last executing test programs:

1.223291739s ago: executing program 1 (id=517):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@local, 0x8000000, 0x2, 0x0, 0x0, 0x9}, 0x20)

1.22295395s ago: executing program 1 (id=519):
r0 = socket(0x840000000002, 0x3, 0xfa)
connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10)
sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)
socket$inet_sctp(0x2, 0x5, 0x84)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f000000cf00)=[{{&(0x7f00000084c0)={0xa, 0xfffc, 0x0, @loopback}, 0x1c, 0x0}}], 0x1, 0x0)

981.372786ms ago: executing program 1 (id=525):
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r0, &(0x7f0000000380)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0xa}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48)
r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r1, &(0x7f0000000300)={{0x6, @rose, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default]}, 0x48)
listen(r0, 0x1ad72f7)
accept4(r0, 0x0, 0x0, 0x80000)
r2 = accept4$netrom(r0, 0x0, 0x0, 0x80000)
writev(r2, &(0x7f0000001b40)=[{&(0x7f0000000600)="16f68b2017beba386312104a1458eb86de", 0x11}, {&(0x7f0000000640)="bb23d9aa9dc40dbda08b06498139a31c4f1c5202930204fe2753dce105cc368976704bdd8275a54b9e939e443d622e78e5439015948fd277697a658dc8c76c5959ad12de9154952a498d61cbb8cf12437e0ef2614fd255c6c693627de0fa2f34c9bf6e8a3be6b5da4be70ae70ec2b2260d489d5dac9b2c3036ccb499dced69a8bc299b00cbf4dbd272d537d37a6769080528c014317ff4baa17ae4e35063a811b32a63f899f529c0b51e8edcbf2a18bbdb4a984fe33ea3a274b6285f3e719d78d1bebe550aaad86c012535d0a9e61ef78d18a460ce413b44bbdcd02f7761d41a7d67cadf49c5d1166d3ee77859dc023fed01e331e3e64d7d9d1754e9588078d5efbb4317aa504360d8d68e9856943fd672a66f8dfd562602d958b858f4d4a9afd1eac5f8c83e4d001ced818fa1680fe9127e850df33b6a03dec960737a093a1468ee83126b3570ab40aa4c059313d78573cdf5e6293ccc0c2a882b22692c1c03fa699aeeb31229d99d49d8785ac6cc37c6e50ecdd445a7d4e2420dce1beb8dda1f76b965433e5ee3d90f530c828586f178b94107ca976458f5e6d93f44e3b7abd9f0d42297311ae37c080a666d1280e4033094555e87b32921769007d2576b18b300a3c1249f9d8e", 0x1c8}], 0x2)
writev(r2, &(0x7f0000000180)=[{&(0x7f0000000000)="9b", 0x1}], 0x1)

640.076664ms ago: executing program 0 (id=539):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4)
sendmmsg(r0, &(0x7f0000000940)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000200)="ad42", 0x2}], 0x1, &(0x7f0000000d40)=[{0x10, 0x1, 0x13}], 0x10}}], 0x2, 0x4000854)

569.737275ms ago: executing program 0 (id=540):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001440)={0x12, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94)
r0 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8)

568.386967ms ago: executing program 0 (id=542):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="020100000a0000000600000000000000030006000000000002000000ffffffff0000000000000000030005000000000002000000ac1e00010000000000000000020013"], 0x50}}, 0x0)

493.282253ms ago: executing program 0 (id=545):
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x2, 0x56d, 0x2}, 0x48)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004"], 0x48)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r2 = accept4(r1, 0x0, 0x0, 0x800)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000d40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWSET={0x7c, 0x9, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x9}, @NFTA_SET_EXPR={0x1c, 0x11, 0x0, 0x1, @lookup={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_FLAGS={0x8}]}}}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELOBJ={0x1c, 0x14, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}]}, @NFT_MSG_DELCHAIN={0x24, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x100}, 0x1, 0x0, 0x0, 0x20014840}, 0xc010)
bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)

390.310413ms ago: executing program 0 (id=549):
r0 = socket(0x10, 0x3, 0x6)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x5c, 0x2, {{0x2, [], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}, [@TCA_MQPRIO_MAX_RATE64={0x4}]}}}]}, 0x8c}}, 0x24000000)

324.000401ms ago: executing program 0 (id=550):
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f00000004c0)=[{0x28, 0x0, 0x5, 0xfffff034}, {0x80000006, 0x0, 0x12, 0xf9}]}, 0x10)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
r1 = socket(0x10, 0x2, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x0, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='wg2\x00', 0x10)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, 0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
syz_emit_ethernet(0xbe, &(0x7f0000000440)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa000800450000b00000000000019078ac1e0001ac1414aa0304907800000000450000000000000000010000ac141400ac1414aa07130000000000000000000000000000000000440c00037f00000100000000890f0000000000ffffffffffffffff444c0001ac1e00010000010000000000000000000000000000000000ac1414aa000000007f000001000000000000000000000000e000000200000000ffffffff00000000ffffffff00000000440400000000"], 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
unshare(0x62040000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r6 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a320000000008004100"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x400c844)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000580)='kfree\x00', r5}, 0x18)
unshare(0x64000600)
r7 = socket$inet6(0x10, 0x2, 0x0)
write(r7, &(0x7f0000000000)="fc0000001c000705ab092509b86813000aab080102000000b85b0e93210001c0f0060848050000010000000000039815fa2c53c28648000000b937799f377a00bc000c00f0036cdf0db400600033d44000040060b16a482c0a3c313012dafd5a32e273fc83ab82d710f74cec18444ef90d475ef8b2863ef3d92c94170e5bba2e177312e081f691bc5110556888100000463ae4f5df1b394cfd6239ec2a0f0d1bcae5f5502943283f4b9e611183b102b2b8f5566791cb19020191bd0733802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4794eedfca92c09d776e7a90ab79a6f00a1960548deac279c00"/252, 0xfc)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x2, 0x18, @mcast1, @mcast2={0xff, 0x3}, 0x8, 0x80, 0xfffffffe, 0x80}})
syz_emit_ethernet(0x76, &(0x7f0000000380)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "fc7771", 0x40, 0x6, 0x0, @remote, @local, {[], {{0x3, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x10, 0x2, 0x82, 0x0, 0x0, {[@eol, @generic={0x0, 0x2}, @generic={0x8, 0xd, "9294f8a639e2a611b3ea7a"}, @mptcp=@mp_join={0x1e, 0x3}, @generic={0x22, 0x8, "730b37ce18aa"}, @mptcp=@ack={0x1e, 0x10, 0xffa, 0x4, "06ba2dd15e056ad187832e55"}, @nop]}}}}}}}}, 0x0)
r8 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r8, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4f)

271.98675ms ago: executing program 2 (id=553):
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x1)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0)
syz_emit_ethernet(0x6f, &(0x7f0000000080)={@broadcast, @multicast, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "fec000", 0x35, 0x3a, 0x0, @private0, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "18b088", 0x0, 0x0, 0x0, @local, @local, [], "fafb17c133"}}}}}}}, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0)

211.877276ms ago: executing program 2 (id=554):
r0 = socket$inet6(0xa, 0x5, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c)

211.568097ms ago: executing program 2 (id=555):
sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)={0x34, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x18, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}]}]}, 0x34}}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="0a0018000303030303030000140070"], 0x3c}}, 0x0)

153.404833ms ago: executing program 2 (id=556):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000004000900041122000b00000001"], 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380), &(0x7f00000000c0), 0x2, r0}, 0x38)
bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, &(0x7f0000000000)=""/56, &(0x7f00000001c0), &(0x7f00000000c0), 0x1, r0}, 0x38)

76.50288ms ago: executing program 1 (id=557):
syz_emit_ethernet(0x82, &(0x7f0000000640)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @dev, {[@rr={0x7, 0x3}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa01012f}, {@multicast1}, {@loopback, 0x200}, {@local}, {}, {@dev}, {@private}]}]}}}}}}}, 0x0)

76.244141ms ago: executing program 2 (id=558):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18085100000000090000000000000000851000000600000018100000", @ANYRES32, @ANYBLOB="00d0ff0000000000660000000000000018000000f8ffffff00000000000000009500000000000000360a00000000000018010000202078250000000000202020db1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222}, 0x94)

74.895027ms ago: executing program 1 (id=559):
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_crypto(0x10, 0x3, 0x15)
socket(0x1d, 0x2, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140))
socket$nl_generic(0x10, 0x3, 0x10)
openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x80001, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xb4}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48)
bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70)

2.588226ms ago: executing program 2 (id=560):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0)
ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, 0x0, 0x0)

0s ago: executing program 1 (id=561):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408048000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:17869' (ED25519) to the list of known hosts.
syzkaller login: [   47.766209][ T5816] cgroup: Unknown subsys name 'net'
[   47.889009][ T5816] cgroup: Unknown subsys name 'cpuset'
[   47.893271][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.637874][ T5816] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   58.108363][ T5843] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.630709][ T5859] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   61.635279][ T5859] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   61.639267][ T5859] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   61.649702][ T5222] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   61.653496][ T5222] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   61.657601][ T5222] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   61.666596][ T5222] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   61.669713][ T5222] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   61.672685][ T5222] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   61.682734][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   61.716646][ T5859] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   61.720979][ T5859] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   61.724204][ T5859] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   61.728051][ T5859] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   61.731540][ T5859] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   61.962916][ T5860] chnl_net:caif_netlink_parms(): no params data found
[   62.065389][ T5864] chnl_net:caif_netlink_parms(): no params data found
[   62.134514][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.138535][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.140986][ T5860] bridge_slave_0: entered allmulticast mode
[   62.143842][ T5860] bridge_slave_0: entered promiscuous mode
[   62.162853][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.165007][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.168486][ T5860] bridge_slave_1: entered allmulticast mode
[   62.171264][ T5860] bridge_slave_1: entered promiscuous mode
[   62.207837][ T5857] chnl_net:caif_netlink_parms(): no params data found
[   62.216004][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.233254][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.278618][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.280912][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.283054][ T5864] bridge_slave_0: entered allmulticast mode
[   62.287225][ T5864] bridge_slave_0: entered promiscuous mode
[   62.290657][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.292829][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.295100][ T5864] bridge_slave_1: entered allmulticast mode
[   62.298549][ T5864] bridge_slave_1: entered promiscuous mode
[   62.308608][ T5860] team0: Port device team_slave_0 added
[   62.329249][ T5860] team0: Port device team_slave_1 added
[   62.353225][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.375731][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.396483][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0
[   62.398607][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.407740][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   62.440789][ T5857] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.443634][ T5857] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.446954][ T5857] bridge_slave_0: entered allmulticast mode
[   62.449652][ T5857] bridge_slave_0: entered promiscuous mode
[   62.454090][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1
[   62.457814][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.465581][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   62.476748][ T5864] team0: Port device team_slave_0 added
[   62.483408][ T5864] team0: Port device team_slave_1 added
[   62.494615][ T5857] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.497426][ T5857] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.500566][ T5857] bridge_slave_1: entered allmulticast mode
[   62.504677][ T5857] bridge_slave_1: entered promiscuous mode
[   62.544720][ T5857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.565609][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0
[   62.568177][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.579397][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   62.584987][ T5857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.594283][ T5860] hsr_slave_0: entered promiscuous mode
[   62.597372][ T5860] hsr_slave_1: entered promiscuous mode
[   62.600654][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1
[   62.602802][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.611426][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   62.645512][ T5857] team0: Port device team_slave_0 added
[   62.660177][ T5857] team0: Port device team_slave_1 added
[   62.712347][ T5864] hsr_slave_0: entered promiscuous mode
[   62.715399][ T5864] hsr_slave_1: entered promiscuous mode
[   62.718549][ T5864] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   62.721104][ T5864] Cannot create hsr debugfs directory
[   62.739980][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_0
[   62.742600][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.752215][ T5857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   62.782556][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_1
[   62.784726][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.793122][ T5857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   62.844780][ T5857] hsr_slave_0: entered promiscuous mode
[   62.847301][ T5857] hsr_slave_1: entered promiscuous mode
[   62.849410][ T5857] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   62.851726][ T5857] Cannot create hsr debugfs directory
[   63.041794][ T5860] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   63.055379][ T5860] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   63.070080][ T5860] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   63.099144][ T5860] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   63.124599][ T5864] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   63.133532][ T5864] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   63.153839][ T5864] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   63.163320][ T5864] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   63.201771][ T5857] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   63.206929][ T5857] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   63.222393][ T5857] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   63.230934][ T5857] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   63.321676][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0
[   63.361112][ T5860] 8021q: adding VLAN 0 to HW filter on device team0
[   63.372569][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.375008][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   63.392343][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.394583][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   63.411737][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0
[   63.459933][ T5857] 8021q: adding VLAN 0 to HW filter on device bond0
[   63.469999][ T5864] 8021q: adding VLAN 0 to HW filter on device team0
[   63.492313][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.494539][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   63.508598][ T5857] 8021q: adding VLAN 0 to HW filter on device team0
[   63.517405][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.520034][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   63.531731][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.534196][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   63.549928][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.552319][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   63.672153][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0
[   63.697817][   T54] Bluetooth: hci1: command tx timeout
[   63.713748][ T5860] veth0_vlan: entered promiscuous mode
[   63.720837][ T5860] veth1_vlan: entered promiscuous mode
[   63.751640][ T5860] veth0_macvtap: entered promiscuous mode
[   63.757391][ T5860] veth1_macvtap: entered promiscuous mode
[   63.769378][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0
[   63.778153][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1
[   63.787027][   T54] Bluetooth: hci2: command tx timeout
[   63.787052][ T5859] Bluetooth: hci0: command tx timeout
[   63.793075][ T5860] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   63.796024][ T5860] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   63.809818][ T5860] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   63.812793][ T5860] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   63.841880][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0
[   63.867641][ T5857] 8021q: adding VLAN 0 to HW filter on device batadv0
[   63.894783][ T5864] veth0_vlan: entered promiscuous mode
[   63.930377][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   63.937054][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.950353][ T5864] veth1_vlan: entered promiscuous mode
[   63.970423][ T5857] veth0_vlan: entered promiscuous mode
[   63.989361][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   63.991861][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.995648][ T5857] veth1_vlan: entered promiscuous mode
[   64.029803][ T5864] veth0_macvtap: entered promiscuous mode
[   64.043807][ T5860] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   64.052660][ T5864] veth1_macvtap: entered promiscuous mode
[   64.062822][ T5857] veth0_macvtap: entered promiscuous mode
[   64.074827][ T5857] veth1_macvtap: entered promiscuous mode
[   64.094969][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.125300][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.130926][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.141470][ T5864] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.144732][ T5864] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.159274][ T5864] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.162347][ T5864] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.184286][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.194911][ T5857] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.199071][ T5857] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.203476][ T5857] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.208231][ T5857] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.299868][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.302431][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.411377][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.414480][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.457707][ T3645] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.460196][ T3645] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.530922][  T205] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.537319][  T205] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.685381][ T5942] blkio.reset_stats is deprecated
[   64.972132][ T5972] netlink: 'syz.2.39': attribute type 21 has an invalid length.
[   64.975034][ T5972] netlink: 152 bytes leftover after parsing attributes in process `syz.2.39'.
[   65.035936][ T5978] openvswitch: netlink: Duplicate or invalid key (type 0).
[   65.056417][ T5976] netlink: 32 bytes leftover after parsing attributes in process `syz.2.42'.
[   65.057653][ T5978] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   65.302799][ T5989] netlink: 16 bytes leftover after parsing attributes in process `syz.1.49'.
[   65.475179][ T6014] netlink: 'syz.0.60': attribute type 5 has an invalid length.
[   65.477874][ T6014] netlink: 4 bytes leftover after parsing attributes in process `syz.0.60'.
[   65.776771][ T5859] Bluetooth: hci1: command tx timeout
[   65.856488][ T5859] Bluetooth: hci2: command tx timeout
[   65.858526][ T5859] Bluetooth: hci0: command tx timeout
[   65.986335][ T6051] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.69'.
[   66.033764][ T6053] netlink: 20 bytes leftover after parsing attributes in process `syz.2.70'.
[   66.038833][ T6053] netlink: 20 bytes leftover after parsing attributes in process `syz.2.70'.
[   66.087574][ T6059] Zero length message leads to an empty skb
[   66.187738][ T6066] syz.2.75 uses obsolete (PF_INET,SOCK_PACKET)
[   66.519327][ T6095] netlink: 12 bytes leftover after parsing attributes in process `syz.2.89'.
[   66.523442][ T6095] netlink: 16 bytes leftover after parsing attributes in process `syz.2.89'.
[   66.633968][ T6106] netlink: 'syz.2.94': attribute type 13 has an invalid length.
[   66.649689][ T6106] netlink: 'syz.2.94': attribute type 17 has an invalid length.
[   66.769110][ T6119] netlink: 8 bytes leftover after parsing attributes in process `syz.2.101'.
[   66.869232][ T6131] netlink: 'syz.1.104': attribute type 1 has an invalid length.
[   66.871812][ T6131] netlink: 'syz.1.104': attribute type 2 has an invalid length.
[   66.875013][ T6131] netlink: 'syz.1.104': attribute type 1 has an invalid length.
[   67.250869][ T6172] netlink: 'syz.2.121': attribute type 39 has an invalid length.
[   67.385449][ T6185] openvswitch: netlink: nsh attribute has 1 unknown bytes.
[   67.391741][ T6185] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   67.452762][ T6188] bridge0: port 3(erspan0) entered blocking state
[   67.455464][ T6188] bridge0: port 3(erspan0) entered disabled state
[   67.461858][ T6188] erspan0: entered allmulticast mode
[   67.465120][ T6188] erspan0: entered promiscuous mode
[   67.467766][ T6188] bridge0: port 3(erspan0) entered blocking state
[   67.470000][ T6188] bridge0: port 3(erspan0) entered forwarding state
[   67.479252][ T6188] erspan0: left allmulticast mode
[   67.480870][ T6188] erspan0: left promiscuous mode
[   67.483296][ T6188] bridge0: port 3(erspan0) entered disabled state
[   67.579783][ T6195] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   67.585326][ T6195] batadv_slave_0: entered promiscuous mode
[   67.857421][ T5859] Bluetooth: hci1: command tx timeout
[   67.937836][ T5859] Bluetooth: hci2: command 0x040f tx timeout
[   67.938704][ T5861] Bluetooth: hci0: command tx timeout
[   68.669710][ T6263] netlink: 'syz.2.160': attribute type 1 has an invalid length.
[   68.899520][ T6279] netlink: 'syz.0.164': attribute type 1 has an invalid length.
[   68.974349][    C1] Unknown status report in ack skb
[   69.927649][ T6301] veth0: entered promiscuous mode
[   69.936283][   T54] Bluetooth: hci1: command tx timeout
[   70.019606][   T54] Bluetooth: hci2: command 0x040f tx timeout
[   70.019642][ T5861] Bluetooth: hci0: command tx timeout
[   70.110687][ T6320] netlink: 'syz.2.182': attribute type 1 has an invalid length.
[   70.113154][ T6320] __nla_validate_parse: 8 callbacks suppressed
[   70.113162][ T6320] netlink: 232 bytes leftover after parsing attributes in process `syz.2.182'.
[   70.124890][ T6320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.182'.
[   70.282869][ T6341] netdevsim netdevsim1 netdevsim0: entered promiscuous mode
[   70.285458][ T6341] netdevsim netdevsim1 netdevsim0: entered allmulticast mode
[   70.302647][ T6341] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[   70.347214][ T6300] veth0: left promiscuous mode
[   70.570104][ T6369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.196'.
[   70.948499][ T6391] netlink: 20 bytes leftover after parsing attributes in process `syz.0.206'.
[   70.958174][ T6391] netlink: 'syz.0.206': attribute type 12 has an invalid length.
[   71.061209][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.102120][ T6411] netlink: 104 bytes leftover after parsing attributes in process `syz.2.214'.
[   71.256521][ T6419] netlink: 'syz.0.218': attribute type 6 has an invalid length.
[   71.299207][ T6421] netlink: 'syz.2.219': attribute type 1 has an invalid length.
[   71.302689][ T6421] netlink: 784 bytes leftover after parsing attributes in process `syz.2.219'.
[   71.514954][ T6447] netlink: 4 bytes leftover after parsing attributes in process `syz.0.227'.
[   71.529220][ T6447] netlink: 4 bytes leftover after parsing attributes in process `syz.0.227'.
[   71.532827][ T6447] netlink: 4 bytes leftover after parsing attributes in process `syz.0.227'.
[   71.940320][ T6478] netlink: 12 bytes leftover after parsing attributes in process `syz.2.242'.
[   72.096200][ T5861] Bluetooth: hci2: command 0x040f tx timeout
[   73.676808][ T6612] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[   74.051777][ T6649] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   74.210435][ T6659] netlink: 'syz.0.327': attribute type 3 has an invalid length.
[   74.632378][   T33] audit: type=1800 audit(1752293476.518:2): pid=6696 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.344" name=33FFFF dev="tmpfs" ino=541 res=0 errno=0
[   75.379563][ T6766] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   75.400142][ T6766] Cannot find add_set index 0 as target
[   75.750663][ T6796] netlink: 'syz.0.390': attribute type 1 has an invalid length.
[   76.172913][ T6827] netlink: 'syz.2.405': attribute type 4 has an invalid length.
[   76.217187][ T6829] netlink: 'syz.2.406': attribute type 3 has an invalid length.
[   76.527804][ T6844] pim6reg1: entered promiscuous mode
[   76.529625][ T6844] pim6reg1: entered allmulticast mode
[   76.791401][ T6862] openvswitch: netlink: VXLAN extension 274 out of range max 1
[   76.834307][ T6857] bridge_slave_0: left allmulticast mode
[   76.836686][ T6857] bridge_slave_0: left promiscuous mode
[   76.839374][ T6857] bridge0: port 1(bridge_slave_0) entered disabled state
[   76.851927][ T6857] bridge_slave_1: left allmulticast mode
[   76.853134][ T6864] netlink: 'syz.0.420': attribute type 3 has an invalid length.
[   76.854115][ T6857] bridge_slave_1: left promiscuous mode
[   76.862400][ T6857] bridge0: port 2(bridge_slave_1) entered disabled state
[   76.881346][ T6857] bond0: (slave bond_slave_0): Releasing backup interface
[   76.889491][ T6857] bond0: (slave bond_slave_1): Releasing backup interface
[   76.898499][ T6866] Cannot find add_set index 2 as target
[   76.903930][ T6857] team0: Port device team_slave_0 removed
[   76.914420][ T6857] team0: Port device team_slave_1 removed
[   76.920884][ T6857] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   76.923867][ T6857] batman_adv: batadv0: Removing interface: batadv_slave_0
[   76.930156][ T6857] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   76.933042][ T6857] batman_adv: batadv0: Removing interface: batadv_slave_1
[   77.106728][ T6877] nbd: must specify a size in bytes for the device
[   77.139102][ T6879] __nla_validate_parse: 11 callbacks suppressed
[   77.139115][ T6879] netlink: 12 bytes leftover after parsing attributes in process `syz.0.427'.
[   77.230667][ T6885] xt_hashlimit: size too large, truncated to 1048576
[   77.236639][ T6885] xt_hashlimit: max too large, truncated to 1048576
[   77.440552][ T6904] netlink: 100 bytes leftover after parsing attributes in process `syz.2.437'.
[   77.531658][ T6909] netlink: 240 bytes leftover after parsing attributes in process `syz.2.440'.
[   77.534500][ T6909] netlink: 48 bytes leftover after parsing attributes in process `syz.2.440'.
[   77.870589][ T6934] delete_channel: no stack
[   78.003633][ T6949] netlink: 'syz.1.457': attribute type 32 has an invalid length.
[   78.005878][ T6949] netlink: 8 bytes leftover after parsing attributes in process `syz.1.457'.
[   78.009424][ T6949] (unnamed net_device) (uninitialized): Setting coupled_control to off (0)
[   78.155311][ T6963] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms)
[   78.242189][ T6963] batadv_slave_0: entered promiscuous mode
[   78.248409][ T6971] netlink: 4 bytes leftover after parsing attributes in process `syz.0.465'.
[   78.258438][ T6963] netlink: 12 bytes leftover after parsing attributes in process `syz.1.463'.
[   78.270889][ T6963] netlink: 428 bytes leftover after parsing attributes in process `syz.1.463'.
[   78.282974][ T6963] netlink: 32 bytes leftover after parsing attributes in process `syz.1.463'.
[   78.526944][ T6993] Bluetooth: MGMT ver 1.23
[   79.631432][ T7079] geneve2: entered promiscuous mode
[   80.398638][   T47] IPVS: starting estimator thread 0...
[   80.518049][ T7154] IPVS: using max 62 ests per chain, 148800 per kthread
[   80.688502][ T7165] raw_sendmsg: syz.1.519 forgot to set AF_INET. Fix it!
[   80.754949][ T7185] ipt_REJECT: ECHOREPLY no longer supported.
[   80.790136][ T7187] netlink: 'syz.2.527': attribute type 39 has an invalid length.
[   80.974832][ T7205] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on
[   81.003268][ T7205] bond1: entered promiscuous mode
[   81.005607][ T7205] bond1: entered allmulticast mode
[   81.009229][ T7205] 8021q: adding VLAN 0 to HW filter on device bond1
[   81.039571][ T7210] netlink: 84 bytes leftover after parsing attributes in process `syz.0.537'.
[   81.074532][ T7212] netlink: 'syz.2.538': attribute type 1 has an invalid length.
[   81.308839][   T24] cfg80211: failed to load regulatory.db
[   81.493573][ T7252] netlink: 'syz.2.555': attribute type 1 has an invalid length.
[   81.504724][ T7240] netlink: 'syz.0.550': attribute type 12 has an invalid length.
Connection to localhost closed by remote host.
[   82.182898][   T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.311907][   T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.390180][   T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.466479][   T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.882194][   T13] bond0 (unregistering): Released all slaves
[   82.890405][   T13] bond1 (unregistering): Released all slaves
[   83.143206][   T13] hsr_slave_0: left promiscuous mode
[   83.154113][   T13] hsr_slave_1: left promiscuous mode
[   83.171230][   T13] veth1_macvtap: left promiscuous mode
[   83.173222][   T13] veth0_macvtap: left promiscuous mode
[   83.175075][   T13] veth1_vlan: left promiscuous mode
[   83.177152][   T13] veth0_vlan: left promiscuous mode
[   84.029559][   T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.082786][   T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.122752][   T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.188799][   T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.280327][   T13] bridge_slave_1: left allmulticast mode
[   84.283164][   T13] bridge_slave_1: left promiscuous mode
[   84.286558][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   84.292663][   T13] bridge_slave_0: left allmulticast mode
[   84.294628][   T13] bridge_slave_0: left promiscuous mode
[   84.298104][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   84.569243][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   84.574387][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   84.579386][   T13] bond0 (unregistering): Released all slaves
[   84.650606][   T13] bond1 (unregistering): Released all slaves
[   84.907863][   T13] hsr_slave_0: left promiscuous mode
[   84.910927][   T13] hsr_slave_1: left promiscuous mode
[   84.913835][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   84.922219][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   84.925346][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   84.944364][   T13] veth1_macvtap: left promiscuous mode
[   84.948276][   T13] veth0_macvtap: left promiscuous mode
[   84.950902][   T13] veth1_vlan: left promiscuous mode
[   84.953221][   T13] veth0_vlan: left promiscuous mode
[   85.256932][   T13] team0 (unregistering): Port device team_slave_1 removed
[   85.280349][   T13] team0 (unregistering): Port device team_slave_0 removed
[   85.690084][   T13] IPVS: stop unused estimator thread 0...
[   85.771748][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   85.835889][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   85.922876][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.013263][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.115763][   T13] bridge_slave_1: left allmulticast mode
[   86.119959][   T13] bridge_slave_1: left promiscuous mode
[   86.121859][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   86.128414][   T13] bridge_slave_0: left allmulticast mode
[   86.130181][   T13] bridge_slave_0: left promiscuous mode
[   86.131993][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   86.397446][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   86.402201][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   86.405915][   T13] bond0 (unregistering): Released all slaves
[   86.575588][   T13] hsr_slave_0: left promiscuous mode
[   86.582077][   T13] hsr_slave_1: left promiscuous mode
[   86.584221][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   86.587285][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   86.590296][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   86.592724][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   86.605867][   T13] veth1_macvtap: left promiscuous mode
[   86.608468][   T13] veth0_macvtap: left promiscuous mode
[   86.610651][   T13] veth1_vlan: left promiscuous mode
[   86.612421][   T13] veth0_vlan: left promiscuous mode
[   86.956897][   T13] team0 (unregistering): Port device team_slave_1 removed
[   86.989430][   T13] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
04:11:33  Registers:
info registers vcpu 0

CPU#0
RAX=3e269b1cb6386800 RBX=ffffffff81976c78 RCX=3e269b1cb6386800 RDX=0000000000000001
RSI=ffffffff8d998b52 RDI=ffffffff8be29dc0 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1f3f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6f24d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fe2fbeee6c0 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=000000040000007a 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000ff0000000000 XMM03=0000000000000000 0000000000000000
XMM04=00000000000000ff 00000000000000ff XMM05=0030313230382f65 65692f306968702f
XMM06=0000000000000000 0000000000000000 XMM07=000000000000ff00 0000ff00000000ff
XMM08=ff00000000000000 0000000000000000 XMM09=3435313230386565 65692f6d69737768
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=7680b767f997fe00 RBX=ffffffff81976c78 RCX=7680b767f997fe00 RDX=0000000000000001
RSI=ffffffff8d998b52 RDI=ffffffff8be29dc0 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa1f3f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d3000
RIP=ffffffff8b6f24d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffecc3101e8 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000080000010015 0000000c00000028 XMM01=0000000e00000001 0000000000000006
XMM02=0043004400010015 0000000000000040 XMM03=0000000000000000 0000000000000000
XMM04=0000ff0000000000 00000000000000ff XMM05=0030313230382f65 65692f306968702f
XMM06=0000000000000000 0000000000000000 XMM07=000000000000ff00 0000ff00000000ff
XMM08=ff00000000000000 0000000000000000 XMM09=3435313230386565 65692f6d69737768
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
