r0 = syz_open_dev$sg(&(0x7f0000000140), 0x0, 0x0)
ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000c40))