r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000000))
write$binfmt_script(r2, 0x0, 0x24)