r0 = perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4307, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
prlimit64(0xffffffffffffffff, 0x2, &(0x7f0000000080)={0x0, 0x8}, &(0x7f00000002c0))
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0)
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000240)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
waitid(0x0, 0x0, &(0x7f00000004c0), 0x1, &(0x7f0000000180))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$unix(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0)
r4 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x8, 0x4000010, 0xffffffffffffffff, 0x8000000)
r5 = dup(r3)
recvmmsg(r5, &(0x7f0000007940)=[{{0x0, 0x0, 0x0}}], 0x500, 0x20000022, 0x0)
r6 = syz_open_dev$ttys(0xc, 0x2, 0x1)
creat(&(0x7f0000000280)='./file0\x00', 0x4)
syz_io_uring_setup(0x4644, &(0x7f00000010c0)={0x0, 0xc528, 0x1, 0x0, 0x3a2, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000001140), &(0x7f0000001180)=<r7=>0x0)
r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0)
syz_io_uring_submit(r4, r7, &(0x7f00000011c0)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r8}}, 0x1ff)
ioctl$FS_IOC_GETFSMAP(r6, 0xc0c0583b, &(0x7f00000003c0)={0x0, 0x0, 0x1, 0x0, '\x00', [{0x2ed, 0x9, 0x7, 0x8000, 0xffffffff, 0x400}, {0x8000, 0x4, 0x3, 0x2, 0x0, 0x5}], ['\x00']})
r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x2801, 0x0)
ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r9, 0x3312, 0xc48)
openat$full(0xffffffffffffff9c, &(0x7f0000001080), 0x0, 0x0)