r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x21)
write$binfmt_aout(r2, &(0x7f0000000300)={{}, "", ['\x00']}, 0x120)