r0 = syz_io_uring_setup(0x7d04, &(0x7f00000002c0), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x9, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x346d, &(0x7f0000000680), &(0x7f0000fee000/0x1000)=nil, &(0x7f0000fec000/0x14000)=nil, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={<r3=>0xffffffffffffffff})
pipe2(&(0x7f0000000040), 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0)
r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
r6 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00')
r7 = perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, @perf_bp={0x0}, 0x0, 0xe90, 0x100, 0x0, 0x0, 0xc4d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r6, 0xc018937e, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r6, @out_args}, './file0\x00'})
pread64(r6, &(0x7f0000001100)=""/4095, 0x20001be3, 0xf0ff1f)
ioctl$LOOP_CHANGE_FD(r6, 0x4c06, r7)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x3, 0x0, @fd_index=0x5, 0x0, 0x0, 0x401, 0x0, 0x1, {0x0, r5, r6}}, 0xb7)
syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd=r0, 0x0, 0x0, 0x9, 0x5, 0x0, {0x0, r5, r3}}, 0x8001)
io_uring_enter(r0, 0x58ab, 0x0, 0x0, 0x0, 0x0)