r0 = perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f00000001c0), 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000044)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000280)=@mgmt_frame=@beacon={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x76, 0x6, {0xe1, 0x9, 0x29, 0x70}}}, 0x36)
nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0))
r2 = dup(r0)
openat$nvram(0xffffffffffffff9c, &(0x7f0000000200), 0x8040, 0x0)
r3 = syz_io_uring_setup(0x21, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000180), &(0x7f0000000040))
io_uring_enter(r3, 0x76d3, 0x0, 0x0, 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000140)={0x2000})
syz_80211_inject_frame(&(0x7f0000000240), &(0x7f0000000440)=ANY=[@ANYBLOB="0100ffffffffffffffffffffffff496d116dee780700020184810105b6037f0c857206030303030303dd435df9e758d57d7a0f3ce9cd5b80f5130d840432b44f42700ea5d2720290c7f8f1830ba76513828ef3b12101ac391f47a2189e330f86170d4c989791c94e6e0f1d135ed000000fab5dbb2ee7e2e310da865f7dda6ab5e7c18745c6548c7ad5508522f2e4f18edd03558b3df8afb72d2a259d26e38eda0754058e8b626133cb0436db37e1af1f2e6eb0e35b1faf51fd4ed15e90a57f7ba16bc7df1f778fc2a350184dfe4275f8bcd7fc5421955b8d77402f147624cea065db008478502459a95875"], 0x70)
socket$inet6_udplite(0xa, 0x2, 0x88)
clone3(&(0x7f0000000000)={0x1040100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)
execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1100)
syz_io_uring_setup(0x7f02, &(0x7f00000002c0), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0))