r0 = openat(0xffffffffffffff9c, 0x0, 0x6381, 0x6)
recvfrom(0xffffffffffffffff, &(0x7f0000000140)=""/74, 0x4a, 0x2000, &(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x50000, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8001, 0x2}, 0x80)
perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x8, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
shmat(r1, &(0x7f0000ff0000/0xd000)=nil, 0x0)
msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xe)
lsetxattr$trusted_overlay_upper(&(0x7f0000000340)='./file0/file0\x00', &(0x7f00000000c0), &(0x7f0000000100)=ANY=[], 0x10b, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x880)
syz_open_dev$tty1(0xc, 0x4, 0x1)
shmdt(0x0)
shmctl$IPC_RMID(r1, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x401)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x23456}, 0x0)
r2 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xf, 0x13, 0xffffffffffffffff, 0x8000000)
syz_io_uring_setup(0x3f04, &(0x7f0000000240)={0x0, 0xafa8, 0x10, 0x2, 0x2a7, 0x0, r0}, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0, &(0x7f00000002c0)=<r3=>0x0)
syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x0, @fd_index, 0x7, 0x0, 0x0, 0x4, 0x1, {0x1}}, 0x0)