tx timeout
[  188.225038] Bluetooth: hci5: command 0x040f tx timeout
[  188.416200] Bluetooth: hci6: command 0x040f tx timeout
[  189.890016] Bluetooth: hci4: command 0x0419 tx timeout
[  190.080059] Bluetooth: hci3: command 0x041b tx timeout
[  190.273389] Bluetooth: hci5: command 0x0419 tx timeout
[  190.465307] Bluetooth: hci6: command 0x0419 tx timeout
[  192.131038] Bluetooth: hci3: command 0x040f tx timeout
[  194.176759] Bluetooth: hci3: command 0x0419 tx timeout
[  235.267255] Bluetooth: hci2: Opcode 0x c03 failed: -110
[  235.904073] Bluetooth: hci7: Opcode 0x c03 failed: -110
[  237.595457] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  237.603464] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  237.633295] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  237.655378] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  237.681333] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  237.687973] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  237.795940] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  237.809319] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  237.834121] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  237.868492] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  237.879404] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  237.887428] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  238.021549] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  238.023366] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  238.029741] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  238.037453] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  238.058588] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  238.067707] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  239.745077] Bluetooth: hci0: command 0x0409 tx timeout
[  239.808852] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  239.813444] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  239.820443] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  239.833141] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  239.846536] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[  239.848429] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  240.000130] Bluetooth: hci1: command 0x0409 tx timeout
[  240.128297] Bluetooth: hci2: command 0x0409 tx timeout
[  241.792066] Bluetooth: hci0: command 0x041b tx timeout
[  241.920084] Bluetooth: hci7: command 0x0409 tx timeout
[  242.048510] Bluetooth: hci1: command 0x041b tx timeout
[  242.178118] Bluetooth: hci2: command 0x041b tx timeout
[  243.840360] Bluetooth: hci0: command 0x040f tx timeout
[  243.968302] Bluetooth: hci7: command 0x041b tx timeout
[  244.096037] Bluetooth: hci1: command 0x040f tx timeout
[  244.225560] Bluetooth: hci2: command 0x040f tx timeout
[  245.824050] Bluetooth: hci4: Opcode 0x c03 failed: -110
[  245.888070] Bluetooth: hci0: command 0x0419 tx timeout
[  245.890198] Bluetooth: hci5: Opcode 0x c03 failed: -110
[  245.953038] Bluetooth: hci6: Opcode 0x c03 failed: -110
[  246.016165] Bluetooth: hci7: command 0x040f tx timeout
[  246.144183] Bluetooth: hci1: command 0x0419 tx timeout
[  246.272110] Bluetooth: hci2: command 0x0419 tx timeout
[  248.066046] Bluetooth: hci7: command 0x0419 tx timeout
[  249.495558] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  249.500513] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  249.511477] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  249.532897] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  249.549764] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[  249.555341] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  249.985088] Bluetooth: hci3: Opcode 0x c03 failed: -110
[  250.944449] Bluetooth: hci4: Opcode 0x c03 failed: -110
[  251.392252] Bluetooth: hci5: Opcode 0x c03 failed: -110
[  251.648111] Bluetooth: hci6: command 0x0409 tx timeout
[  252.863459] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  252.874943] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  252.883268] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  252.914444] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  252.933889] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  252.941120] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  253.696187] Bluetooth: hci6: command 0x041b tx timeout
[  254.099891] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  254.108621] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  254.111619] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  254.175210] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  254.200923] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  254.208821] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  254.378687] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  254.393540] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  254.395481] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  254.404180] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  254.431269] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  254.511892] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  255.040148] Bluetooth: hci3: command 0x0409 tx timeout
[  255.744319] Bluetooth: hci6: command 0x040f tx timeout
[  256.322084] Bluetooth: hci4: command 0x0409 tx timeout
[  256.576257] Bluetooth: hci5: command 0x0409 tx timeout
[  257.088442] Bluetooth: hci3: command 0x041b tx timeout
[  257.792101] Bluetooth: hci6: command 0x0419 tx timeout
[  258.368036] Bluetooth: hci4: command 0x041b tx timeout
[  258.624079] Bluetooth: hci5: command 0x041b tx timeout
[  259.136233] Bluetooth: hci3: command 0x040f tx timeout
[  260.416674] Bluetooth: hci4: command 0x040f tx timeout
[  260.674248] Bluetooth: hci5: command 0x040f tx timeout
[  261.184153] Bluetooth: hci3: command 0x0419 tx timeout
[  262.464241] Bluetooth: hci4: command 0x0419 tx timeout
[  262.720554] Bluetooth: hci5: command 0x0419 tx timeout
[  299.169085] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  299.175501] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  299.183312] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  299.199504] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  299.229472] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  299.231953] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  299.435671] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  299.443852] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  299.449258] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  299.457310] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  299.471635] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  299.482655] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  301.312091] Bluetooth: hci0: command 0x0409 tx timeout
[  301.568164] Bluetooth: hci1: command 0x0409 tx timeout
[  301.761206] Bluetooth: hci2: Opcode 0x c03 failed: -110
[  302.336165] Bluetooth: hci7: Opcode 0x c03 failed: -110
[  303.362083] Bluetooth: hci0: command 0x041b tx timeout
[  303.616069] Bluetooth: hci1: command 0x041b tx timeout
[  305.120319] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  305.123894] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  305.137405] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  305.183292] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  305.195162] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[  305.202534] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  305.408683] Bluetooth: hci0: command 0x040f tx timeout
[  305.664272] Bluetooth: hci1: command 0x040f tx timeout
[  306.496570] Bluetooth: hci2: Opcode 0x c03 failed: -110
[  307.265094] Bluetooth: hci7: command 0x0409 tx timeout
[  307.456037] Bluetooth: hci0: command 0x0419 tx timeout
[  307.712101] Bluetooth: hci1: command 0x0419 tx timeout
[  309.312057] Bluetooth: hci7: command 0x041b tx timeout
[  309.562524] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  309.569229] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  309.577316] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  309.587210] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  309.608373] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  309.614383] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  311.360198] Bluetooth: hci7: command 0x040f tx timeout
[  311.680078] Bluetooth: hci2: command 0x0409 tx timeout
[  313.088322] Bluetooth: hci6: Opcode 0x c03 failed: -110
[  313.408074] Bluetooth: hci7: command 0x0419 tx timeout
[  313.734366] Bluetooth: hci2: command 0x041b tx timeout
[  315.221544] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  315.224912] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  315.226689] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  315.234166] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  315.238570] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  315.249411] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  315.776619] Bluetooth: hci2: command 0x040f tx timeout
[  316.061553] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  316.069609] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  316.073256] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  316.078810] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  316.086297] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  316.104881] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  316.544055] Bluetooth: hci3: Opcode 0x c03 failed: -110
[  317.312113] Bluetooth: hci4: command 0x0409 tx timeout
[  317.824556] Bluetooth: hci2: command 0x0419 tx timeout
[  318.145074] Bluetooth: hci6: Opcode 0x c03 failed: -110
[  318.208098] Bluetooth: hci5: command 0x0409 tx timeout
[  319.361177] Bluetooth: hci4: command 0x041b tx timeout
[  319.395630] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  319.409355] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  319.425715] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  319.428802] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  319.430938] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  319.432743] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  320.256078] Bluetooth: hci5: command 0x041b tx timeout
[  321.051977] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  321.078884] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  321.094103] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  321.131282] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  321.142321] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[  321.143613] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  321.408337] Bluetooth: hci4: command 0x040f tx timeout
[  321.473662] Bluetooth: hci3: command 0x0409 tx timeout
[  322.304498] Bluetooth: hci5: command 0x040f tx timeout
[  323.266476] Bluetooth: hci6: command 0x0409 tx timeout
[  323.456533] Bluetooth: hci4: command 0x0419 tx timeout
[  323.522106] Bluetooth: hci3: command 0x041b tx timeout
[  324.353036] Bluetooth: hci5: command 0x0419 tx timeout
[  325.312190] Bluetooth: hci6: command 0x041b tx timeout
[  325.568266] Bluetooth: hci3: command 0x040f tx timeout
[  327.361045] Bluetooth: hci6: command 0x040f tx timeout
[  327.616230] Bluetooth: hci3: command 0x0419 tx timeout
[  329.409764] Bluetooth: hci6: command 0x0419 tx timeout
[  361.947249] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  361.952874] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  361.957526] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  361.965520] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  361.979276] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  361.995890] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  363.072086] Bluetooth: hci0: Opcode 0x c03 failed: -110
[  364.096074] Bluetooth: hci1: command 0x0409 tx timeout
[  366.144222] Bluetooth: hci1: command 0x041b tx timeout
[  368.001222] Bluetooth: hci0: Opcode 0x c03 failed: -110
[  368.193049] Bluetooth: hci1: command 0x040f tx timeout
[  368.770080] Bluetooth: hci7: Opcode 0x c03 failed: -110
[  370.241859] Bluetooth: hci1: command 0x0419 tx timeout
[  371.097442] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  371.100308] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  371.106432] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  371.121126] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  371.123787] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  371.128814] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  371.262519] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  371.265400] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  371.266372] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  371.270219] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  371.271844] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  371.272729] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  371.440892] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  371.455568] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  371.465925] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  371.486296] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  371.490401] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[  371.494816] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  373.185082] Bluetooth: hci0: command 0x0409 tx timeout
[  373.377122] Bluetooth: hci2: command 0x0409 tx timeout
[  373.568099] Bluetooth: hci7: command 0x0409 tx timeout
[  375.235012] Bluetooth: hci0: command 0x041b tx timeout
[  375.425048] Bluetooth: hci2: command 0x041b tx timeout
[  375.617070] Bluetooth: hci7: command 0x041b tx timeout
[  377.026347] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  377.031641] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  377.047143] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  377.103321] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  377.137774] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[  377.143352] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  377.281041] Bluetooth: hci0: command 0x040f tx timeout
[  377.472063] Bluetooth: hci2: command 0x040f tx timeout
[  377.665060] Bluetooth: hci7: command 0x040f tx timeout
[  379.264271] Bluetooth: hci4: command 0x0409 tx timeout
[  379.329246] Bluetooth: hci0: command 0x0419 tx timeout
[  379.521029] Bluetooth: hci2: command 0x0419 tx timeout
[  379.713468] Bluetooth: hci7: command 0x0419 tx timeout
[  379.968237] Bluetooth: hci5: Opcode 0x c03 failed: -110
[  380.979647] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  380.984120] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  380.990793] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  381.017059] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  381.031918] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  381.033542] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  381.313050] Bluetooth: hci4: command 0x041b tx timeout
[  383.104088] Bluetooth: hci3: command 0x0409 tx timeout
[  383.218878] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  383.230127] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  383.242275] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  383.275716] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  383.287363] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  383.288442] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  383.362032] Bluetooth: hci4: command 0x040f tx timeout
[  383.651573] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  383.661279] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  383.686442] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  383.704862] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  383.724288] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[  383.728257] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  385.154527] Bluetooth: hci3: command 0x041b tx timeout
[  385.344277] Bluetooth: hci5: command 0x0409 tx timeout
[  385.409065] Bluetooth: hci4: command 0x0419 tx timeout
[  385.793108] Bluetooth: hci6: command 0x0409 tx timeout
[  387.200976] Bluetooth: hci3: command 0x040f tx timeout
[  387.392335] Bluetooth: hci5: command 0x041b tx timeout
[  387.841265] Bluetooth: hci6: command 0x041b tx timeout
[  389.249250] Bluetooth: hci3: command 0x0419 tx timeout
[  389.441070] Bluetooth: hci5: command 0x040f tx timeout
[  389.889044] Bluetooth: hci6: command 0x040f tx timeout
[  391.489034] Bluetooth: hci5: command 0x0419 tx timeout
[  391.936239] Bluetooth: hci6: command 0x0419 tx timeout

VM DIAGNOSIS:
06:09:31  Registers:
info registers vcpu 0
RAX=dffffc0000000000 RBX=ffffffff8775cb60 RCX=ffffffff812e4d5c RDX=1ffffffff0eeb974
RSI=0000000000000008 RDI=ffffffff8775cba0 RBP=ffff88802bd4b680 RSP=ffff88806ce09bb0
R8 =0000000000000000 R9 =fffffbfff0eea56b R10=ffffffff87752b5f R11=0000000000000001
R12=ffff88802bd4c0c0 R13=0000000000000000 R14=ffffffff87754890 R15=0000000000000000
RIP=ffffffff812e4d96 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f1335be38e0 CR3=0000000031f4c000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=756e696c2d34365f3638782f62696c2f XMM01=00362e6f732e6362696c2f756e672d78
XMM02=ffff0000000000ffffffffffffffffff XMM03=ffffffffffffffffffffffffffffffff
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000080000001 RBX=ffff888023c47918 RCX=0000000000000000 RDX=1ffff11004788f24
RSI=ffffffff8113b444 RDI=ffff888023c47920 RBP=ffff888023c47ed0 RSP=ffff888023c47850
R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001
R12=0000000000000008 R13=ffff888023c40000 R14=ffff888023c47ef8 R15=0000000000000001
RIP=ffffffff814d908b RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f40411cc8e0 CR3=0000000024fde000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=756e696c2d34365f3638782f62696c2f XMM01=00362e6f732e6362696c2f756e672d78
XMM02=ffff0000000000ffffffffffffffffff XMM03=ffffffffffffffffffffffffffffffff
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000