r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/timer_list\x00', 0x0, 0x0)
lseek(r0, 0xba, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
sendfile(r1, r0, 0x0, 0x800000000000000)