last executing test programs:

4m42.807060211s ago: executing program 2 (id=963):
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0000}]})
r0 = gettid()
r1 = getpgrp(0x0)
rt_tgsigqueueinfo(r1, r0, 0x28, &(0x7f0000000240)={0x0, 0xfffffffe, 0x8})

4m42.806757702s ago: executing program 2 (id=964):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6)
write(r0, &(0x7f0000000000)='\a\x00\x00\x00', 0x4)

4m42.706063494s ago: executing program 2 (id=965):
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
r1 = fanotify_init(0x200, 0x0)
fanotify_mark(r1, 0x1, 0x40000032, r0, 0x0)
pipe2(&(0x7f0000000240)={<r2=>0xffffffffffffffff}, 0x4000)
readv(r2, 0x0, 0x0)

4m42.705743064s ago: executing program 2 (id=966):
r0 = syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000001240)='./file0\x00', 0x10, &(0x7f0000000a00)=ANY=[@ANYBLOB="00e789da34e04a1ffbc2f05cefeb4ee6d5ae1071124b2c2fb684f5c7ac05000000c7880f67e775c748f6381a3e01e7f93330b30b90bbb4d2b697899a16f2df4fa2a8f06ac2c5352ddcae2b83672ef3d9f532e55f4e798924ac6332751e737383f6890d2dcfcbdbd41940a64c7b4374674e7bb6dd0d1b8d3d62f6d77b0282e166e2ce4c353d2d4d315a81146bf46a1508ef0d2ddc7d0b447fe17b85b292d13cea2256a16cab12d75a852bc680da7ea837480feb2e0500001e0000000000003bc18c52d0351cd285197b0641569048b5b416ba1c570000000000100083794afff0a9eed63b1226b18c4b455ab222d7ae1be52a22e8ec8bf2c0c7d99770415863f50aa18bcb66061a29bc55105f3482ed752f882d224a386b51836c1b437036b677156e22e174ff516dbab0b2cdf52bee43c4ffffffffffffffffd9487b8663a339b98df63b4bf3e97f02d6f1e7e65f968dd90841506355d9ac40f1b434c8a9b5bd91a70c53a5aadbebd9ed9d0a55bd47a967163e0c02753f8895bfbf1b41b5490667c241068d59983ae1d0f03e650f5357425200000000000000008fa437e38b8200000000630000000000000000000000000000000000000000000000e91100000000ee65e073c14bb74617079e0b6ecfc830db14244567fd8f4e4e5903eaf983786e28295783f130b95dc37f59a658020e88047db7783ce8a9cba6c255902cfb83946ea3f5f7a8cee911b2b37ae4b01e65ea86d5ea7ae17b2a9bc250c9b8fc9fbc04617939bdd13457954172d18701768f8a461bee740f2d82ae566d2e30a93ad2b201a6d16a93c75a950cc437e7f25d3aadddb8edd028d84490b6bafd636aa4fb482a8a4b3987dafe58e742448c4b36b03790090198145dee533257bb9050554f8cace210a5bc5c768f83e99019f7c00ff9ca679768dbba3f7d21c545c99c2f7688f7030fe37121d625d1f81018feb74c9d48eebdf1702550b097271ab9bd38c62f4b31fd9482c05ba042bb2617f5b3eb59efcdf3e9332827586e6be0cd2d7297ebd5716514942fd941c1152a8df17f7bf8d23188cc812736a6eb35f0004dde29f79717df9065381ba566751a8e1710210f00ca58ff481633fa3fbe088f86e336cce022c8e2233b79af7f3fb562f9863b2842df189b15ae659ffd7fb31258935a7d1eec82952520f62fbf0f4c8d879805ef3e6b576f5bac6cd8ad874081", @ANYRES16], 0x0, 0x11dc, &(0x7f0000001280)="$eJzs3MGLG1UcB/Bf19rW1N2sWqstiA+96GVo9uBFL0G2IA0obSO0gjB1JxoyJiETFiJi9eTVv0M8ehPEm1724t/gbS8eexBHTNR2l3hYdDewfD6X/OD3vuQ9BgbeMG/23/jq40Gvynr5NNbOnIm1cUR6kCLFWvzt83j19R9/euHWnbs32p3O9s2Urrdvt15LKW28+P17n37z0g/Ti+9+u/Hd+djbfH//161f9i7vXdn//fZH/Sr1qzQcTVOe7o1G0/xeWaSdfjXIUnqnLPKqSP1hVUwO9HvlaDyepXy4s94YT4qqSvlwlgbFLE1HaTqZpfzDvD9MWZal9UbwX3S/flDXdURdPx7noq7r+oloxMV4MtZjI5qxGU/F0/FMXIpn43I8F8/HlfmoVc8bAAAAAAAAAAAAAAAAAAAAThfn/wEAAAAAAAAAAAAAAAAAAGD1bt25e6Pd6WzfTOlCRPnlbne3u/hd9Nu96EcZRVyLZvwW89P/C4v6+lud7WtpbjO+KO//lb+/233sYL41/5zA0nxrkU8H8+ej8Wh+K5pxaXl+a2n+Qrzy8iP5LJrx8wcxijJ24s/sw/xnrZTefLtzKH91Pg4AAABOgyz9Y+n+Pcv+rb/IH+H5wKH99dm4ena1ayeimn0yyMuymBxbcS6O/S8UCsX/XKz6zsRJeHjRVz0TAAAAAAAAAAAAjuIkXidc9RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA/2IFjAQAAAABh/tZpdGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBVAAAA//8xgdSv")
r1 = openat(r0, &(0x7f0000000080)='./file0\x00', 0x0, 0x30)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307202, &(0x7f0000000f00)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])

4m42.585423753s ago: executing program 2 (id=967):
syz_usb_connect(0x3, 0x34, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000907000000000000000705d77b5d"], 0x0)
syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="04"], 0x10)

4m42.193151502s ago: executing program 2 (id=970):
socketpair(0x1, 0x5, 0x0, &(0x7f0000000000))
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4)

4m41.766503883s ago: executing program 32 (id=970):
socketpair(0x1, 0x5, 0x0, &(0x7f0000000000))
r0 = socket$packet(0x11, 0x2, 0x300)
getsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4)

4m16.587012912s ago: executing program 0 (id=1288):
r0 = syz_open_dev$loop(&(0x7f00000003c0), 0x6, 0x20000)
ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000400))

4m16.526816098s ago: executing program 0 (id=1290):
r0 = socket$vsock_stream(0x28, 0x1, 0x0)
getsockopt(r0, 0x28, 0x7f, 0x0, &(0x7f0000000000))

4m16.496247874s ago: executing program 0 (id=1292):
syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f0000000a40), 0x1, 0x55e, &(0x7f0000000a80)="$eJzs3c1rHOUfAPDvbJK+/35NoRQVkUAPVmo3TeJLBQ/1KFos6L0uyTSUbLoluylNLNge7MWLFEHEgnjXu8fiP+BfUdBCkRL04CUym9k0L7vJNt2ajfP5wITn2Znd5/nuzPfJMzuzbACFNZL9KUW8GBFfJRFHIyLJ1w1GvnJkZbulxzcnsyWJ5eWP/0ia22X11mu1nnc4r7wQEb98EXG6tLnd+sLiTKVaTefy+mhj9tpofWHxzJXZynQ6nV4dn5g49+bE+Dtvv9WzWF+7+Ne3H91//9yXJ5e++enhsbtJnI8j+bq1cTyDW2srIzGSvydDcX7DhmM9aKyfJLvdAXZkIM/zocjGgKMxkGc98N/3eUQsAwWVyH8oqNY8oHVu36Pz4D3j0XsrJ0Cb4x9c+WwkDjTPjQ4tJevOjLLz3eEetJ+18fPv9+5mS2z4HOJAD14foJNbtyPi7ODg5vEvyce/nTvbxTYb2yja/x/YTfez+c/r7eY/pdX5T7SZ/xxuk7s7sX3+lx72oJmOsvnfu23nv6sXrYYH8tr/mnO+oeTylWqajW3/j4hTMbQ/q291Pefc0oPlTuvWzv+yJWu/NRfM+/FwcP/650xVGpVniXmtR7cjXmo7/01W93/SZv9n78fFLts4kd57pdO67eN/vpZ/iHi17f5/ckUr2fr65GjzeBhtHRWb/XnnxK+d2t/t+LP9f2jr+IeTtddr60/fxvcH/k47rVsXf3R//O9LPmmW9+WP3ag0GnNjEfuSDzc/Pv7kua16a/ss/lMntx7/2h3/ByPi0y7jv3P8x5e7in+X9v/UU+3/py88+OCz7zq1393490azdCp/pJvxr9sOPst7BwAAAAAAAP2mFBFHIimVV8ulUrm8cn/H8ThUqtbqjdOXa/NXp6L5XdnhGCq1rnQfXXM/xFh+P2yrPr6hPhERxyLi64GDzXp5slad2u3gAQAAAAAAAAAAAAAAAAAAoE8c7vD9/8xvA7vdO+C585PfUFzb5n8vfukJ6Ev+/0NxyX8oLvkPxSX/objkPxSX/Ifikv9QXPIfAAAAAAAAAAAAAAAAAAAAAAAAAAAAeurihQvZsrz0+OZkVp+6vjA/U7t+Ziqtz5Rn5yfLk7W5a+XpWm26mpYna7PbvV61Vrs2Nh7zN0Ybab0xWl9YvDRbm7/auHRltjKdXkqH/pWoAAAAAAAAAAAAAAAAAAAAYG+pLyzOVKrVdE5BYUeFwf7oxp4vZNnYB91Y1x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6A//BAAA//8iuzYD")
r0 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x389b0d52417bb201)
pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x6a000}], 0x1, 0x7030, 0x0, 0x3)

4m16.364923535s ago: executing program 0 (id=1293):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f00000000c0)={[{@noinit_itable}, {@dax_inode}, {@nolazytime}, {@abort}, {@dax_inode}, {@lazytime}, {@noload}, {}, {@noauto_da_alloc}]}, 0xfe, 0x558, &(0x7f0000000c00)="$eJzs3U1rG0cfAPD/ynbenOeJAyG0PRRDDk1JI8d2X1LoIT2WNjTQ3lNhb0ywHAVLDrEbaHJoLr2UUCilgdIP0HuPoV+gnyLQBkIJpj30orLyylFsyZZtpVaq3w82mdldaXY0+x/PaCQUwMAaz/4pRLwcEV8nEcdajg1HfnB87bzVJ7dmsi2Jev2TP5JI8n3N85P8/9E881JE/PJlxJnC5nKryyvzpXI5XczzE7WF6xPV5ZWzVxdKc+lcem1qevr8W9NT777zds/q+vqlv777+MEH5786tfrtT4+O30viQhzNj7XWYw9ut2bGYzx/TUbiwoYTJ3tQWD9J9vsC2JWhPM5HIusDjsVQHvXAf98XEVEHBlQi/mFANccBzbl9j+bBL4zH769NgDbXf3jtvZE41JgbHVlNnpkZZfPdsR6Un5Xx8+/372Vb9O59CIBt3b4TEeeGhzf3f0ne/+3euS7O2VjGDvu/+g4vCWjxIBv/vNFu/FNYH/9Em/HPaJvY3Y3t47/wqAfFdJSN/95rO/5dX7QaG8pz/2uM+UaSK1fLada3/T8iTsfIwSy/1XrO+dWHHfup1vFftmXlN8eC+XU8Gj747GNmS7XSXurc6vGdiFfajn+T9fZP2rR/9npc6rKMk+n9Vzsd277+z1f9x4jX2rb/0xWtZOv1yYnG/TDRvCs2+/PuyV87lb/f9c/a/8jW9R9LWtdrqzsv44dDf6edju32/j+QfNpIH8j33SzVaouTEQeSjzbvn3r62Ga+eX5W/9Ontu7/2t3/hyPisy7rf/fE3Y6n9kP7z+6o/XeeePjh5993Kr+79n+zkTqd7+mm/+v2Avfy2gEAAAAAAEC/KUTE0UgKxfV0oVAsrn2+40QcKZQr1dqZK5Wla7PR+K7sWIwUmivdoy2fh5jMPw/bzE9tyE9HxPGI+GbocCNfnKmUZ/e78gAAAAAAAAAAAAAAAAAAANAnRjt8/z/z29B+Xx3w3PnJbxhc28Z/L37pCehL/v7D4BL/MLjEPwwu8Q+DS/zD4BL/MLjEPwwu8Q8AAAAAAAAAAAAAAAAAAAAAAAAAAAA9denixWyrrz65NZPlZ28sL81XbpydTavzxYWlmeJMZfF6ca5SmSunxZnKwnbPV65Urk9OxdLNiVparU1Ul1cuL1SWrtUuX10ozaWX05F/pVYAAAAAAAAAAAAAAAAAAADwYqkur8yXyuV0UUJiV4nh/rgMibVEM7D3/IT72y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQKt/AgAA//+jgjYy")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000200)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x2080, 0x0)
io_setup(0x4, &(0x7f0000010440)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f00000019c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0xfdfe, 0x100000000000000}])

4m16.081087168s ago: executing program 0 (id=1298):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073017a31000000000800410072786500140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x810)

4m15.65240212s ago: executing program 0 (id=1302):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="44ae5f001000"/20, @ANYRES32=0x0, @ANYBLOB="0000000008290400240012800b000100697036746e6c000014000280060012"], 0x44}}, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000)

4m15.539527134s ago: executing program 33 (id=1302):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="44ae5f001000"/20, @ANYRES32=0x0, @ANYBLOB="0000000008290400240012800b000100697036746e6c000014000280060012"], 0x44}}, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000)

3m49.477735947s ago: executing program 1 (id=1593):
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x7b345e05922a0178, 0xffffffffffffffff, 0x1dd1c000)

3m49.364444143s ago: executing program 1 (id=1597):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0)
sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01022cbd7000fcdfdf251bea000008009a0013"], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x40)

3m49.295412514s ago: executing program 1 (id=1599):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0)
shutdown(r0, 0x0)

3m49.165432048s ago: executing program 1 (id=1603):
syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000180)='./file1\x00', 0x20108c0, &(0x7f0000006980)=ANY=[@ANYBLOB="646973636172642c696f636861727365743d63703837342c6572726f72733d72656d6f756e742d726f2c75737271756f74612c696f636861727365743d63703836312c696f636861727365743d6370313235302c696e7465677269747900696f636861727365743d69736f383835392d342c646973636172643d30783030303030303030303030303030396943b95b49aca56faf1cc22189cc312c796f636861727365743d6d6163677265656b2c71756f74612c726573697a653d3078303030303030303030303030376666662c646973636172643d3078303030303030303066666666666666662c756d61736b3d3078303030303030303030303032303034352c6673636f6e746578743d046e636f6e66696e65645f752c66736d616769633d3078303030303030303030303230303030392c324216873b95edfe8ceab2bb0b11835a5cf531ac6273c29a4d4f9d056f1bcb8cd0a969ed12cf99802b5b3201518ecfc59a4fd94dd5349dc55633bd2bde1128ad071807ef13a9f10c0fbf3ad861c2009067c5c6c84cdba2806fa74eddff8373799d0b8c1e6f7e2b205235161b610ae5c66d1d9cfc2bc0cb617ae49331ade71595c2a5438139933aada47236dafdffffff088a552445f95768ccecb0c35797e832beced2077fa197623cd3de51d69d7a4f77a80eb5f783f091e5ec6047a0f67676819f4bf66744c1cb0975b96baf730000000000000001004e257bbabf33e3fa8d0cca2fbb4dabe1c5634b06881b049910b34a55f5a213438b2cdf889b764ce26ae4e539fdffa2ea82c34b16308e26ce945d101d5f2e2577d8e2a21d9401194a97a6c281b603da7c66934f0c"], 0xfe, 0x61f6, &(0x7f000000cdc0)="$eJzs3c1vHGcdB/DfvvolNLV6qEqEkJuWl1KaxEkJgQJtD3Dg0gPKFSVy3SoiBZQElFYWceULB078BSAkjghxRBz4A3rgyo0TJyLZSKCeGDTe54lnN7tdp7Z31p7PR3JmfvPMep/Jd189L08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPH97/1grRURN36eFqxEfCY6Ee2IpbJejYil1ZW8fjcinou95ng2InoLEeXt9/55OuLViPjobMTO7uZ6ufjyAfvx3T/+/Xc/PPPW3/7Qu/jfP93rvDZpvfv3f/WfPz843DYDAABA0xRFUbTS1/xz6ft9u+5OAQAzkd//iyQvP/X1r//51l/mqT/qRtcRl/YWzkt/1Gr16a2rivEeVIuI2KrepvzMYHc8AJwwW/Fx3V2gRvJvtG5EnKm7E8Bca9XdAY7Fzu7meivl26q+H6wO2vOxIEP5b7Uend8xaTrN6DEms3p8bUcnnpnQn6UZ9WGe5Pzbo/nfGLT303rHnf+sTMq/Pzj1qXFy/p3R/Eccaf4LdebfHpt/U+X8u0+Uf+cEP//lDwAAAADA6Zf//r9S8/7fhcNvyoF80v7f1Rn1AQAAAAAAAACO2mHH/3vE+H8AAAAwt8rv6qXfnN1fNulabOXy662Ip0bWBxomnSyzXHc/AAAAAAAAAAAAAKBJuoNjeK+3InoR8dTyclEU5U/VaP2kDnv7k67p2w9NVveLPAAADHx0duRc/lbEYkRcT9f66y0vLxfF4tJysVwsLeTPs/2FxWKp8r02T8tlC/0DfCDu9ovyly1Wblc17fvytPbR31feV7/oHKBjR6SX/jcnNNcUNgAkg3ejHe9Ip0xRPD3pwwcM8fw/hVZipe7HFfOv7ocpAAAAcPyKoiha6XLe59I+/3bdnQIAZiK//4/uFzhU3Z7QHnE0v1+tVqvVavWnqquK8R5Ui4jYqt6m/MxgOH4AOGG24uO6u0CN5N9o3Yh4ru5OAHOtVXcHOBY7u5vrrZRvq/p+kMZ3z8eCDOW/1dq7Xb79uOk0o8eYzOrxtR2deGZCf56dUR/mSc6/PZr/jUF7P6133PnPyqT8+3unzDVPzr8zmv+I05N/e2z+TZXz7z5R/h35AwAAAADAHMt//1+x/zdvMgAAAAAAAACcODu7m+v5vNe8//9zY9Zz/ufplPNvPWn+S2le/idazr89kv+XR9brVOYfvrn//P/37ub67+/967N5etD8F/JMKz2yWukR0Ur31Oqm6WG27nHbvU6/vKdeq93ppmN+it47cStux0ZcGlq3nf4/9tvXhtrLnvaG2i8PtXcfa78y1N5L1x0olnL7hViPn8TteHuvvWxbmLL9i1PaiyntOf+O1/9Gyvl3Kz9l/supvTUyLT38sP3Y8746HXc/b9z6/C8vHf/mTDHpyseD7Ts/6+5EDF5xzvTjZ3c37ly4f/PevTtrkSZDSy9HmhyxnH9v72dh//X/hUF7ft2vPl8ffth/4vznxXZ0Hz22q8r8X6jMl9v70oz7Voecfz/95PzfTu3jn/8nOf/OxPxfrqE/AAAAAAAAAAAAAAAA8EmKotg7RfSNiLiazv+p69xMAGC28vt/keTlarVarVarT19dVYz3erWIiL9Wb1N+ZvjFuF8GAMyz/0XEP+ruBLWRf4Pl6/2V0xfr7gwwU3ff/+BHN2/f3rhzt+6eAAAAAAAAAACfVh7/c7Uy/vOLEbEyst7Q+K9vxuphx//s5plHA4we8UDfE2y3+512Zbjx52NvfO4Lk8b/Ph+Pj/+dx8TtVLdjgt6U9v6U9oUp7Ytjl+6nNfZEj4qc//OV8c7L/M+NDL/ehPFfR8e8b4Kc//nK47nM/0sj61XzL347d/lvHXTF7WgP5X/x3ns/vXj3/Q9eufXezXc33t348ZW1tUtXrl69du3axXdu3d64NPj3eHo9B3L+eexrx4E2S84/Zy7/Zsn5fyHV8m+WnP8XUy3/Zsn558978m+WnH/+7iP/Zsn5v5Rq+TdLzv8rqZZ/s+zsbi6U+b+cavk3S37+fzXV8m+WnP8rqZZ/s+T8L6Ra/s2S87+Y6gPk7/Lwp0jOP+/h8vxvlpz/Wqrl3yw5/8upln+z5PyvpFr+zZLzfzXV8m+WnP/XUi3/Zsn5X021/Jsl5//1VMu/WXL+11It/2bJ+X8j1fJvlpz/N1Mt/2bJ+b+Wavk3S87/W6mWf7Pk/L+davk3S87/O6mWf7Pk/F9PtfybZf/6/2bMmDGTZ+p+ZQIAAAAAAAAAAAAARs3icOK6txEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+zw4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsHdvMXLd9R3Az+zF3nUIMRCCkxrYJCaEZMmu7cQX2jQmXBugFEgo9ILtetdmwTe8dgkUyaaBEgmjooqq6UNbQKiNVFVYFQ+0ojQPVS9PpX2gLxVVJaRGVUABFamtKFvNnP//vzOzszOz3vF69vw/Hyn57c6cmXPmzJnZ/e76uwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJrd/ob5z9SKoqj/1/jf9qJ4Qf3jyantjcted723EAAAAFiv/2v8//mb0gWH+rhR0zJ/94p//NrS0tJS8b7R3x3/wtJSumKqKMa3FkXjuujKv7+/1rxM8EQxURtp+nykx+pHe1w/1uP68R7Xb+lx/dYe10/0uH7FDlhhsvx5TOPOdjU+3F7u0uLmYrxx3a4Ot3qitnVkJP4sp6HWuM3S+PFioThZzBezLcuXy9Yay3/j9vq63lrEdY00rWtn/Qj5wSeOxW2ohX28q2Vdy/cZfe/1xdQPf/CJY398/rlbO82eu6Hl/srtvPuO+nZ+KlxSbmut2Jr2SdzOkabt3NnhORlt2c5a43b1j9u38/k+t3N0eTM3VPtzPlGMND7+VmM/jTX/WC/tp53hsv++syiKS8ub3b7MinUVI8W2lktGlp+fifKIrN9H/VB6cTG2puP09j6O0/qc29V6nLa/JuLzf3u43dgq29D8NH3vk1tWPO9rPU6j+qNe7bXSfgwO+rUyLMdgPC6+1XjQT3Y8BneFx/+Ju1Y/BjseOx2OwfS4m47BO3odgyNbRhvbnJ6EWuM2y8fg7pblRxtrqjXms3d1PwZnzp86O7P4sY+/duHU0RPzJ+ZP7929e3bvvn0HDhyYOb5wcn62/P9V7u3ht60YSa+BO8K+i6+BV7ct23yoLn1pcK/DiS6vw+1tyw76dTjW/uBqG/OCXHlMl6+NR+s7feLySLHKa6zx/Nyz/tdhetxNr8Oxptdhx68pHV6HY328DuvLnL2nv+9Zxpr+67QN1+prwfamY7D9+5H2Y3DQ348MyzE4EY6Lf71n9a8FO8P2Pjm91u9HRlccg+nhhvee+iXp+/2JA43R6bi8rX7FDVuKC4vz5+57/Oj58+d2F2FsiJc0HSvtx+u2psdUrDheR9Z8vB5aeMWTt3W4fHvYVxOvrf9vYtXnqr7M/fd1f64aX90678+WS/cUYQzYRu/PTl/N6/szZcku+7O+zKdm1v+9eMqlTe+/46u8/8bc/5NyfemunhgdHytfv6Np74y3vB+3PlVjjfeuWmPdz8/09348Hv7b6Pfjm7u8H+9oW3bQ78fj7Q8uvh/Xev20Y33an8+JcJycnO3+flxfZseetR6TY13fj+8Msxb2/2tCUki5qOnYWe24TesaGxsPj2ssrqH1ON3bsvx4yGb1dT295+qO07vvLO9rND26ZRt1nE61LTvo4zS9X612nNZ6/fTt6rQ/nxPhuLh5b/fjtL7MM/ev/71zMn7Y9N65pdcxOD66pb7N4+kgLN/vlybjMXhfcaw4U5ws5hrXbmkcT7XGuqYf6O8Y3BL+2+j3yh1djsG725Yd9DGYvo6tduzVxpbfSAao/fmcCMfFUw90Pwbry7xx/2C/d707XJKWafretf3na6v9zOu2seX7K67xz7zq2/k3+7v/bLa+zMkDa82Z3ffTveGSGzrsp/bX72qvqbliY/bTjrCdzx1YfT/Vt6e+zBcO9nk8HSqK4uJHHm78vDf8fuXPL3z7ay2/d+n0O52LH3n4+zce/9u1bD8Am99PyrGt/FrX9Jupfn7/DwAAAGwKMfePhJnI/wAAAFAZMffHfxWeyP8AAABQGTH3j4WZZJL/d7zxuYWfXCxSM38piNen3fBIuVzsuM6Gz6eWltUvf/gr8z/6y4v9rXukKIofP/IbHZff8UjcrtJU2M4rb2q9fOUNL/a1/iOPLS/X3F//Yrj/+Hj6PQw6VXBni6L4xk2fa6xn6v2XG/OZR4405rsvPflEfZnnD5afx9s/+5Jy+T8I5d9Dx4+23P7ZsB++G+bs2zrvj3i7r15+zc79711eX7xd7Y4XNh72Ux8o7zf+nZzPP1EuH/fzatv/V599+qv15R9/VeftvzjSefufDvf7lTD/5+Xl8s3PQf3zeLtPh+2P64u3u+/L3+y4/Vc+Uy5/9s3lckfCjOu/O3y+683PLTTvr8drR1seV/GWcrm4/tlv/3bj+nh/8f7bt3/i8OWW/dF+fDzzz+X9zLQtHy+P64n+om399ftpPj7j+p/+rSMt+7nX+q+8+9mX1++3ff33ti032nb79r/Y9Ief/lzH9cXtOfRnZ1sez6F3hddxWP9THwjHY7j+f698rmW90ZF3tb7/xOW/uP1iy+OJ3vrDcv1XHjrRmP8x9aPfv+EFN77w0ivr+64ovvWe8v56rf/EH51p2f4v3XJP4/mI18eOfvv6VxPXf+6j06fPLF5YmGvaq42/nfP2cnu2Tkxuq2/vTeG9tf3zw2fOf3D+3NTs1GxRTFX3T+hdtS+H+f1yXFrr7e95LDyft/3eN7bd9U+fjZf/y6Pl5ZffVn7denVY7vPh8u3l87dUW+f6n7r9lsbru/ZM+XlLj30Adu76zwN9LRgef/v3BfF4P/vSDzb2Q/26xteN+Lpe5/Z/Z668n6+H/boU/jLzHbcsr695+fi3ES6/p3y9r3v/hbe5+Lz+SXi+3/Hd8v7jdsXH+53wfcw3d7S+38Xj4+sXR9rvv/FXPC6F95PiUnl9XCru78vP39Jx8+LfISku3dr4/HfS/dy6poe5msWPLc6cXDh94fGZ8/OL52cWP/bxw6fOXDh9/nDjb3ke/lCv2y+/P21rvD/Nze+7v5idLIriTDG7AW9Y12b76x/1t/1nHzs2t3/2rrn540cvHD//2Nn5cyeOLS4em59bvOvo8ePzH+11+4W5B3fvObh3/57pEwtzDx44eHDvwemF02fqm1FuVA/7Zj88ffrc4cZNFh+8/+DuBx64f3b61Jm5+Qf3z85OX+h1+8bXpun6rX99+tz8yaPnF07NTy8ufHz+wd0H9+3b0/OvAZ46e3xxaubchdMzFxbnz82Uj2XqfOPi+te+Xrenmhb/rfx+tl2t/EN8xTvv3Zf+PmvdVz656l2Vi7T9AdHnwt+i+YcXnT3Qz+cx94+HmWSS/wEAACAHMfdvCTOR/wEAAKAyYu7fGmYi/wMAAEBlxNw/EWaSSf7X/9f/76//X16v/59X///sR8pe6Wbv/8f+vP5/Hq5z/3/d69f/1/+vXv+///78Zt9+/X/9f1Yatv5/zP2TRZFl/gcAAIAcxNy/LcxE/gcAAIDKiLn/hjAT+R8AAAAqI+b+F4SZZJL/9f/76v/v6VW4qn7/3/n/9f+Lzdn/j0+O/n821ty/f++jLZ/q/wf6//r/+v/6//r/rNv4qtdcr/5/zP03hplkkv8BAAAgBzH3vzDMRP4HAACAyoi5/6YwE/kfAAAAKiPm/u1hJpnkf/1/5//X/9f/r3T/f73n/2/aGP3/zcH5/7vT/+/hqvv/E/r/m7H/Pz7Y7R/u/n/Pzdf/55oYtvP/x9z/ojCTTPI/AAAA5CDm/heHmcj/AAAAUBkx978kzET+BwAAgMqIuf/mMJNM8r/+v/6//r/+v/5/5/X3Pv9/+ZH+/3DR/+9O/78H5//Pq/8/4O0f7v7/oM//P/6m9tvr/9PJsPX/Y+5/aZhJJvkfAAAAchBz/y1hJvI/AAAAVEbM/S8LM5H/AQAAoDJi7t8RZpJJ/tf/1//X/9f/1//vvP7e/f+S/v9w0f/vTv+/B/1//X/9//76/x2++dX/p5Nh6//H3H9rmEkm+R8AAAByEHP/bWEm8j8AAABURsz9PxVmIv8DAABAZcTcvzPMJJP8r/+v/6//n1f//94t+v/6/9Wm/9+d/n8P+v/6//r/fZ7/f6W19P+39rozKmPY+v8x9788zCST/A8AAAA5iLn/FWEm8j8AAABURsz9rwwzkf8BAACgMmLunwozyST/6/9Xq///p3/91CsL/X/9/x7rH0T/vxYuHaL+fzwMhr7//5D+/zWl/9+d/n8P+v/6//r/G9L/Jx/D1v+Puf/2MJNM8j8AAADkIOb+O8JM5H8AAACojJj77wwzkf8BAACgMmLu3xVmkkn+1/+vVv8/0v/X/++2/o06//9YeD7Tcen8/87/vwH0/ztoepHq//eg/6//n33/P373q//PYAxb/z/m/leFmWSS/wEAACAHMfffVbT9Elf+BwAAgMpo5P5ionh1mIn8DwAAAJURc//dYSaZ5H/9/6vv/483faz/37r9+v+tcu3/b/D5/xP9/7zp/3e31v7/Fv1//X/9/8z6/+s7//9k+Fj/n2jY+v8x978mzCST/A8AAAA5iLn/njAT+R8AAAAqI/77zfLfvcr/AAAAUEUx90+HmWSS//X/nf8/p/5/Tf9/QP3/+Ij1/wv9/6Gj/9+d8//3oP+v/6//v67+v/P/027Y+v8x9782zCST/A8AAAA5iLn/vjAT+R8AAAAqI+b+mTAT+R8AAAAqI+b+2TCTTPK//r/+f079f+f/d/5//f/q0//vTv+/B/1//f+q9f+LQv+f62rY+v8x9+8OM8kk/wMAAEAOYu7fE2Yi/wMAAEBlxNy/N8xE/gcAAIDKiLn//jCTTPK//r/+v/6//r/+f+f16/9vTvr/3en/96D/r/9ftf6/8/9znQ1b/z/m/gfCTDLJ/wAAAJCDmPv3hZnI/wAAAFAZMffvDzMJ+b/Tv+sGAAAANpeY+w+EmWTy+3/9/4r0/3/z71vWrf+v/99t/YPp/0/q/4ep/z9cKtr/b39ZXDX9/x70//X/9f/1/xmoYev/x9x/MMwkk/wPAAAAOYi5/3VhJvI/AAAAVEbM/T8dZiL/AwAAQGXE3P8zYSaZ5P/B9v8n9f+bZHX+/8nW7df/73x8VKv/7/z/+v/DqaL9/4GpVP9/RP9f/3+4tl//X/+fla59/z9+1F//P+b+B8NMMsn/AAAAkIOY+382zET+BwAAgMqIuf+hMBP5HwAAACoj5v5DYSaZ5H/n/9f/d/5//f9r0/9/qGg3jP3/+sGj/18t+v/dVar/7/z/+v9Dtv36//r/rDRs5/+Puf/1YSaZ5H8AAADIQcz9D4eZyP8AAABQGTH3vyHMRP4HAACAyoi5/41hJpnkf/1//X/9f/1/5//vvH79/81J/787/f8e9P/1//X/9f8ZqGHr/8fc/6Ywk0zyPwAAAOQg5v43h5nI/wAAAFAZMfe/JcxE/gcAAIDKiLn/rWEmmeR//X/9f/1//X/9/87r1//fnPT/u9P/70H/X/9f/1//n4Eatv5/zP0/F2aSSf4HAACAHMTc/0iYifwPAAAAlRFz/9vCTOR/AAAAqIyY+98eZpJJ/tf/38T9/zH9f/1//X/9/97rzY3+f3f6/z3o/+v/6//r/zNQw9b/j7n/HWEmmeR/AAAAyEHM/T8fZiL/AwAAQGXE3P/OMBP5HwAAACoj5v5fCDPJJP/r/2/i/n8lz/+/dLH5dhXr/9cX0/+/Xv3/+o30/7Og/9+d/n8PHfr/W/X/8+r/L4V3ef1//X8GYtj6/zH3vyvMJJP8DwAAADmIuf/dYSbyPwAAAFRGzP3vCTOR/wEAAKAyYu5/NMwkk/yv/59l/z895OHr/692/v/JxnWbvP/v/P/O/6//vwGq2/9f8111pP/fg/P/6/87/7/+PwM1bP3/mPsfCzPJJP8DAABADmLuf2+YifwPAAAAlRFz/y+Gmcj/AAAAUBkx978vzCST/K//n2X/f4jP/79a/3+znv9/rCgml9eTU/9/oun5TMel/r/+/waobv9/MPT/e9D/1/8f5v5/OJonV7m9/j/DaNj6/zH3vz/MJJP8DwAAADmIuf+XwkzkfwAAAKiMmPt/OcxE/gcAAIDKiLn/V8JMMsn/+v/6//r/zv/v/P+d16//vznp/3en/9+D/r/+/zD3/3vQ/2cYDVv/P+b+Xw0zWTX4ff+/+niYAAAAwBCJuf8DYSaZ/P4fAAAAchBz/+EwE/kfAAAAKiPm/iNhJpnkf/3/9v5/PKOq/r/+v/6//r/+/2Y0uP7/y24sCv3/yvT/J/rcAP1//X/9f/1/BmrY+v8x9x8NM8kk/wMAAEAOYu7/tTAT+R8AAAAqI+b+Y2Em8j8AAABURsz9c2EmmeT/69j/Hx/O/r/z/19t///H+v/6/4H+f2f6/xvD+f+7y7b/3y/9f/1//X/9fwZq2Pr/MffPh5lkkv8BAACgwtKPg2PuPx5mIv8DAABAZcTcfyLMRP4HAACAyoi5/4NhJpnkf+f/1/93/v/r0f8fa1le/7+k/6//Pwj6/93p//eg/6//r/+v/89ADVv/P+b+hTCTTPI/AAAA5CDm/g+Fmcj/AAAAUBkx9384zET+BwAAgMqIuf9kmEkm+V//X/8/9/5/rSguOf+//n+n9ev/b076/93p//eg/6//r/+v/89ADVv/P+b+U//P3n002XVWexw+9pUVbtWty0fwmBFDGJmPwJQZVYzJJgdZ5Awm52CyyTmDyTnnbHKOJhqqRLm11pK6z+m9JfXuPnu/7/NM1m2V+p7TVlvwp+tXO27pZP8DAABAD3L33zNusf8BAACgGbn77xW32P8AAADQjNz9945bOtn/+n/9f+/9/2orz//f/fv1/+fo//X/U1jr749t/n37ReH79v93uOO1d9P/6//1/4P0//p//T97za3/z91/n7ilk/0PAAAAPcjdf9+4xf4HAACAZuTuv1/cYv8DAABAM3L3Xxu3dLL/9f/6f/2//n9X/3+T/l//v2ye/z9M/z9C/6//1//r/5nU3Pr/3P33j1s62f8AAADQg9z9D4hb7H8AAABoRu7+B8Yt9j8AAAA0I3f/g+KWTva//l//r/9fSv9/3PP/93w9+n/9/yb6/2H6/xH6f/2//l//z6Tm1v/n7n9w3NLJ/gcAAIAe5O5/SNxi/wMAAEAzcvc/NG6x/wEAAKAZufsfFrd0sv/1//p//f9S+v8jev6//l//v3A3rM7/naD/X6f/HzHS/69W+v8hF93Pb/7ylvP+96H/1/+zbm79f+7+h8ctd16tjl/uFwkAAADMSu7+R8Qtnfz8HwAAAHqQu/903GL/AwAAQDNy918Xt3Sy//X/+n/9v/5f/7/59fX/y+T5/8MO3v/f/nb3uHu//X8zz/8/u+m/uWy/nz+obb//6fv/274z9P8s29z6/9z9Z+KWTvY/AAAA9CB3/yPjFvsfAAAAmpG7/1Fxi/0PAAAAzcjd/+i4pZP9r/9vrf//n12fd0H/v1O76P/1//p//X/r9P/DPP9/xM5fc6fqw2b7/31su59f+vv3/H/9P+vm1v/n7n9M3NLJ/gcAAIAe5O5/bNxi/wMAAEAzcvc/Lm6x/wEAAKAZufsfH7d0sv/1/631/7s/z/P/9f+bXl//r/9vmf5/mP5/RCvP/7/M75pt9/MHte33r//X/7Nubv1/7v4nxC2d7H8AAADoQe7+J8Yt9j8AAAA0I3f/k+IW+x8AAACakbv/yXFLJ/tf/6//X0b/n6+g/9f/H37/n/T/y/O/+v9R+v8RrfT/l2nb/fzS37/+X//Purn1/7n7nxK3dLL/AQAAoAe5+58at9j/AAAA0Izc/U+LW+x/AAAAaEbu/qfHLZ3sf/2//n8Z/b/n/+v/Pf9f/39x9P/D9P8j9P/6f/2//p9Jza3/z91/fdzSyf4HAACAHuTuf0bcYv8DAABAM3L3PzNusf8BAACgGbn7nxW3dLL/9f/6f/2//l//v/n19f/LpP8fpv8fof/X/+v/9f9Makb9/wWfdXL17Lilk/0PAAAAPcjd/5y4xf4HAACAZuTuf27cYv8DAABAM3L3Py9u6WT/6/9n0//v5Hxt9f+nVquV/n/Vaf9/6oI/z/q+1P/r/4+A/n+Y/n+E/l//r//X/zOpGfX/Ox/n7n9+3NLJ/gcAAIAe5O5/Qdxi/wMAAEAzcve/MG6x/wEAAKAZuftfFLd0sv/1/7Pp/3e01f97/v/e74+e+n/P/1+n/z8a+v9h+v8R+n/9v/5f/8+k5tb/5+5/cdx0/KrL/hIBAACAmcnd/5K4pZOf/wMAAEAPcve/NG6x/wEAAGChrl/7ldz9L4tbOtn/+v9p+//jF/ya/l//v/f7Q/+v/9f/Hz79/zD9/wj9v/5f/6//Z1Jz6/9z9788bulk/wMAAEAPcvffELfY/wAAANCM3P2viFvsfwAAAGhG7v5Xxi2d7H/9v+f/6//1//r/za+v/18m/f8w/f8I/b/+f7v9/4nz/6f+nzZcQv9/9uzZ04fe/+fuf1Xc0sn+BwAAgCbt+Vlp7v5Xxy32PwAAADQjd/9r4hb7HwAAAJqRu/+1cUsn+1//32n/n9/qy+r/r1ut9P/6f/2//n+Y/n+Y/n+E/l//7/n/+n8mNbfn/+fuf13c0sn+BwAAgB7k7r8xbrH/AQAAoBm5+18ft9j/AAAA0Izc/W+IWzrZ//r/Tvt/z//X/+v/j7r/v3Wl/z8Si+j/T+3/+nPv/8/o//X/A7rr/+9yp10f6v/1/6ybW/+fu/+NcUsn+x8AAAB6kLv/TXGL/Q8AAADNyN3/5rjF/gcAAIBm5O5/S9x0rJP9r//X/+v/9f/6/82vf8TP/z++Wq30/xNYRP8/YO79/zTP/9/7b/l5+n/9/5Lfv/5f/8+6ufX/ufvfGrd0sv8BAACgB7n73xa32P8AAADQjNz9b49b7H8AAABoRu7+d8Qtnex//b/+X/+v/59V/3/FIfT/ZxbR/3v+/0T0/8Pm0f/vT/+v/1/y+9f/6/+5eNvq/3P3vzNu6WT/AwAAQA9y978rbrH/AQAAoBm5+98dt9j/AAAA0Izc/e+JWzrZ//p//f+l9P/5Pnvr/0/F72u1/z8xp/5/5++Zk7v+/3Xy/H/9/0T0/8P0/yP0//p//f/1+n+mNLfn/+fuf2/c0sn+BwAAgB7k7n9f3Pqfbu1/AAAAaEbu/vfHLfY/AAAANCN3/wfilk72v/5f/+/5/57/P6vn/58+hOf/6/+7ov8fpv8fof/X/+v/Pf+fSc2t/8/d/8G4pZP9DwAAAD3I3f+huMX+BwAAgGbk7v9w3GL/AwAAQDNy998Ut3Sy//X/+n/9v/5f/3/uz1D/3wb9/7Cj6f9P6f/1/9XPXxH/Fuj/9f9jn0+b5tb/5+7/SNzSyf4HAACAHuTu/2jcYv8DAABAM3L3fyxusf8BAABgkY5t+LXc/R+PWzrZ//p//b/+f8L+/8qV/n+h/f+m19f/L9NW+v/8ptD/e/5/6Kf/v3rXR9t+/v+xS3z/e//zaxv9/wXrQ/9Pk+bW/+fu/0Tc0sn+BwAAgB7k7v9k3GL/AwAAQDNy938qbrH/AQAAoBm5+z8dt/Sw//9P/7/S/x+k/z+j//f8f/2//n9uPP9/mP5/hP5/q8/PX/r79/x//T/r5tb/5+7/TNzSw/4HAACATuTu/2zcYv8DAABAM3L3fy5usf8BAACgGTu7P+OyDve//l//7/n/+n/9/+bX1/8vk/5/mP5/hP5f/6//1/8zqbn1/5/f+ayTqy/ELZ3sfwAAAOhB7v4vxi32PwAAADQjd/+X4hb7HwAAAJqRu//LcUsn+1//r/9fRv9/9uzZ0/p//f/ur+d8/3+z/p+i/x+m/x+h/9f/6//1/0xqbv1/7v6vxC2d7H8AAADoQe7+r8Yt9j8AAAA0I3f/1+IW+x8AAACakbv/63FLJ/tf/z+D/v+k/t/z//X/K8//1/9PRP8/TP8/osX+/+TFf/nb7ucPatvvX/+v/2fd3Pr/3P3fiFs62f8AAADQg9z934xb7H8AAABoRu7+b8Ut9j8AAAA0I3f/t+OWTva//v/o+v/b/tn18vz/U6vN71//r//X/+v/D5v+f5j+f0SL/f8l2HY/v/T3r//X/7Nubv1/7v7vxC27h99Vl/ZVAgAAAHOSu/+7cUsnP/8HAACAHuTu/17cYv8DAABAM3L3fz9u6WT/6/9n8Pz/Bvt/z//f/P2h/591/3+l/r8N+v9h+v8R+n/9v/5/ov4/v5v1/72bW/+fu/8HcUsn+x8AAAB6kLv/h3GL/Q8AAADNyN3/o7jF/gcAAIBm5O6/OW65YP9vartbof/X/+v/9f/6/82vr/9fJv3/sIvt/0+sDtb/J/2//l//32v/7/n/nDO3/j93/4/jFj//BwAAgMW5ap9fz93/k7jF/gcAAIBm5O7/adxi/wMAAEAzcvf/LG655cptvaUjpf/X/+v/9f/6/82vr/9fJv3/MM//H6H/n6Kfv0b/30b/v1rp/zm4ufX/uft/Hrf4+T8AAAA0I3f/L+IW+x8AAACakbv/l3GL/Q8AAADNyN3/q7ilk/2v/9f/H7D/30kz9f/n6P/P0f9vpv8/Gvr/Yfr/Efp/z//X/3v+P5OaW/+fu//XcUsn+x8AAAB6kLv/N3GL/Q8AAADNyN3/27jF/gcAAIBm5O7/XdzSyf6ftP+/MSrsi+n/4x+1/n/x/b/n/+v/9f/6/1nR/w/T/4/Q/+v/9f/6fyY1t/4/d//v45ZO9j8AAAD0IHf/H+IW+x8AAACakbv/j3GL/Q8AAADNyN3/p7ilk/3v+f/6f/2//l//v/n19f/LpP8fpv/frP6g9P/6f/2//p9Jza3/z93/57ilk/0PAAAAPcjd/5e4xf4HAACAZuTuvyVusf8BAACgGbn7/xq3dLL/9f/6f/2//l//v/n19f/LNKv+/5j+/8LPvev/j7+s5/9vvf/Pt6D/1//r/5nE3Pr/3P1/i1s62f8AAADQg9z9f49b7H8AAABoRu7+f8Qt9j8AAAA0I3f/P+OWTvb/SP9/on6j/n+Q/n/3+9f/b/7+0P/r//X/h29W/b/n/y/m+f9F/+/5//p//T+Tmlv/n7v/X3FLJ/sfAAAAepC7/9a4xf4HAACAZuTu/3fcYv8DAABAM3L3/ydu6WT/e/7/kvr/a/T/+n/9v/5f/z9C/z9M/z9C/6//v4T3f/Wej/X/+n/Wza3/z93/3wAAAP//tmNCRw==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000240)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0)
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, 0x0)

3m48.843431434s ago: executing program 1 (id=1608):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000001509010000000000b500f8ffffff000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000a36c00850000001700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

3m48.476358641s ago: executing program 1 (id=1614):
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mkdir(&(0x7f00000003c0)='./file0\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
syz_mount_image$fuse(0x0, &(0x7f0000000380)='./file1\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1000000, 0x0, 0x0, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000b80), 0x200008, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})

3m48.350579255s ago: executing program 34 (id=1614):
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mkdir(&(0x7f00000003c0)='./file0\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
syz_mount_image$fuse(0x0, &(0x7f0000000380)='./file1\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1000000, 0x0, 0x0, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000b80), 0x200008, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})

3m13.796102651s ago: executing program 4 (id=2061):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfffffffffffffeff, 0x9, &(0x7f0000000100))
openat$mice(0xffffffffffffff9c, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x161141)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x356}, &(0x7f00000008c0)=<r3=>0x0, &(0x7f0000000500)=<r4=>0x0)
syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1})
io_uring_enter(r2, 0x70a, 0x41e3, 0x0, 0x0, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
connect$inet6(r5, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc85eb51b0ace6a", "4617a9f6040839230fb7fead776dd8dc", "3f4051c4", "a44a889722b66244"}, 0x28)
recvmmsg(r5, &(0x7f0000003d40)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000400)=""/247, 0xf7}], 0x1}, 0x3}], 0x1, 0x40010020, 0x0)
r6 = userfaultfd(0x801)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000a, 0x5d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x400000, 0x3, 0x2})
ioctl$BTRFS_IOC_LOGICAL_INO(0xffffffffffffffff, 0xc0389424, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)

3m12.921935838s ago: executing program 4 (id=2069):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x14008850}, 0x40000)
read$alg(r1, &(0x7f0000000000)=""/35, 0x23)
sendmsg$nl_generic(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x4000090)

3m12.326634987s ago: executing program 4 (id=2072):
r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)={0x3c, r0, 0x1, 0xffffffff, 0x0, {0x37}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400c001}, 0x0)

3m12.247633427s ago: executing program 4 (id=2074):
syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x20, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000200)='proc\x00', 0x16, 0x0)
chroot(&(0x7f0000000100)='./file0\x00')
mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00')

3m12.247073147s ago: executing program 4 (id=2076):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20)

3m11.896637073s ago: executing program 4 (id=2080):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffffff7}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94)

3m11.708500385s ago: executing program 35 (id=2080):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffffff7}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94)

3.466679886s ago: executing program 6 (id=4565):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xc}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0)

3.431353526s ago: executing program 6 (id=4567):
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000000), r1)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x8000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000004000000020000000000000f0400000000005f"], 0x0, 0x28}, 0x20)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r5, 0x0, 0x1}, 0x48)
getsockopt$IP_VS_SO_GET_TIMEOUT(r4, 0x0, 0xf, 0x0, &(0x7f0000000640))
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r7, &(0x7f00000005c0)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000001000372429bd7000fcdbdf2500efff00", @ANYRES32=r8, @ANYBLOB="890c040000000000180012800b000100697036746e6c000008000280040013"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x1, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r8}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x20008050)

2.47330362s ago: executing program 6 (id=4572):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
unshare(0x2a020400)
poll(&(0x7f0000000080)=[{r0, 0x429}], 0x1, 0xe)

2.35913262s ago: executing program 6 (id=4576):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [<r2=>0x0]}, &(0x7f0000000240)=0x8)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@sack_info={r2, 0x9, 0x5}, &(0x7f00000000c0)=0xc)

1.967761751s ago: executing program 5 (id=4578):
syz_mount_image$jfs(&(0x7f0000000080), &(0x7f00000000c0)='./bus\x00', 0x0, &(0x7f0000001000)=ANY=[], 0xfd, 0x620a, &(0x7f0000000300)="$eJzs3c9vHGf9B/DP7C//yLep1UPVb4SQm5YfpTSJkxICBdoe4MClB5QjKJHrVhEpoCSgtLKIK184cOIvACFxRIgj4sAf0ANXbpw4EclGAvXEoLGfJ5nd7NZ2be+sPa+X5Mx85pm1n9n3zv7IzOwTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEB89zvfWyki4sbP0oKliP+LbkQnYqGqlyNiYXkpr9+LiOdipzmejYj+XER1+51/no54NSI+Ohuxtb2+Wi2+vM9+fPsPf/vtD8689dff9y/+54/3uq9NWu/+/V/++08PDrfNAAAA0DZlWZZF+ph/Ln2+7zTdKQBgKvLrf5nk5ae+/tU/3vrzLPVHrVar1eop1HXleA/qRURs1G9TvWdwOB4ATpiN+LjpLtAg+bdaLyLONN0JYKYVTXeAY7G1vb5apHyL+uvB8m57PhdkKP+N4tH1HZOmexk9x2Raj6/N6MYzE/qzMKU+zJKcf2c0/xu77YO03nHnPy2T8h/sXvrUOjn/7mj+I05P/p2x+bdVzr93oPy78gcAAAAAgBmW//9/qeHjv3OH35R9+aTjv8tT6gMAAAAAAAAAHLXDjv/3iPH/AAAAYGZVn9Urvz77eNmk72Krll8vIp4aWR9omXSxzGLT/QAAAAAAAAAAAACANuntnsN7vYjoR8RTi4tlWVY/daP1QR329idd27cf2qEYu7TpJ3kAANj10dmRa/mLiPmIuJ6+66+/uLhYlvMLi+ViuTCX388O5ubLhdrn2jytls0N9vE2uTcoq182X7td3V6fl/dqH/191d8alN19dOyI9NO9OaG5obABINl9NdryinTKlOXTk958wBD7/ym0FEtNP66YfU0/TAEAAIDjV5ZlWaSv8z6Xjvl3mu4UADAV+fV/9LjAoerOhPaIo/n9arVarVarP1VdV473oF5ExEb9NtV7BsPxA8AJsxEfN90FGiT/VutFxHNNdwKYaUXTHeBYbG2vrxYp36L+epDGd8/nggzlv1Hs3C7fftx0L6PnmEzr8bUZ3XhmQn+enVIfZknOvzOa/43d9kFa77jzn5ZJ+Q92Lplrn5x/dzT/Eacn/87Y/Nsq5987UP5d+QMAAAAAwAzL//+/5Phv3mQAAAAAAAAAOHG2ttdX83Wv+fj/Z8as5/rP0ynnXxw0/4U0L/8TLeffGcn/iyPrdWvzD998vP//a3t99Xf3/vn/ebrf/OfyTJEeWUV6RBTpLxW9ND3M1j1ps98dVH+pX3S6vXTOT/moM5eG1u2k+6PsvxO34nasxcpQe9XT/lD75aH23hPtV4ba++l7B8qF3H4hVuPHcTve3mkfDN/tY83vcf+Ue7Tn/Lue/1sp59+r/VT5L6b2YmRaefhh54n9vj4d93feuPXZX1w6/s3Z02Z0H21bXbV95xvoz859cmYQP727dufC/Zv37t1ZiTQZWno50uSI5fz7Oz9zj5//X9htz09A9f314YeDA+c/KzajNzH/F2rz1fa+NOW+NSHnP0g/Of+3U/v4/f8k5z95/3+5gf4AAAAAAAAAAAAAAADAJynLcucS0Tci4mq6/qepazMBgOnKr/9lkperj7z+/pmIWeqPWq1Wq1tY15XjvV4vIuIv9dtU7xl+Pu6XAQCz7L8R8femO0Fj5N9i+fv+qumLTXcGmKq773/ww5u3b6/dudt0TwAAAAAAAACATyuP/7lcG//5xYhYGllvaPzXN2P5sON/9vLMowFGj3ig7wk2O4Nupzbc+POxMz73hd3xt58c//t8PDn+dx4Tt1vfjgn6e7QP9mif26N9fuzSx2mNvdCjJuf/fG288yr/cyPDr7dh/NfRMe/bIOd/vvZ4rvL/wsh69fzL38xc/hv7XXEzOkP5X7z33k8u3n3/g1duvXfz3bV31350ZWXl0pWrV69du3bxnVu31y7t/ns8vZ4BOf889rXzQNsl558zl3+75Pw/l2r5t0vO//Opln+75Pzz+z35t0vOP3/2kX+75PxfSrX82yXn/6VUy79dtrbX56r8X061/Nsl7/9fTrX82yXn/0qq5d8uOf8LqZZ/u+T8L6Z6H/n7evhTJOefj3DZ/9sl57+Savm3S87/cqrl3y45/yupln+75PxfTbX82yXn/5VUy79dcv5XUy3/dsn5fzXV8m+XnP+1VMu/XXL+X0u1/Nsl5//1VMu/XXL+r6Va/u2S8/9GquXfLjn/b6Za/u2S8/9WquXfLjn/11Mt/3Z5/P3/ZsyYMZNnmn5mAgAAAAAAAAAAAABGTeN04qa3EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4H/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgp79xoj11nfD/zM3rx2CDEQgpO/gY1jjHGW7PoSX/jXxYR7gFIgodALtutdmwXf8NolUCSbBkokjIoqqqYv2gJCbaSqwqp4QStK86Lq5VVpX9A3FVUlpEZVQAEVqa1otppznufxzOzszK53vD57zucj2b/dmXPmXOY5Z+a3u985AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAre594+znGlmWNf/l/23Oshc0v944sTm/7XW3eg0BAACA1frf/P/n7kg3HFnGTC3T/O0r/uEbCwsLC9kHhn9n9EsLC+mOiSwb3ZBl+X3RtX/7YKN1muDxbLwx1PL9UJ/FD/e5f6TP/aN97h/rc/+GPveP97l/0Q5YZGPx85j8wbbnX24udml2Zzaa37e9y1yPNzYMDcWf5eQa+TwLoyezuex0NptNt01fTNvIp//Wvc1lvS2LyxpqWdbW5gj50adOxHVohH28vW1Z1x8z+sEbsokf/+hTJ/7o4rN3d6t9d0Pb4xXruXNbcz0/E24p1rWRbUj7JK7nUMt6bu3ynAy3rWcjn6/5ded6PrfM9Ry+vpprqvM5H8+G8q+/k++nkdYf66X9tDXc9l/3ZVl25fpqd06zaFnZULap7Zah68/PeDEim4/RHEovzkZWNE7vXcY4bdaZ7e3jtPOYiM//vWG+kSXWofVp+sGnxxY97ysdp1Fzq5c6VjrH4KCPlbKMwTguvpNv9BNdx+D2sP2f2rH0GOw6drqMwbTdLWNwW78xODQ2nK9zehIa+TzXx+DutumH8yU18vrMjt5jcOrimfNT85/45Gvnzhw/NXtq9uze3bun9+7ff/DgwamTc6dnp4v/b3Bvl9+mbCgdA9vCvovHwKs7pm0dqgtfGdxxON7jONzcMe2gj8ORzo1rrM0BuXhMF8fGI82dPn51KFviGMufn12rPw7TdrcchyMtx2HX15Qux+HIMo7D5jTndy3vPctIy79u63CzXgs2t4zBzvcjnWNw0O9HyjIGx8O4+JddS78WbA3r+8TkSt+PDC8ag2lzw7mneUt6vz9+MC/dxuU9zTtuG8suzc9eeOCx4xcvXtidhbImXtIyVjrH66aWbcoWjdehFY/XI3OveOKeLrdvDvtq/LXN/8aXfK6a0+x7oPdzlb+6dd+fbbfuyUIZsLXen91ezZv7M/WSPfZnc5rPTK3+vXjqS1vOv6NLnH9j3/98sbz0UI8Pj44Ux+9w2jujbefj9qdqJD93NfJlPze1vPPxaPi31ufjO3ucj7d0TDvo8/Fo58bF83Gj3087Vqfz+RwP4+T0dO/zcXOaLXtWOiZHep6P7wu1Efb/a0KnkPqilrGz1LhNyxoZGQ3bNRKX0D5O97ZNPxp6s+ayntpzY+N0533FYw2nrbturcbpRMe0gx6n6Xy11Dht9Pvp243pfD7Hw7i4c2/vcdqc5ul9qz93boxftpw7x/qNwdHhseY6j6ZBWJzvFzbGMfhAdiI7l53OZvJ7x/Lx1MiXNfng8sbgWPi31ufKLT3G4M6OaQc9BtPr2FJjrzGyeOMHoPP5HA/j4skHe4/B5jRvOjDY9647wy1pmpb3rp0/X1vqZ173dOymm/kzr+Z6/vWB3j+bbU5z+uBK+8ze++n+cMttxU1jrfup8/hd6piaydZmP20J6/nswaX3U3N9mtN86dAyx9ORLMsuf+yh/Oe94fcrf3bpu99o+71Lt9/pXP7YQz+8/eTfrGT9AVj/ni/KpuK1ruU3U8v5/T8AAACwLsS+fyjURP8PAAAAlRH7/vhX4Yn+HwAAACoj9v0joSY16f+3vOnZuecvZymZvxDE+9NueLiYLmZcp8P3EwvXNW9/6GuzP/mLy8tb9lCWZT99+Ne7Tr/l4bhehYmwntfe3H774hkvL2v5xx69Pl1rfv3L4fHj9ix3GHSL4E5nWfatO76QL2fig1fz+vTDx/L63itPPN6c5rlDxfdx/mdeUkz/+yH8e+Tk8bb5nwn74fuhTr+j+/6I83396mu2Hnj/9eXF+RrbXphv9pMfKh43fk7OFx8vpo/7ean1/8vPP/X15vSPvar7+l8e6r7+T4XH/Vqo//3yYvrW56D5fZzvs2H94/LifA989dtd1//a54rpz7+lmO5YqHH5O8P329/y7Fzr/nqscbxtu7K3FtPF5U9/97fy++PjxcfvXP/xo1fb9kfn+Hj6n4rHmeqYPt4elxP9ecfym4/TOj7j8p/6zWNt+7nf8q+995mXNx+3c/n3d0w33DF/5yc2/cFnv9B1eXF9jvzp+bbtOfKecByH5T/5oTAew/3/c+0LbcuNjr2n/fwTp//y5stt2xO97cfF8q+9/lRe/33iJ7932wtuf+GVVzb3XZZ9533F4/Vb/qk/PNe2/l+5a1f+fMT7Y0a/c/lLicu/8PHJs+fmL83NtOzV/LNz3lmsz4bxjZua63tHOLd2fn/03MUPz16YmJ6YzrKJ6n6E3g37aqg/LMqVlc6/69HwfN7zu9/atOMfPx9v/+dHituvvqN43Xp1mO6L4fbNxfO30Fjl8p+89678+G48XXzflmMfgK3b/+PgsiYM29/5viCO9/Mv/XC+H5r35a8b8bhe5fp/b6Z4nG+G/boQPpl5213Xl9c6ffxshKvvK473Ve+/cJqLz+sfh+f7Xd8vHj+uV9ze74X3Md/e0n6+i+Pjm5eHOh8//xSPK+F8kl0p7o9Txf199bm7uq5e/ByS7Mrd+fe/nR7n7hVt5lLmPzE/dXru7KXHpi7Ozl+cmv/EJ4+eOXfp7MWj+Wd5Hv1Iv/mvn5825eenmdn9+7LpjVmWncum1+CENfD1Tx8ItLz1P//oiZkD0ztmZk8ev3Ty4qPnZy+cOjE/f2J2Zn7H8ZMnZz/eb/65mcO79xzae2DP5Km5mcMHDx3ae2hy7uy55m4sVqqP/dMfnTx74Wg+y/zhfYd2P/jgvunJM+dmZg8fmJ6evNRv/vy1abI5969NXpg9ffzi3JnZyfm5T84e3n1o//49fT8N8Mz5k/MTUxcunZ26ND97YarYlomL+c3N175+81NN8/9avJ/t1Cg+iC979/370+ezNn3t00s+VDFJxweIPhs+i+bvX3T+4HK+j33/aKhJTfp/AAAAqIPY94+Fmuj/AQAAoDJi378h1ET/DwAAAJUR+/7xUJOa9P/y//L/y8v/F/fL/9cr/3/+Y0WudL3n/2N+Xv6/Hm5x/n/Vy5f/l/+vXv6/+dU6zf+vcP3l/+X/Waxs+f/Y92/Mslr2/wAAAFAHse/fFGqi/wcAAIDKiH3/baEm+n8AAACojNj3vyDUpCb9v/z/svL/e/oFrqqf/3f9f/n/bH3m/+OTI/9fGyvO37//kbZv5f8D+X/5f/l/+X/5f1ZtdMl7blX+P/b9t4ea1KT/BwAAgDqIff8LQ030/wAAAFAZse+/I9RE/w8AAACVEfv+zaEmNen/5f9d/1/+X/6/0vn/1V7/v2Vl5P/XB9f/723F+f8N8v/Ly/+Py/+vx/z/6GDXv9z5/76rL//PTVG26//Hvv9FoSY16f8BAACgDmLf/+JQE/0/AAAAVEbs+18SaqL/BwAAgMqIff+doSY16f/l/+X/65z/f6r4AFD5f/n/rsvvf/3/4iv5/3KR/+/N9f/7cP3/euX/B7z+5c7/D/r6/6Nv7pxf/p9uypb/j33/S0NNatL/AwAAQB3Evv+uUBP9PwAAAFRG7PtfFmqi/wcAAIDKiH3/llCTmvT/8v/y/3XO/0fy//L/3ZbfP/9fkP8vF/n/3uT/+5D/l/+X/19e/r/Lm1/5f7opW/4/9v13h5rUpP8HAACAOoh9/z2hJvp/AAAAqIzY9/+/UBP9PwAAAFRG7Pu3hprUpP+X/5f/l/+vV/7//jH5f/n/aqtm/n9wb0rk//uQ/5f/L2v+f+H59oOxi7W9/v9iK8n/b+j3YFRG2fL/se9/eaiFLSN16f8BAACgDmLf/4pQE/0/AAAAVEbs+18ZaqL/BwAAgMqIff9EqElN+n/5/2rl///kr558ZSb/L//fZ/kVzf/HYSD/X3PVzP8Pjvx/H/L/8v9lzf+X7fr/Xbj+P92ULf8f+/57Q01q0v8DAABAHcS+f1uoif4fAAAAKiP2/feFmuj/AQAAoDJi37891KQm/b/8f7Xy/5H8v/x/r+VXNP+fyP/Xm/x/Fy0Hqfx/H/L/8v+1z//Hd7/y/wxG2fL/se9/VahJTfp/AAAAqIPY9+8INdH/AwAAQGXEvv/VoSb6fwAAAKiM2PfvDDWpSf8v/y//L/8v/y//33358v/rk/x/byvN/4/J/8v/y//XLP/v+v8MVtny/7Hvf02oSU36fwAAAKiD2PfvCjXR/wMAAEBlxL/fLP7uVf8PAAAAVRT7/slQk5r0//L/8v91yv835P/l/+X/K0/+vzfX/+9D/l/+X/5/cf5/Q99Nz8n/003Z8v+x739tqElN+n8AAACog9j3PxBqov8HAACAyoh9/1Soif4fAAAAKiP2/dOhJjXp/+X/5f/rlP8v//X/23Oi8v8F+X/5/5WQ/+9N/r8P+X/5/6rl/7PM9f+5pcqW/499/+5Qk5r0/wAAAFAHse/fE2qi/wcAAIDKiH3/3lAT/T8AAABURuz794Wa1KT/l/+vav5/IZP/X4/5f9f/l/+X/18t+f/e5P/7kP+X/69a/n8Q1/+X/2cVypb/j33/g6EmNen/AQAAoA5i378/1ET/DwAAAJUR+/4DoSah/+/2d90AAADA+hL7/oOhJjX5/b/8f0Xy/7/xd23Ldv1/+f9eyx9M/n+j/H+o8v/lUtH8f+dhccPk//uQ/5f/l/+X/2egypb/j33/oVCTmvT/AAAAUAex739dqIn+HwAAACoj9v3/P9RE/w8AAACVEfv+nwk1qUn/L/9fkfx/B/l/+f9ey3f9f/n/Kqto/n9gKpX/H5L/l/8v1/rL/8v/s9jNz//Hr5aX/499/+FQk5r0/wAAAFAHse//2VAT/T8AAABURuz7Xx9qov8HAACAyoh9/5FQk5r0//L/8v/y//L/Nyf///qsUxnz/83BI/9fLfL/vVUq/+/6//L/JVt/+X/5fxYr2/X/Y9//hlCTmvT/AAAAUAex738o1ET/DwAAAJUR+/43hpro/wEAAKAyYt//plCTmvT/8v/y//L/8v+u/999+fL/65P8f2/y/33I/8v/y//L/zNQZcv/x77/zaEmNen/AQAAoA5i3/+WUBP9PwAAAFRG7PvfGmqi/wcAAIDKiH3/20JNatL/y//L/8v/y//L/3dfvvz/+iT/35v8fx/y//L/8v/y/wxU2fL/se9/e6hJTfp/AAAAqIPY9z8caqL/BwAAgMqIff87Qk30/wAAAFAZse9/Z6hJTfp/+X/5f/l/+X/5/+7Ll/9fn+T/e5P/70P+X/5f/l/+n4EqW/4/9v3vCjWpSf8PAAAAdRD7/p8LNdH/AwAAQGXEvv/doSb6fwAAAKiM2Pf/fKhJTfp/+X/5/3Ll/xcut84n/y//nw0q/9+caXn5/7H4OPL/65P8f2/y/310yf9vkP+X/5f/l//nhpUt/x/7/veEmtSk/wcAAIA6iH3/e0NN9P8AAABQGbHvf1+oif4fAAAAKiP2/Y+EmtSk/5f/r2X+P21y+fL/rv8v/+/6//L/qyP/35v8fx+u/y//L/8v/89AlS3/H/v+R0MNfjzgl1sAAADgFop9//tDTWry+38AAACog9j3/0Koif4fAAAAKiP2/R8INalJ/39D+f8YepX/T9ZZ/r/E1/+vWv5/pG181Cn/P97yfKZxKf8v/78G5P97k//vQ/5f/r/M+f8wmjcuMb/8P2VUtvx/7Ps/GGpSk/4fAAAA6iD2/b8YaqL/BwAAgPVgfjkTxb7/l0JN9P8AAABQGbHv/+VQk5r0/67/L/8v/9+a/3+76/+7/r/8/zon/9+b/H8f8v/y/2XO//ch/08ZlS3/H/v+Xwk1WbLx++F/LmMzAQAAgBKJff+HQk1q8vt/AAAAqIPY9x8NNdH/AwAAQGXEvv9YqElN+n/5/878f7yiqvx/PfP/g77+f/v4kP+X/5f/v/kGl/9/2e1ZJv8v/y//L/+/lvn/Ifl/Kqds+f/Y9x8PNalJ/w8AAAB1EPv+Xw010f8DAABAZcS+/0Soif4fAAAAKiP2/TOhJlXs/ztDtbc2/z9azvy/6//faP7/p/L/Vcv/X87k/+X/1yHX/+9N/r8P+X/5f9f/X3X+vzlO5f+Jypb/j33/bKhJFft/AAAAqJf04+DY958MNdH/AwAAQGXEvv9UqIn+HwAAACoj9v0fDjWpSf/v+v/y/67/fyvy/yNt05c0/1/m6//ns8j/y/93I//fm/x/H/L/8v/y/67/z0CVLf8f+/65UJOa9P8AAABQB7Hv/0ioif4fAAAAKiP2/R8NNdH/AwAAQGXEvv90qElN+n/5f/n/uuf/G1l2xfX/113+Pyf/L//fjfx/b/L/fcj/y//L/8v/83/s3UePnfd1x/ErRWIBAiQvIeusskxWykvIJovsAmStVKXbluTebbnK3ZZ7773Jvffe5d6rXGUDNEiec8iZuXwuybkz93n+5/PZnJAQPTPSUMHPxNf/rZpb/5+7/8a4pcn+BwAAgA5y9/9z3GL/AwAAwDBy9/9L3GL/AwAAwDBy9/9r3NJk/+v/9f/d+//VTt7/3/vX6//P0//r/7fhQH9/3fq/7lJR+CX7/7/665v+Uf+v/9f/T9L/6//1/+w3t/4/d/+/xS1N9j8AAAB0kLv/3+MW+x8AAACGkbv/P+IW+x8AAACGkbv/prilyf7X/+v/9f/6/z39/536f/3/snn/f5r+fwP9v/5f/6//Z6vm1v/n7v/PuKXJ/gcAAIAOcvf/V9xi/wMAAMAwcvf/d9xi/wMAAMAwcvf/T9zSZP/r//X/+v+l9P8nvP+/7+vR/+v/19H/T9P/b6D/1//r//X/bNXc+v/c/f8btzTZ/wAAANBB7v7/i1vsfwAAABhG7v7/j1vsfwAAABhG7v57xS1N9r/+X/+v/19K/39M7//r//X/C3fH6sK/E467/z+xhf/9Af3/vPv/1Ur/P+Wy+/n1X95yPv9L0P/r/zlobv1/7v57xy1/u1qduNovEgAAAJiV3P33iVua/Pk/AAAAdJC7/+a4xf4HAACAYeTuvyVuabL/9f/6/6vr/89/v+j/9f/6f/3/3Hj/f9rh+/+//PMb/6lv/+/9/2ne/992/3/2O0P/z7LNrf/P3X9r3NJk/wMAAEAHufvvG7fY/wAAADCM3P33i1vsfwAAABhG7v77xy1N9r/+f7T+/0/2/LqL+v9ztYv3//X/+n/9/+j0/9O8/7/BuX/Nna4f6v/1/97/1/9zOHPr/3P3PyBuabL/AQAAoIPc/Q+MW+x/AAAAGEbu/gfFLfY/AAAADCN3/4Pjlib7X/8/Wv+/99cd3fv/+n/9v/5f/z9P+v9p+v8NRnn//yq/a3bdzx/Wrj9//b/+n4Pm1v/n7n9I3NJk/wMAAEAHufsfGrfY/wAAADCM3P0Pi1vsfwAAABhG7v6Hxy1N9r/+X/+/jP4/P4L+X/9/9P1/0v8vk/5/mv5/g1H6/6u0635+6Z+//l//z0Fz6/9z9z8ibmmy/wEAAKCD3P2PjFvsfwAAABhG7v5HxS32PwAAAAwjd/+j45Ym+1//r/9fRv/v/X/9v/f/9f+XR/8/Tf+/gf5f/6//1/+zVXPr/3P33xa3NNn/AAAA0EHu/sfELfY/AAAADCN3/2PjFvsfAAAAhpG7/3FxS5P9r//X/+v/9f/6//UfX/+/TPr/afr/DfT/+n/9v/6frZpR/3/Rrzq1enzc0mT/AwAAQAe5+58Qt9j/AAAAMIzc/U+MW+x/AAAAGEbu/tvjlib7X/8/m/7/XM43Vv9/erVa6f9XTfv/0xf986zvS/2//v8Y6P+n6f83OPsb8sw1+n/9v/5f/8+WHG//f/bf+dP/ewC5+58UtzTZ/wAAANBB7v4nxy32PwAAAAwjd/9T4hb7HwAAAIaRu/+pcUuT/a//n03/f85Y/b/3//d/f3Tq/73/f5D+/3jo/6fp/zfw/v+h+/lrV/p//b/+nwuOt//f/OPc/U+Lm05cf9VfIgAAADAzufufHrc0+fN/AAAA6CB3/zPiFvsfAAAAFuq2Az+Tu/+ZcUuT/a//327/f+Kin9P/6//3f3/o//X/+v+jp/+fpv/fQP/v/X/9v/6frZpb/5+7/1lxS5P9DwAAAB3k7r8jbrH/AQAAYBi5+58dt9j/AAAAMIzc/c+JW5rsf/2/9//1//p//f/6j6//Xyb9/zT9/wb6f/3/bvv/kxf+z6Pt/0+v+fX6f47CFfT/Z86cufnI+//c/c+NW5rsfwAAAOggd//z4hb7HwAAAIaRu//5cYv9DwAAAMPI3f+CuKXJ/tf/N+3/81t9Wf3/LauV/l//r//X/0/T/0/T/2+g/9f/e/9f/89Wze39/9z9L4xbmux/AAAA6CB3/4viFvsfAAAAhpG7/8Vxi/0PAAAAw8jd/5K4pcn+1/837f+9/6//1/8fd/9/z0r/fywW0f+ve3g7zL3/v1X/r/+f0K7//7u/2fND/b/+n4Pm1v/n7n9p3NJk/wMAAEAHuftfFrfY/wAAADCM3P0vj1vsfwAAABhG7v5XxE3XNdn/+n/9v/5f/6//X//xj/n9/xOr1Ur/vwWL6P8nzL3/3877//t/l1+g/9f/L/nz1//r/zlobv1/7v5Xxi1N9j8AAAB0kLv/VXGL/Q8AAADDyN3/6rjF/gcAAIBh5O5/TdzSZP/r//X/+n/9//D9/62L6P+9/78l+v9p8+j/L03/r/9f8uev/9f/c/l21f/n7n9t3NJk/wMAAEAHuftfF7fY/wAAADCM3P2vj1vsfwAAABhG7v43xC1N9r/+X/9/Jf1/fp76/7H6/5Oz6/9P7fnPa/L+v/5/S/T/0/T/G+j/9f/6/9v0/2zT3N7/z93/xrilyf4HAACADnL3vylu/Ve39j8AAAAMI3f/m+MW+x8AAACGkbv/LXFLk/2v/9f/e/9f/z/8+//6/1b0/9P0/xvo//X/+n/v/7NVc+v/c/e/NW5psv8BAACgg9z9b4tb7H8AAAAYRu7+t8ct9j8AAAAMI3f/nXFLk/2v/9f/6//1//r/8/8M9f9j0P9PO57+/7T+X/9f/fw18btA/6//3/TrGdPc+v/c/e+IW5rsfwAAAOggd/874xb7HwAAAIaRu/9dcYv9DwAAAIt03Zqfy93/7rilyf7X/+v/9f/6f/3/+o+v/1+mnfT/+U2h//f+f+jT///Fnh8t7f3//f//S/+v/2f75tb/5+5/T9zSZP8DAABAB7n73xu32P8AAAAwjNz974tb7H8AAAAYRu7+98ctTfa//l//r//X/0/0/6vV7dfo/4P+fxm8/z9N/7+B/n+n7+cv/fPX/+v/OWhu/X/u/g/ELU32PwAAAHSQu/+DcYv9DwAAAMPI3f+huMX+BwAAgGGc2/0ZlzXc//p//b/+X//v/f/1H1//v0z6/2n6/w30//p//b/+n62aW///4XO/6tTqI3FLk/0PAAAAHeTu/2jcYv8DAADAMHL3fyxusf8BAABgGLn7Px63NNn/+n/9/zL6/zNnztys/9f/7/16LvT/d+n/Kfr/afr/DfT/+n/9v/6frZpb/5+7/xNxS5P9DwAAAB3k7v9k3GL/AwAAwDBy938qbrH/AQAAYBi5+z8dtzTZ//r/GfT/p/T/3v/X/6+8/6//3xL9/zT9/wYj9v+nLv/L33U/f1i7/vz1//p/Dppb/5+7/zNxS5P9DwAAAB3k7v9s3GL/AwAAwDBy938ubrH/AQAAYBi5+z8ftzTZ//r/4+v/z/696/L+/+nV+s9f/6//1//r/4+a/n+a/n+DEfv/K7Drfn7pn7/+X//PQXPr/3P3fyFu2Tv8rr+yrxIAAACYk9z9X4xbmvz5PwAAAHSQu/9LcYv9DwAAAMPI3f/luKXJ/tf/z+D9/wH7f+//r//+0P/Puv+/Vv8/Bv3/NP3/Bvp//b/+f0v9f3436/+7m1v/n7v/K3FLk/0PAAAAHeTu/2rcYv8DAADAMHL3fy1usf8BAABgGLn774pbLtr/69ruUej/9f/6f/2//n/9x9f/L5P+f9rl9v8nV4fr/5P+X/+v/+/a/3v/n/Pm1v/n7v963OLP/wEAAGBxrr/Ez+fu/0bcYv8DAADAMHL3fzNusf8BAABgGLn7vxW33H3trj6lY6X/1//r//X/+v/1H1//v0z6/2ne/99A/7+Nfv4G/f8Y/f9qpf/n8ObW/+fu/3bc4s//AQAAYBi5+78Tt9j/AAAAMIzc/d+NW+x/AAAAGEbu/u/FLU32v/5f/3/I/v9cmqn/P2/c/j//E/T/2+z///Siv6v6/+3R/0/T/2+g//f+v/7f+/9s1dz6/9z9349bmux/AAAA6CB3/w/iFvsfAAAAhpG7/4dxi/0PAAAAw8jd/6O4pcn+31n/H3+r9f+L7/+9/3/k/f/Zr27X/X/S/3v/f/70/9P0/xvo//X/jfr/v9/3Y/0/R2Fu/X/u/h/HLU32PwAAAHSQu/8ncYv9DwAAAMPI3f/TuMX+BwAAgGHk7v9Z3NJk/3v/X/+v/597/z+H9//T1vv/1Ur/r//fMv3/NP3/evUPSv+v/2/U/++n/+cozK3/z93/87ilyf4HAACADnL3/yJusf8BAABgGLn7745b7H8AAAAYRu7+X8YtTfa//l//r//X/3v/f/3H1/8vk/5/2i77/3/4s80f1vv/O+//81PQ/+v/9f9sxdz6/9z9v4pbmux/AAAA6CB3/6/jFvsfAAAAhpG7/zdxi/0PAAAAw8jd/9u4pcn+39D/n6y/UP8/Sf+/9/PX/6///tD/6//1/0dP/z9tuv+/6Hdzs/f/i/7f+//6f/0/WzW3/j93/+/ilib7HwAAADrI3X9P3GL/AwAAwDBy9/8+brH/AQAAYBi5+/8QtzTZ/97/X1L/f4P+X/+v/9f/6/830P9P2+X7/5dD/6//X/Lnr//X/3PQ3Pr/3P1/DAAA//9PIEvU")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
symlinkat(&(0x7f0000001040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00')

1.653367928s ago: executing program 5 (id=4579):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000001140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2e0da70e67a330d}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x50}, 0x1, 0x0, 0x0, 0x4030}, 0x8000)

1.59708069s ago: executing program 5 (id=4580):
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
socket$can_bcm(0x1d, 0x2, 0x2)
socket$inet_udp(0x2, 0x2, 0x0)
socket$packet(0x11, 0x2, 0x300)
socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$packet(0x11, 0x3, 0x300)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001340))
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4)
socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, 0x0}}], 0x1, 0x0)

1.545458527s ago: executing program 5 (id=4581):
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40081271, &(0x7f0000000980)=0x4000)
mount(&(0x7f0000000100)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='jfs\x00', 0x2208004, 0x0)

1.544803663s ago: executing program 5 (id=4582):
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff})
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0x0, 0x0, 0x0, 0x3133245c, 0x0, 0x0, 0x41000, 0x30, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x5, 0xd, 0x1, 0xb8}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0)
ioctl$TCSETS(r1, 0x5402, &(0x7f00000001c0)={0x401, 0x0, 0x10000, 0xb998, 0x0, "194f2f83c2e798c3584770116cddc8819592b1"})
write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000000080)={0xa04c, 0x35e8b531, 0x1, 0x8, 0x13, "53af0f0b4ecf6c29bf81c173f4a8f5f73eb62f"})

1.490300914s ago: executing program 6 (id=4583):
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0x9}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000)
syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
syz_usb_connect(0x2, 0x36, &(0x7f0000000a40)={{0x12, 0x1, 0x0, 0xef, 0x96, 0xb, 0x40, 0x13b1, 0x42, 0x5103, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x93, 0x0, 0x2, 0x17, 0xc5, 0x5a, 0x0, [], [{{0x9, 0x5, 0x2, 0x3, 0x200, 0xff, 0x2, 0x2}}, {{0x9, 0x5, 0x1, 0x0, 0x8, 0x7f, 0x29, 0x6}}]}}]}}]}}, 0x0)
epoll_create1(0x0)

672.833617ms ago: executing program 5 (id=4592):
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001002fe70009046b00016a93f000090588aeff"], 0x0)

234.076213ms ago: executing program 3 (id=4598):
syz_mount_image$msdos(&(0x7f0000000080), &(0x7f0000000a80)='./file1\x00', 0x2800810, &(0x7f00000025c0)=ANY=[@ANYBLOB="646f74732c747a3d5554432c646f74732c646f74732c6e6f646f74732c666c7573682c646f74732c6e6f646f74732c71756965742c00b3d27234e95eb4b44190021bbbe89ab824d38c571641668d362b4dff6e47bdf1638c7462a3bd66a53b404ae08c32af6843a2469c7210381b9d48047c77540b6447a8e50c44cb44f91e4264a37e0209c3a234f4803ba56b7a24536ee396f4838f4143b92ad909efb23eb22dce6477c2bb5b8f793b9e07c2120d566cf1f6ba51e4d01e8ef223a2ba72cfb3127844c045765149fb1219f433feb977426596e07082254e9930296256df143ff96377d8c28c533724fbd9fdad260e7d875d0f17374141abc60c8e3c07e4a7bc381791172c217f00964aaf6e213a252b9689ae38342862d27437921e13229d407e1a6037e3f16a2cdab8f9c76a66a72ccc67015c9435e200f9fbb9d78ce426b37310b9f127e7b1207c74eff7b853de7043a001de85931463c7fc7c78be9eb9b5f88c0067aabb3a5d1f94bcc90537c1c1ce509450160c"], 0x3, 0x15d, &(0x7f0000000f00)="$eJzs27+KE1EUB+AzJmrUJrVYDNhYBbWyVCSCOKAoKbRSiDaJBEwzWgWfxNaHEyRVCuGKzpLshoRl/8zO7ub7mhz4ccM9xZ3LGZj3dz6PhpPpp8mreXSyLNqPI49FFt24Eq2ozAIAuEwWKcXvlFK6PosbPyKl1PSOAIC6uf8BYPccev8/amhjAEBtzP8AsHvevH334klR9F/neSfi16wclIPqt8qfPS/69/P/uqtV87IctJb5gyrPD+ZX4+Ze/nBjfi3u3a3yf9nTl8VafiuG9bcPAAAAO6GXL22c73u9bXlV7Xs/sDa/t+N2+8zaAACOYPr12+jDePzxi0JxQYs/KaVjLP/+szoC56SL0y2yiDjZ/zT9ZALqtjr0Te8EAAAAAAAAAAAAAADYpt6vkVpNtwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb/Q0AAP//LjxONw==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105042, 0x40)
ioctl$FAT_IOCTL_SET_ATTRIBUTES(r0, 0x40047211, 0x0)

190.731937ms ago: executing program 6 (id=4599):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000001400)=0x7)
syz_mount_image$xfs(&(0x7f0000000040), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000080)={[{@gqnoenforce}, {@uquota}, {@sysvgroups}, {@inode64}, {@gqnoenforce}]}, 0x1, 0xb919, &(0x7f0000001440)="$eJzs3Xts3WX9wPGnXdutkMH4hY7LT2RMBgxkW7dBKQTXdqyjXCqXgR0wobICk47LKLhxLSEkoGIA44WYRYl4jRLFQSQKDiPKxWGMAeIfRALGgMmif4EaQ82355zSHkqzPuV5mrHXK1nP+X5PP08v7/N8T1jITk/nuR0h1IWSwVDtpbe2PvHFdZ1P/vxL929/+K4XHimdbZtVfritfNtevu0Iw4sNn64tnar7+rZHa4uD2tHr7tXYWLNPCJdWrdNSurmpufJ5Q1XKp+dVHq8dOaz5fOnPiL2LD79vW9cbQpgzar4mhLDkPT/oHqqnfXVn+XcSRnWbUX645t3Hhm/rSn9WPBfCiu3hfZ8f06r4Pud0zv74wdP9jewOetpXd1X1byt3rinvx7bqPbgnqn6ev/7QojvLv8Lh59s0JpySnvbOM8IE+/i4/160YKh03awPITSEEGaGEGZNdw8+GO0dy4rX7NrKcTl7Zf/PGe95ceTS1/8dQphbvIyXrhel1wJg99LesWzlOPu/YaL933rHtjftf9j9dbV3LCv2etX+nzXR/t/QuvbF0r5vaylNvTO9PwQAAAAAMK7rttx4ZW9/f98md9xxx52RO9N9ZQJSe3fTT/d3AgAAAAAAAAAAAOyqHP878XT/jAAAAAAAAAAAAADwYdHV3b5zRs2YUzNGHxyyo2/4dvnbPVd8756h9ZXb8sOnj7PkmPf5HxoaGmrduaLyXuwzq94ve1b1cLH+YN3bz5QP26rff7B++Gx9uOSyDf19S4ovtbI+bC4Omot1O+vDvcXB0uJgdX34fnGwbPigMWwvDhZdenX/+uLEqZG/sQ+Xru7BMGNMsTDm2TC6/2D9/O2V2wmWrKxWF8r999//vE1Vj1WM3//d9dvf733J+WBMrv+izZXbCZZ8z/4/6I01vxzvsffvP7J+h/5pjXP9H9Oo+rpfdf2fN86SI/NzX3rmiqL/Y0/etaZ8qm5Xrv+j1l9Z3X948ZHrf7HUKZXrf/HasmpKv4w9UFf37Tsn2v8T96+rvK7XjpodWe2Mk15oLfrvs3Dbn8qn6ifZ/5SJ9n/NvPdcT5ikru4Hh6r2/yT6hyPGWXKkyddePu25ov9PnlnTNOqxyfRfVd1/8cDGaxZft+XGYzds7L287/K+q1qWLD/h+OaW5c2Lh68IpY9T+53sSaa2/4ff/3/0TE0IC0bmFxz/zgVF/7nf7uwpn5o1yf6dE+7/S8Z+r4wyvzY0NITNvQMDm5pLHyuHS0sfS582Tv9JvP5/7KjypzWWb2tCOHBkvuWApgOL/k0zVn2kfKphkv1XT9h/cOTrEmmK+3991cyY/oPPP/izov/8H55f+TuFyb7+nzpR/9pv2f9T1dVd9Rc+H7Ci/1/rFp4YOd7lv//SytH/V/svODdy/DT908rR/4b/P2wgcvx0/dOK61/71K5+ZtG/cfnJt0/6S5ScoX9aOfb/9pNavxs5fqb+aeXo/41jjvtD5Hi3/mnl6H/O4c1vRI5/Uv+0cvT/2/9tuTBy/Cz908rRf/Eht9wcOX62/mnl6D8w+9qmyPFz9E8rR/8naq9fGjl+rv5p5ej/62M3/C5yfI3+aeXov/f8ja9Gjp+nf1o5+p+1tPfuyPHz9U8rR/8HTu57OHL8U/qnlaP/xQc/elnkeI/+aeXo/9Wmn7ZHjq/VP60c/XfUP3FU5PgF+qeVo3/dXo/vGzl+of5p5eh/04Lv/Cdy/CL908rR/5GjH3wlcnyd/mnl6P/miT/eFjn+af3TytF/3nE/+HLk+MX6p5Wj/zWH/fHlyPFL9E8rR//HF734z8jxXv3TytH/tU/8+YHI8c/on1aO/sc0v/Jk5Pil+qeVo/+ajz413r8TtCvW659Wov4NlTtF/637Pd0fuU6f/mnl2P+/rXm2PnL8Mv3TytF/3312zI8cv1z/tHL0f3bhIX+PHL9C/7Ry9A9HHLQjcnyD/mnl6H/h8U0PRY5/Vv+0cvS/v3W/OyLHr9Q/rRz9d86dfUPkeL/+aeXof/hBjWdHjm/UP60c/W9rrD8hcvwq/dPK0f+xhppDI8ev1j+tHP1rl3T9KHL8Gv3TytH/+RVnfiFy/Fr900raf+9S/3sXt78WucIm/dPKsf/Xzlv1dOT4dfqnlaP/Efuujf0X2Qf0TytH/3+EdQdEjl+vf1o5+m+bc/atkeM36J9Wjv63HHre2sjxz7301taZQf9kcvT/xQl33hc5vtn+TytH/00ttz8WOb5F/7Ry9F945D1/iRy/Uf+0cvR/9ai7/xU5fpP+aeXo/82ZX5kdOX6z/mnl6H/+rPuOjhy/Rf+0cvSffeDWlZHjt+qfVo7+vznggfWR47fpDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP/YgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsHcnYJfOhf/Hz6x2SVmLZC/ZZUlh0KC0WJPsu6yhrIWokC0pJNkjSrKUhLRbslSWSkqRNtJKyfK/xswzMT7jpy7/1Hxer+uaOds9Z77n+z7f85x57ufcAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAc2+jseutOhiMnHDpoKfdftuDp1x55KZjr7rs6OOuvuCwGy8af+0qU0+4eZXHJzF44s5WGXfb8PGbjDzxkrOHj7sw/Mn3O+000wybcTBs6zyq/Tf7P4Y9z9CZ4RMvDjti/K+Jpnvib59pywsHg8FM/8f91dpozBpjx03e+F8Tu42YcPOE6yeeHzn+14qbDwYrbjKY7PPj+ffoBmPXeb7H8L9gozFrrDVJ/8GEzk90n3R9t5r0eT7i0E2GPa/hniMbjRm79rjWk1vH++x99BPPgcFg5GmDwcjTB4ORZwwGI898vnvw3Biz6tKrjnvNH7o8vvpBQ28I0uv7sIffdMm4rxmjxn+dGHnW0NcC4H/LmFWXXi2s/9FDt6f1f88jd29o/cP/vrXGrLr04Env88dfe9DQv+/j+l9privufP5GDAAAAPyrHrv/8qsm7OsbPhjMPZhkf+8TJnxfYNiFV9988/M20P8OYT/Z039m4n/MuM5TnzfPYLDrBs/3UHgeTBH7sfm36d9N/276d9O/m/7d9O+mfzf9u+nfTf9u+nfTv5v+xSaz/3+modMDRly6+oRNF7jl+J3Wn/TPj7tu6v/4qJ83U+r+/8GOw8a3HNd8x8Fg8OYx666/8GAwWH+n42+ZdzDxtuXH3bbizCMmHCBg4Sd+f/1k7njo0+RPHKxh2on3ceET97/W46ePGDbJIJ5km8ePOmeHjR5aZtLTBSf/OCYeX+K6N9x+wtBnWYZPstHknqtD9z/0WCbtPGHsC48b++J77bL74nvuu9+iO+6y5fbbbr/trsstsczyyy653DJLLr7djjtvu8T43yc3Z+MPXbHas5mz0ZPO2f1jnjxnkz62yc3ZPM88Z0/c4w7X3Dbr0JyN/BfnbLVnnrN5dhwa6yqjBls8MTfj/srVRw32GXdhyanGPYUmbDv7uG1fO/PwweDYfz7QceemmvgcHHbQjs/BcUsmnI6ZcLpqPG7JpZM7bslg60nuZ4XxJ3tdObTdpJ+znnD1sz5uyUpjD1lo3Fqc5M////Bvff1/Wq/lh02cqKGDhkzYZnyvfx5nYmjaVnnScSaWS8eSeS49bbzzDJ/4vE7jnfC5uGGTzP8zfS5usPA9W5w//nGtstz4P/XYvx0lv3as/c/ZC57y2jF45teOEf88+89rt71hrklfO944+SE+ZV0MzdFUk2w0udeOax4aedC4+x8a82ReO9beccIHjf/52jHur11t6LVj3NjHjhocO+7CUuMurDFqcO64C0s/cWGawdXjLiy29W47bzPuijWf/rxdeNhTfuAxPG/HTvK8fRbHx1n5usFg5avT45r8dGbpeTv6GcabP889eMbPcy90+CPrDQaDWcd/lR73IMeP/d+Rxjvymccbjj8xeKbjTwxWWP781Z7j8U5cZ0881yYcLmrNyfyZp6yzmZ62zg4e8aSV8Wzf12wTth9/fvaJ93bx6dcfNDRHoya536mf/nbgKX/f0GNJ/Yfe8z3Z8NMGw55pbtZ4NnMz4zPPzbN9/7LwfONvn+YZ5mb2WWZbbmhuRj99bqKh+19jMnPz5PfDTzbsoME0T52bkU+8B55/wtyMfTZzM/1z87yZNmw//vwCE6/a+LFlFxiamzAX8ev/0P2P/VfnZouJz5v5n7ht3uGD0aMH+2y51157LDn+96GLS43//ZnX4OrPZi6nfm7mcs4JrzrDnz45E69a4cYV136GNRgN3f/q/+pczjMYPvRv7h3j6n5O+P5PN/276d9N/276d9O/m/7d9C82mf3/8wx9X3CRGxa+ecI3Y0Zde/6G2zzf432eTdH7/yf0fcr+/202PP/a4YOJtz3j/tnx2/xX7p9dbvzJ/ksObTfp/sEJVz/r/bNXHHPZJv+h/bP/lqG1+iy+b+j1v5v+3fTvpn83/bvp303/bvp307+b/t3076Z/N/276V9sMvv/lxj6OYDH7tvrrgk7QkdtNWaOf/tzVlOIKXr//4S+T9n/f/UcY7YaPph42zPu/x+/Tcf+/z3uuPeQ/+b9/0Nr1f5//g/6d9O/m/7d9O+mfzf9u+nfTf9u+nfTv5v+3fTvpn+xyez/X2Xo5wB2fuzWB4Z+HuCmk1fd7fke7/NsSt3/7///7+X1v5v+3fTvpn83/bvp303/bvp307+b/t3076Z/N/276V9swv7/wST/7eFbPS+isP//f9tk+q+jf9TSf139o5b+6+kftfRfX/+opf8G+j/9//cu6r+h/lFL/7fpH7X030j/qKX/2/WPWvpvrH/U0v8d+kct/TfRP2rpv6n+UUv/zfSPWvpvrn/U0n8L/aOW/lvqH7X030r/qKX/1vpHLf230T9q6b+t/tFT+08BMzSZ/tvpH7Ws/+31j1r676B/1NJ/R/2jlv7v1D9q6b+T/lFL/531j1r676J/1NJ/V/2jlv676R+19N9d/6il/7v0j1r676F/1NJ/T/2jlv576R+19H+3/lFL//foH7X031v/qKX/PvpHLf331T9q6b+f/lFL//31j1r6H6B/1NL/vfpHLf3fp3/U0v9A/aOW/gfpH7X0P1j/qKX/+/WPWvofon/U0v9Q/aOW/h/QP2rp/0H9o5b+H9I/aul/mP7RFNh/kPofrn80BfaP6/8I/aOW/h/WP2rpf6T+UUv/o/SPWvofrX/U0v8Y/aOW/sc+rf80/9Fh/bdq6f8R6z9q6X+c/lFL/4/qH7X0P17/qKX/x/SPWvp/XP+opf8J+kct/U/UP2rpf5L+UUv/T+gftfQ/Wf+opf8n9Y9a+p+if9TS/1P6Ry39T9U/aul/mv5RS//T9Y9a+p+hf9TS/0z9o5b+Z+kftfQ/W/+opf+n9Y9a+p+jf9TS/1z9o5b+n9E/aul/nv5RS//z9Y9a+n9W/6il/+f0j1r6X6B/1NL/8/pHLf0v1D9q6f8F/aOW/hfpH7X0v1j/qKX/JfpHLf0v1T9q6f9F/aOW/l/SP2rpf5n+UUv/L+sftfS/XP+opf9X9I9a+l+hf9TS/0r9o5b+V+kftfT/qv5RS/+r9Y9a+n9N/6il/9f1j1r6f0P/qKX/N/WPWvp/S/+opf+39Y9a+n9H/6il/zX6Ry39r9U/aul/nf5RS//r9Y9a+n9X/6il/w36Ry39b9Q/aul/k/5RS/+b9Y9a+n9P/6il//f1j1r6/0D/qKX/LfpHLf1v1T9q6X+b/lFL/9v1j1r6/1D/qKX/j/SPWvr/WP+opf8d+kct/X+if9TS/079o5b+P9U/aun/M/2jlv536R+19P+5/lFL/1/oH7X0v1v/qKX/PfpHLf1/qX/U0v9e/aOW/r/SP2rp/2v9o5b+v9E/aun/W/2jlv6/0z9q6X+f/lFL//v1j1r6/17/qKX/A/pHLf3/oH/U0v+P+kct/f+kf9TS/8/6Ry39/6J/1NL/r/pHLf0f1D9q6f+Q/lFL/7/pH7X0/7v+UUv/h/WPWvr/Q/+opf8j+kct/R/VP2rp/5j+UUv/x/WPSvoPG+gftfQfpn/U0n+4/lFL/xH6Ry39R+oftfQfpX/U0n+0/lFL/6n0j1r6T61/1NJ/msn0H/WfGtd/qZb+01r/UUv/6fSPWvpPr3/U0n8G/aOW/jPqH7X0f4H+UUv/mfSPWvq/UP+opf/M+kct/V+kf9TS/8X6Ry39Z9E/auk/q/5RS//Z9I9a+s+uf9TSfw79o5b+c+oftfR/if5RS/+X6h+19J9L/6il/9z6Ry39X6Z/1NJ/Hv2jlv4v1z9q6T+v/lFL//n0j1r6z69/1NJ/Af2jlv4L6h+19F9I/6il/8L6Ry39X6F/1NL/lfpHLf0X0T9q6f8q/aOW/ovqH7X0X0z/qKX/4vpHLf2X0D9q6b+k/lFL/6X0j1r6L61/1NJ/Gf2jlv6v1j9q6b+s/lFL/+X0j1r6L69/1NJ/Bf2jlv6v0T9q6b+i/lFL/9fqH7X0f53+UUv/lfSPWvqvrH/U0n8V/aOW/mP0j1r6r6p/1NJ/Nf2jlv6r6x+19H+9/lFL/7H6Ry3919A/aum/pv5RS/+19I9a+r9B/6il/xv1j1r6r61/1NL/TfpHLf3frH/U0v8t+kct/d+qf9TSfx39o5b+6+oftfRfT/+opf/6+kct/TfQP2rpv6H+UUv/t+kftfTfSP+opf/b9Y9a+m+sf9TS/x36Ry39N9E/aum/qf5RS//N9I9a+m+uf9TSfwv9o5b+W+oftfTfSv+opf/W+kct/bfRP2rpv63+UUv/7fSPWvpvr3/U0n8H/aOW/jvqH7X0f6f+UUv/nfSPWvrvrH/U0n8X/aOW/rvqH7X0303/qKX/7vpHLf3fpX/U0n8P/aOW/nvqH7X030v/qKX/u/WPWvq/R/+opf/e+kct/ffRP2rpv6/+UUv//fSPWvrvr3/U0v8A/aOW/u/VP2rp/z79o5b+B+oftfQ/SP+opf/B+kct/d+vf9TS/xD9o5b+h9b0f3y8A5/d1i39P1DT/1/T0v+D+kct/T+kf9TS/zD9o5b+h+sftfQ/Qv+opf+H9Y9a+h+pf9TS/yj9o5b+R+sftfQ/Rv+opf+x+kct/T+if9TS/zj9o5b+H9U/aul/vP5RS/+P6R+19P+4/lFL/xP0j6bc/sOffO2wE/WPptz+T13/J+kftfT/hP5RS/+T9Y9a+n9S/6il/yn6Ry39P6V/1NL/VP2jlv6n6R+19D9d/6il/xn6Ry39z9Q/aul/lv5RS/+z9Y9a+n9a/6il/zn6Ry39z9U/aun/Gf2jlv7n6R+19D9f/6il/2f1j1r6f07/qKX/BfpHLf0/r3/U0v9C/aOW/l/QP2rpf5H+UUv/i/WPWvpfon/U0v9S/aOW/l/UP2rp/yX9o5b+l+kftfT/sv5RS//L9Y9a+n9F/6il/xX6Ry39r9Q/aul/lf5RS/+v6h+19L9a/6il/9f0j1r6f13/qKX/N/SPWvp/U/+opf+39I9a+n9b/6il/3f0j1r6X6N/1NL/Wv2jlv7X6R+19L9e/6il/3f1j1r636B/1NL/Rv2jlv436R+19L9Z/6il//f0j1r6f1//qKX/D/SPWvrfon/U0v9W/aOW/rfpH7X0v13/qKX/D/WPWvr/SP+opf+P9Y9a+t+hf9TS/yf6Ry3979Q/aun/U/2jlv4/0z9q6X+X/lFL/5/rH7X0/4X+UUv/u/WPWvrfo3/U0v+X+kct/e/VP2rp/yv9o5b+v9Y/aun/G/2jlv6/1T9q6f87/aOW/vfpH7X0v1//qKX/7/WPWvo/oH/U0v8P+kct/f+of9TS/0/6Ry39/6x/1NL/L/pHLf3/qn/U0v9B/aOW/g/pH7X0/5v+UUv/v+sftfR/WP+opf8/9I9a+j+if9TS/1H9o5b+j+kftfR/XP+opP8TZ/V/upb+w/SPpsT+j48Yf/bJ/YfrH02J/dP6H6F/1NJ/pP5RS/9R+kct/UfrH7X0n0r/qKX/1PpHLf2n0T9q6T+t/lFL/+n0j1r6T69/1NJ/Bv2jlv4z6h+19H+B/lFL/5n0j1r6v1D/qKX/zPpHLf1fpH/U0v/F+kct/WfRP2rpP6v+UUv/2fSPWvrPrn/U0n8O/aOW/nPqH7X0f4n+UUv/l+oftfSfS/+opf/c+kct/V+mf9TSfx79o5b+L9c/auk/r/5RS//59I9a+s+vf9TSfwH9o5b+C+oftfRfSP+opf/C+kct/V+hf9TS/5X6Ry39F9E/aun/Kv2jlv6L6h+19F9M/6il/+L6Ry39l9A/aum/pP5RS/+l9I9a+i+tf9TSfxn9o5b+r9Y/aum/rP5RS//l9I9a+i+vf9TSf4X2/sPz1S39X9PefzJa+q+of9TS/7X6Ry39X6d/1NJ/Jf2jlv4r6x+19F9F/6il/xj9o5b+q+oftfRfTf+opf/q+kct/V+vf9TSf6z+UUv/NfSPWvqvqX/U0n8t/aOW/m/QP2rp/0b9o5b+a+sftfR/k/5RS/836x+19H+L/lFL/7fqH7X0X0f/qKX/uvpHLf3X0z9q6b++/lFL/w30j1r6b6h/1NL/bfpHLf030j9q6f92/aOW/hvr/2QnzTDhTEv/d+gftfTfRP+opf+m+kct/TfTP2rpv7n+UUv/LfSPWvpvqX/U0n8r/aOW/lvrH7X030b/qKX/tvpHLf230z9q6b+9/lFL/x30j1r676h/1NL/nfpHLf130j9q6b+z/lFL/130j1r676p/1NJ/N/2jlv676x+19H+X/lFL/z30j1r676l/1NJ/L/2jlv7v1j9q6f8e/aOW/nvrH7X030f/qKX/vvpHLf330z9q6b+//lFL/wP0j1r6v1f/qKX/+/SPWvofqH/U0v8g/aOW/gfrH7X0f7/+UUv/Q/SPWvofqn/U0v8D+kct/T+of9TS/0P6Ry39D9M/aul/uP5RS/8j9I9a+n9Y/6il/5H6Ry39j9I/aul/tP5RS/9j9I9a+h+rf9TS/yP6Ry39j9M/aun/Uf2jlv7H6x+19P+Y/lFL/4/rH7X0P0H/qKX/ifpHLf1P0j9q6f8J/aOW/ifrH7X0/6T+UUv/U/SPWvp/Sv+opf+p+kct/U/TP2rpf7r+UUv/M/SPWvqfqX/U0v8s/aOW/mfrH7X0/7T+UUv/c/SPWvqfq3/U0v8z+kct/c/TP2rpf77+UUv/z+oftfT/nP5RS/8L9I9a+n9e/6il/4X6Ry39v6B/1NL/Iv2jlv4X6x+19L9E/6il/6X6Ry39v6h/1NL/S/pHLf0v0z9q6f9l/aOW/pfrH7X0/4r+UUv/K/SPWvpfqX/U0v8q/aOW/l/VP2rpf7X+UUv/r+kftfT/uv5RS/9v6B+19P+m/lFL/2/pH7X0/7b+UUv/7+gftfS/Rv+opf+1+kct/a/TP2rpf73+UUv/7+oftfS/Qf+opf+N+kct/W/SP2rpf7P+UUv/7+kftfT/vv5RS/8f6B+19L9F/6il/636Ry39b9M/aul/u/5RS/8f6h+19P+R/lFL/x/rH7X0v0P/qKX/T/SPWvrfqX/U0v+n+kct/X+mf9TS/y79o5b+P9c/aun/C/2jlv536x+19L9H/6il/y/1j1r636t/1NL/V/pHLf1/rX/U0v83+kct/X+rf9TS/3f6Ry3979M/aul/v/5RS//f6x+19H9A/6il/x/0j1r6/1H/qKX/n/SPWvr/Wf+opf9f9I9a+v9V/6il/4P6Ry39H9I/aun/N/2jlv5/1z9q6f+w/lFL/3/oH7X0f0T/qKX/o/pHLf0f0z9q6f+4/lFJ/xED/aOW/sP0j1r6D9c/auk/Qv+opf9I/aOW/qP0j1r6j9Y/auk/lf5RS/+p9Y9a+k+jf9TSf1r9o5b+0+kftfSfXv+opf8M+kct/WfUP2rp/wL9o5b+M+kftfR/of5RS/+Z9Y9a+r9I/6il/4v1j1r6z6J/1NJ/Vv2jlv6z6R+19J9d/6il/xz6Ry3959Q/aun/Ev2jlv4v1T9q6T+X/lFL/7n1j1r6v0z/qKX/PPpHLf1frn/U0n9e/aOW/vPpH7X0n1//qKX/AvpHLf0X1D9q6b+Q/lFL/4X1j1r6v0L/qKX/K/WPWvovon/U0v9V+kct/RfVP2rpv5j+UUv/xfWPWvovoX9yYEv/Jcf3n+r5GtZ/q5b+S1n/UUv/pfWPWvovo3/U0v/V+kct/ZfVP2rpv5z+UUv/5fWPWvqvoH/U0v81+kct/VfUP2rp/1r9o5b+r9M/aum/kv5RS/+V9Y9a+q+if9TSf4z+UUv/VfWPWvqvpn/U0n91/aOW/q/XP2rpP1b/qKX/GvpHLf3X1D9q6b+W/lFL/zfoH7X0f6P+UUv/tfWPWvq/Sf+opf+b9Y9a+r9F/6il/1v1j1r6r6N/1NJ/Xf2jlv7r6R+19F9f/6il/wZD/R9/nsb1X6ql/4bWf9TS/236Ry39N9I/aun/dv2jlv4b6x+19H+H/lFL/030j1r6b6p/1NJ/M/2jlv6b6x+19N9C/6il/5b6Ry39t9I/aum/tf5RS/9t9I9a+m+rf9TSfzv9o5b+2+sftfTfQf+opf+O+kct/d+pf9TSfyf9o5b+O+sftfTfRf+opf+u+kct/XfTP2rpv7v+UUv/d+kftfTfQ/+opf+e+kct/ffSP2rp/279o5b+79E/aum/t/5RS/999I9a+u+rf9TSfz/9o5b+++sftfQ/QP+opf979Y9a+r9P/6il/4H6Ry39D9I/aul/sP5RS//36x+19D9E/6il/6H6Ry39P6B/1NL/g/pHLf0/pH/U0v8w/aOW/ofrH7X0P0L/qKX/h/WPWvofqX/U0v8o/aOW/kfrH7X0P0b/qKX/sfpHLf0/on/U0v84/aOW/h/VP2rpf7z+UUv/j+kftfT/uP5RS/8T9I9a+p+of9TS/yT9o5b+n9A/aul/sv5RS/9P6h+19D9F/6il/6f0j1r6n6p/1NL/NP2jlv6n6x+19D9D/6il/5n6Ry39z9I/aul/tv5RS/9P6x+19D9H/6il/7n6Ry39P6N/1NL/PP2jlv7n6x+19P+s/lFL/8/pH7X0v0D/aHz/ERMuTbn9P69/1LL+L9Q/aun/Bf2jlv4X6R+19L9Y/6il/yX6P8WCM4w/bel/qf5RS/8v6h+19P+S/lFL/8v0j1r6f1n/qKX/5fpHLf2/on/U0v8K/aOW/lfqH7X0v0r/qKX/V/WPWvpfrX/U0v9r+kct/b+uf9TS/xv6Ry39v6l/1NL/W/pHLf2/rX/U0v87+kct/a/RP2rpf63+UUv/6/R/mtFF/a/XP2rp/139o5b+N+gftfS/Uf+opf9N+kct/W/WP2rp/z39o5b+39c/aun/A/2jlv636B+19L9V/6il/236Ry39b9c/aun/Q/2jlv4/0j9q6f9j/aOW/nfoH7X0/4n+UUv/O/WPWvr/VP+opf/P9I9a+t+lf9TS/+f6Ry39f6F/1NL/bv2jlv736B+19P+l/lFL/3v1j1r6/0r/qKX/r/WPWvr/Rv+opf9v9Y9a+v9O/6il/336Ry3979c/aun/e/2jlv4P6B+19P+D/lFL/z/qH7X0/5P+UUv/P+sftfT/i/5RS/+/6h+19H9Q/6il/0P6Ry39/6Z/1NL/7/pHLf0f1j9q6f8P/aOW/o/oH7X0f1T/qKX/Y/pHLf0f1z8q6T9yoH/U0n+Y/lFL/+H6Ry39R+gftfQfqX/U0n+U/lFL/9H6Ry39p9I/auk/tf5RS/9p9I9a+k+rf9TSfzr9o5b+0+sftfSfQf+opf+M+kct/V+gf9TSfyb9o5b+L9Q/auk/s/5RS/8X6R+19H+x/lFL/1n0j1r6z6p/1NJ/Nv2jlv6z6x+19J9D/6il/5z6Ry39X6J/1NL/pfpHLf3n0j9q6T+3/lFL/5fpH7X0n0f/qKX/y/WPWvrPq3/U0n8+/aOW/vPrH7X0X0D/qKX/gvpHLf0X0j9q6b+w/lFL/1foH7X0f6X+UUv/RfSPWvq/Sv+opf+i+kct/RfTP2rpv7j+UUv/JfSPWvovqX/U0n8p/aOW/kvrH7X0X0b/qKX/q/WPWvovq3/U0n85/aOW/svrH7X0X0H/qKX/a/SPWvqvqH/U0v+1+kdP7j/V8z2Y58Jk+r9O/6hl/a+kf9TSf2X9o5b+q+gftfQfo3/U0n9V/aOW/qvpH7X0X13/qKX/6/WPWvqP1T9q6b+G/lFL/zX1j1r6r6V/1NL/DfpHLf3fqH/U0n9t/aOW/m/SP2rp/2b9o5b+b9E/aun/Vv2jlv7r6B+19F9X/6il/3r6Ry3919c/aum/gf5RS/8N9Y9a+r9N/6il/0b6Ry39365/NIX3H/pI68iN9Y+m8P5DRr5D/6il/yb6Ry39N9U/aum/mf5RS//N9Y9a+m+hf9TSf0v9o5b+W+kftfTfWv+opf82+kct/bfVP2rpv53+UUv/7fWPWvrvoH/U0n9H/aOW/u/UP2rpv5P+UUv/nfWPWvrvon/U0n9X/aOW/rvpH7X0313/qKX/u/SPWvrvoX/U0n9P/aOW/nvpH7X0f7f+UUv/9+gftfTfW/+opf8++kct/fet73/xsunalv771ffPWvrvr3/U0v8A/aOW/u/VP2rp/z79o5b+B+oftfQ/SP+opf/B+kct/d+vf9TS/xD9o5b+h+oftfT/gP5RS/8P6h+19P+Q/lFL/8P0j1r6H65/1NL/CP2jlv4f1j9q6X+k/lFL/6P0j1r6H61/1NL/GP2jlv7H6h+19P+I/lFL/+P0j1r6f1T/qKX/8fpHLf0/pn/U0v/j+kct/U/QP2rpf6L+UUv/k/SPWvp/Qv+opf/J+kct/T+pf9TS/xT9o5b+n9I/aul/qv5RS//T9I9a+p+uf9TS/wz9o5b+Z+oftfQ/S/+opf/Z+kct/T+tf9TS/xz9o5b+5+oftfT/jP5RS//z9I9a+p+vf9TS/7P6Ry39P6d/1NL/Av2jlv6f1z9q6X+h/lFL/y/oH7X0v0j/qKX/xfpHLf0v0T9q6X+p/lFL/y/qH7X0/5L+UUv/y/SPWvp/Wf+opf/l+kct/b+if9TS/wr9o5b+V+oftfS/Sv+opf9X9Y9a+l+tf9TS/2v6Ry39v65/1NL/G/pHLf2/qX/U0v9b+kct/b+tf9TS/zv6Ry39r9E/aul/rf5RS//r9I9a+l+vf9TS/7v6Ry39b9A/aul/o/5RS/+b9I9a+t+sf9TS/3v6Ry39v69/1NL/B/pHLf1v0T9q6X+r/lFL/9v0j1r6365/1NL/h/pHLf1/pH/U0v/H+kct/e/QP2rp/xP9o5b+d+oftfT/qf5RS/+f6R+19L9L/6il/8/1j1r6/0L/qKX/3fpHLf3v0T9q6f9L/aOW/vfqH7X0/5X+UUv/X+sftfT/jf5RS//f6h+19P+d/lFL//v0j1r6369/1NL/9/pHLf0f0D9q6f8H/aOW/n/UP2rp/yf9o5b+f9Y/aun/F/2jlv5/1T9q6f+g/lFL/4f0j1r6/03/qKX/3/WPWvo/rH/U0v8f+kct/R/RP2rp/6j+UUv/x/SPWvo/rn9U0n/UQP+opf8w/aOW/sP1j1r6j6jpP/xf2rql/8ia/v+alv6j9I9a+o/WP2rpP5X+UUv/qfWPWvpPo3/U0n9a/aOW/tPpH7X0n17/qKX/DPpHLf1n1D9q6f8C/aOW/jPpH7X0f6H+UUv/mfWPWvq/SP+opf+L9Y9a+s+if9TSf1b9o5b+s+kftfSfXf+opf8c+kct/efUP2rp/xL9o5b+L9U/auk/l/5RS/+59Y9a+r9M/6il/zz6Ry39X65/1NJ/Xv2jlv7z6R+19J9f/6il/wL6Ry39F9Q/aum/kP5RS/+F9Y9a+r9C/6il/yv1j1r6L6J/1NL/VfpHLf0X1T9q6b+Y/lFL/8X1j1r6L6F/1NJ/Sf2jlv5L6R+19F9a/6il/zL6RxP7jxoMBlNw/1frH7Ws/2X1j1r6L6d/1NJ/ef2jlv4r6B+19H+N/lFL/xX1j1r6v1b/qKX/6/SPWvqvpH/U0n9l/aOW/qvoH7X0H6N/1NJ/Vf2jlv6r6R+19F9d/6il/+v1j1r6j9U/aum/hv5RS/819Y9a+q+lf9TS/w36Ry3936h/1NJ/bf2jlv5v0j9q6f9m/aOW/m/RP2rp/1b9o5b+6+gftfRfV/+opf96+kct/dfXP2rpv4H+UUv/DfWPWvq/Tf+opf9G+kct/d+uf9TSf2P9o5b+79A/aum/if5RS/9N9Y9a+m+mf9TSf3P9o5b+W+gftfTfUv+opf9W+kct/bfWP2rpv43+UUv/bfWPWvpvp3/U0n97/aOW/jvoH7X031H/qKX/O/WPWvrvpH/U0n9n/aOW/rvoH7X031X/qKX/bvpHLf131z9q6f8u/aOW/nvoH7X031P/qKX/XvpHLf3frX/U0v89+kct/ffWP2rpv4/+UUv/ffWPWvrvp3/U0n9//aOW/gfoH7X0f6/+UUv/9+kftfQ/UP+opf9B+kct/Q/WP2rp/379o5b+h+gftfQ/VP+opf8H9I9a+n9Q/6il/4f0j1r6H6Z/1NL/cP2jlv5H6B+19P+w/lFL/yP1j1r6H6V/1NL/aP2jlv7H6B+19D9W/6il/0f0j1r6H6d/1NL/o/pHLf2P1z9q6f8x/aOW/h/XP2rpf4L+UUv/E/WPWvqfpH/U0v8T+kct/U/WP2rp/0n9o5b+p+gftfT/lP5RS/9T9Y9a+p+mf9TS/3T9o5b+Z+gftfQ/U/+opf9Z+kct/c/WP2rp/2n9o5b+5+gftfQ/V/+opf9n9I9a+p+nf9TS/3z9o5b+n9U/aun/Of2jlv4X6B+19P+8/lFL/wv1j1r6f0H/qKX/RfpHLf0v1j9q6X+J/lFL/0v1j1r6f1H/qKX/l/SPWvpfpn/U0v/L+kct/S/XP2rp/xX9o5b+V+gftfS/Uv+opf9V+kct/b+qf9TS/2r9o5b+X9M/aun/df2jlv7f0D9q6f9N/aOW/t/SP2rp/239o5b+39E/aul/jf5RS/9r9Y9a+l+nf9TS/3r9o5b+39U/aul/g/5RS/8b9Y9a+t+kf9TS/2b9o5b+39M/aun/ff2jlv4/0D96Sv/nezDPhcn0v0X/qGX936p/1NL/Nv2jlv636x+19P+h/lFL/x/pH7X0/7H+UUv/O/SPWvr/RP+opf+d+kct/X+qf9TS/2f6Ry3979I/aun/c/2jlv6/0D9q6X+3/lFL/3v0j1r6/1L/qKX/vfpHLf1/pX/U0v/X+kct/X+jf9TS/7f6Ry39f6d/1NL/Pv2jlv736x+19P+9/lFL/wf0j1r6/0H/qKX/H/WPWvr/Sf+opf+f9Y9a+v9F/6il/1/1j1r6P6h/1NL/If2jlv5/0z9q6f93/aOW/g/rH7X0/4f+UUv/R/SPWvo/qn/U0v8x/aOW/o/rH5X0Hz3QP2rpP0z/qKX/cP2jlv4j9I9a+o/UP2rpP0r/qKX/aP2jlv5T6R+19J9a/6il/zT6Ry39p9U/auk/nf5RS//p9Y9a+s+gf9TSf0b9o5b+L9A/auk/k/5RS/8X6h+19J9Z/6il/4v0j1r6v1j/qKX/LPpHLf1n1T9q6T+b/lFL/9n1j1r6z6F/1NJ/Tv2jlv4v0T9q6f9S/aOW/nPpH7X0n1v/qKX/y/SPWvrPo3/U0v/l+kct/efVP2rpP5/+UUv/+fWPWvovoH/U0n9B/aOW/gvpH7X0X1j/qKX/K/SPWvq/Uv+opf8i+kct/V+lf9TSf1H9o5b+i+kfPdF/MGyK77+4/lHL+l9C/6il/5L6Ry39l9I/aum/tP5RS/9l9I9a+r9a/6il/7L6Ry39l9M/aum/vP5RS/8V9I9a+r9G/6il/4r6Ry39X6t/1NL/dfpHLf1X0j9q6b+y/lFL/1X0j1r6j9E/aum/qv5RS//V9I9a+q+uf9TS//X6Ry39x+oftfRfQ/+opf+a+kct/dfSP2rp/wb9o5b+b9Q/aum/tv5RS/836R+19H+z/lFL/7foH7X0f6v+UUv/dfSPWvqvq3/U0n89/aOW/uvrH7X030D/qKX/hvpHLf3fpn/U0n8j/aOW/m/XP2rpv7H+UUv/d+gftfTfRP+opf+m+kct/TfTP2rpv7n+UUv/LfSPWvpvqX/U0n8r/aOW/lvrH7X030b/qKX/tvpHLf230z9q6b+9/lFL/x30j1r676h/1NL/nfpHLf130j9q6b+z/lFL/130j1r676p/1NJ/N/2jlv676x+19H+X/lFL/z30j1r676l/1NJ/L/2jlv7v1j8q6T/Te/SPSvqP3lv/qKX/PvpHLf331T9q6b+f/lFL//31j1r6H6B/1NL/vfpHLf3fp3/U0v9A/aOW/gfpH7X0P1j/qKX/+/WPWvofon/U0v9Q/aOW/h/QP2rp/0H9o5b+H9I/aul/mP5RS//D9Y9a+h+hf9TS/8P6Ry39j9Q/aul/lP5RS/+j9Y9a+h+jf9TS/1j9o5b+H9E/aul/nP5RS/+P6h+19D9e/6il/8f0j1r6f1z/qKX/CfpHLf1P1D9q6X+S/lFL/0/oH7X0P1n/qKX/J/WPWvqfon80RfY/dfzZJ/f/lP7RFNl/wtkn9z9V/6il/2n6Ry39T9c/aul/hv5RS/8z9Y9a+p+lf9TS/2z9o5b+n9Y/aul/jv5RS/9z9Y9a+n9G/6il/3n6Ry39z9c/aun/Wf2jlv6f0z9q6X+B/sFUE06n/P6f1z9qWf8X6h+19P+C/lFL/4v0j1r6X6x/1NL/Ev2jlv6X6h+19P+i/lFL/y/pH7X0v0z/qKX/l/WPWvpfrn/U0v8r+kct/a/QP2rpf6X+UUv/q/SPWvp/Vf+opf/V+kct/b+mf9TS/+v6Ry39v6F/1NL/m/pHLf2/pX/U0v/b+kct/b+jf9TS/xr9o5b+1+oftfS/Tv+opf/1+kct/b+rf9TS/wb9o5b+N+oftfS/Sf+opf/N+kct/b+nf9TS//v6Ry39f6B/1NL/Fv2jlv636h+19L9N/6il/+36Ry39f6h/1NL/R/pHLf1/rH/U0v8O/aOW/j/RP2rpf6f+UUv/n+oftfT/mf5RS/+79I9a+v9c/6il/y/0j1r6361/1NL/Hv2jlv6/rO4/erK3tPS/t7r/5LX0/5X+UUv/X+sftfT/jf5RS//f6h+19P+d/lFL//v0j1r6369/1NL/9/pHLf0f0D9q6f8H/aOW/n/UP2rp/yf9o5b+f9Y/aun/F/2jlv5/1T9q6f+g/lFL/4f0j1r6/03/qKX/3/WPWvo/rH/U0v8f+kct/R/RP2rp/6j+UUv/x/SPWvo/rn9U0n+qgf5RS/9h+kct/YfrH7X0H6F/1NJ/pP5RS/9R+kct/UfrH7X0n0r/qKX/1PpHLf2n0T9q6T+t/lFL/+n0j1r6T69/1NJ/Bv2jlv4z6h+19H+B/lFL/5n0j1r6v1D/qKX/zPpHLf1fpH/U0v/F+kct/WfRP2rpP6v+UUv/2fSPWvrPrn/U0n8O/aOW/nPqH7X0f4n+UUv/l+oftfSfS/+opf/c+kct/V+mf9TSfx79o5b+L9c/auk/r/5RS//59I9a+s+vf9TSfwH9o5b+C+oftfRfSP+opf/C+kct/V+hf9TS/5X6Ry39F9E/aun/Kv2jlv6L6h+19F9M/6il/+L6Ry39l9A/aum/pP5RS/+l9I9a+i+tf9TSfxn9o5b+r9Y/aum/rP5RS//l9I9a+i+vf9TSfwX9o5b+r9E/mpL7P6n3VCvqH03J/Z+8/l+rf9TS/3X6Ry39V9I/aum/sv5RS/9V9I9a+o/RP2rpv6r+UUv/1fSPWvqvrn/U0v/1+kct/cfqH7X0X0P/qKX/mvpHLf3X0j9q6f8G/aOW/m/UP2rpv7b+UUv/N+kftfR/s/5RS/+36B+19H+r/lFL/3X0j1r6r6t/1NJ/Pf2jlv7r6x+19N9A/6il/4b6Ry3936Z/1NJ/I/2jlv5v1z9q6b+x/lFL/3foH7X030T/qKX/pvpHLf030z9q6b+5/lFL/y30j1r6b6l/1NJ/K/2jlv5b6x+19N9G/6il/7b6Ry39t9M/aum/vf5RS/8d9I9a+u+of9TS/536Ry39d9I/aum/s/5RS/9d9I9a+u+qf9TSfzf9o5b+u+sftfR/l/5RS/899I9a+u+pf9TSfy/9o5b+79Y/aun/Hv2jlv576x+19N9H/6il/75P7f/4BP/x4f23aem/n/UftfTfX/+opf8B+kct/d+rf9TS/336Ry39D9Q/aul/kP5RS/+D9Y9a+r9f/6il/yH6Ry39D9U/aun/Af2jlv4f1D9q6f8h/aOW/ofpH7X0P1z/qKX/EfpHLf0/rH/U0v9I/aOW/kfpH7X0P1r/qKX/MfpHLf2P1T9q6f8R/aOW/sfpH7X0/6j+UUv/4/WPWvp/TP+opf/H9Y9a+p+gf9TS/0T9o5b+J+kftfT/hP5RS/+T9Y9a+n9S/6il/yn6Ry39P6V/1NL/VP2jlv6n6R+19D9d/6il/xn6Ry39z9Q/aul/lv5RS/+z9Y9a+n9a/6il/zn6Ry39z9U/aun/Gf2jlv7n6R+19D9f/6il/2f1j1r6f07/qKX/BfpHLf0/r3/U0v9C/aOW/l/QP2rpf5H+UUv/i/WPWvpfon/U0v9S/aOW/l/UP2rp/yX9o5b+l+kftfT/sv5RS//L9Y9a+n9F/6il/xX6Ry39r9Q/aul/lf5RS/+v6h+19L9a/6il/9f0j1r6f13/qKX/N/SPWvp/U/+opf+39I9a+n9b/6il/3f0j1r6X6N/1NL/Wv2jlv7X6R+19L9e/6il/3f1j1r636B/1NL/Rv2jlv436R+19L9Z/6il//f0j1r6f1//qKX/D/SPWvrfon/U0v9W/aOW/rfpH7X0v13/qKX/D/WPWvr/SP+opf+P9Y9a+t+hf9TS/yf6Ry3979Q/aun/U/2jlv4/0z9q6X+X/lFL/5/rH7X0/4X+UUv/u/WPWvrfo3/U0v+X+kct/e/VP2rp/yv9o5b+v9Y/aun/G/2jlv6/1T9q6f87/aOW/vfpH7X0v1//qKX/7/WPWvo/oH/U0v8P+kct/f+of9TS/0/6Ry39/6x/1NL/L/pHLf3/qn/U0v9B/aOW/g/pH7X0/5v+UUv/v+sftfR/WP+opf8/9I9a+j+if9TS/1H9o5b+j+kftfR/XP+opP/UA/2jlv7D9I9a+g/XP2rpP0L/qKX/SP2jlv6j9I9a+o/WP2rpP5X+UUv/qfWPWvpPo3/U0n9a/aOW/tPpH7X0n17/qKX/DPpHLf1n1D9q6f8C/aOW/jPpH7X0f6H+UUv/mfWPWvq/SP+opf+L9Y9a+s+if9TSf1b9o5b+s+kftfSfXf+opf8c+kct/efUP2rp/xL9o5b+L9U/auk/l/5RS/+59Y9a+r9M/6il/zz6Ry39X65/1NJ/Xv2jlv7z6R+19J9f/6il/wL6Ry39F9Q/aum/kP5RS/+F9Y9a+r9C/6il/yv1j1r6L6J/1NL/VfpHLf0X1T9q6b+Y/lFL/8X1j1r6L6F/1NJ/Sf2jlv5L6R+19F9a/6il/zL6Ry39X61/1NJ/Wf2jlv7L6R+19F9e/6il/wr6Ry39X6N/1NJ/Rf2jlv6v1T9q6f86/aOW/ivpH7X0X1n/qKX/KvpHLf3H6B+19F9V/6il/2r6Ry39V9c/aun/ev2jlv5j9Y9a+q+hf9TSf039o5b+a+kftfR/g/5RS/836h+19F9b/6il/5v0j1r6v1n/qKX/W/SPWvq/Vf+opf86+kct/dfVP2rpv57+UUv/9fWPWvpvoH/U0n9D/aOW/m/TP2rpv5H+UUv/t+sftfTfWP+opf879I9a+m+if9TSf1P9o5b+m+kftfTfXP+opf8W+kct/bfUP2rpv5X+UUv/rfWPWvpvo3/U0n9b/aOW/tvpH7X0317/qKX/DvpHLf131D9q6f9O/aOW/jvpH7X031n/qKX/LvpHLf131T9q6b+b/lFL/931j1r6v0v/qKX/HvpHLf331D9q6b+X/lFL/3frH7X0f4/+UUv/vfWPWvrvo3/U0n9f/aOW/vvpH7X031//qKX/AfpHLf3fq3/U0v99+kct/Q/UP2rpf5D+UUv/g/WPWvq/X/+opf8h+kct/Q/VP2rp/wH9o5b+H9Q/aun/If2jlv6H6R+19D9c/6il/xH6Ry39P6x/1NL/SP2jlv5H6R+19D9a/6il/zH6Ry39j9U/aun/Ef2jlv7H6R+19P+o/lFL/+P1j1r6f0z/qKX/x/WPWvqfoH/U0v9E/aOW/ifpH7X0/4T+UUv/k/WPWvp/Uv+opf8p+kct/T+lf9TS/1T9o5b+p+kftfQ/Xf+opf8Z+kct/c/UP2rpf5b+UUv/s/WPWvp/Wv+opf85+kct/c/VP2rp/xn9o5b+5+kftfQ/X/+opf9n9X+aFUb19P+c/lFL/wv0j1r6f17/qKX/hfpHLf2/oH/U0v8i/aOW/hfrH7X0v0T/qKX/pfpHLf2/qH/U0v9L+kct/S/TP2rp/2X9o5b+l+sftfT/iv5RS/8r9I9a+l+pf9TS/yr9o5b+X9U/aul/tf5RS/+v6R+19P+6/lFL/2/oH7X0/6b+UUv/b+kftfT/tv5RS//v6B+19L9G/6il/7X6Ry39r9M/aul/vf5RS//v6h+19L9B/6il/436Ry39b9I/aul/s/5RS//v6R+19P++/lFL/x/oH7X0v0X/qKX/rfpHLf1v0z9q6X+7/lFL/x/qH7X0/5H+UUv/H+sftfS/Q/+opf9P9I9a+t+pf9TS/6f6Ry39f6Z/1NL/Lv2jlv4/1z9q6f8L/aOW/nfrH7X0v0f/qKX/L/WPWvrfq3/U0v9X+kct/X+tf9TS/zf6Ry39f6t/1NL/d/pHLf3v0z9q6X9/Uf+7Dnn227b0/31R/39FS/8H9I9a+v9B/6il/x/1j1r6/0n/qKX/n/WPWvr/Rf+opf9f9Y9a+j+of9TS/yH9o5b+f9M/aun/d/2jlv4P6x+19P+H/lFL/0f0j1r6P6p/1NL/Mf2jlv6P6x+V9J9moH/U0n+Y/lFL/+H6Ry39R+gftfQfqX/U0n+U/lFL/9H6Ry39p9I/auk/tf5RS/9p9I9a+k+rf9TSfzr9n26Lnv7T6x+19J9B/6il/4z6Ry39X6B/1NJ/Jv2jlv4v1D9q6T+z/lFL/xfpH7X0f7H+UUv/WfSPWvrPqn/U0n82/aOW/rPrH7X0n0P/qKX/nPpHLf1fon/U0v+l+kct/efSP2rpP7f+UUv/l+kftfSfR/+opf/L9Y9a+s+rf9TSfz79o5b+8+sftfRfQP+opf+C+kct/RfSP2rpv7D+UUv/V+gftfR/pf5RS/9F9I9a+r9K/6il/6L6Ry39F9M/aum/uP7RFNcfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/8cOHAgAAAAAAPm/NkJVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUVduBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFHTggAQAAABD0/3U7AgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABuCgAA///0/SZm")
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x80140, 0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x40285881, &(0x7f0000000080)={@desc={0x1, 0x0, @desc2}})

190.408593ms ago: executing program 3 (id=4600):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x150, 0x10, 0x713, 0x70bd2c, 0x25dfdbfc, {{@in6=@loopback, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x20, 0x4e21, 0x2, 0xa, 0x0, 0x0, 0x3b, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, {0x40, 0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x543}, {0x5, 0x7fffffffffffffff}, {}, 0x70bd28, 0x3500, 0x2, 0x4}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "217d66d38547aa140db8a200000000c538c7cb7a"}}]}, 0x150}, 0x1, 0x0, 0x0, 0x880}, 0x0)

90.716047ms ago: executing program 3 (id=4601):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6110}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_FLAGS={0x6}]}}}]}, 0x40}}, 0x0)

90.455399ms ago: executing program 3 (id=4602):
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f0000002700)=[{{&(0x7f0000001080)={0xa, 0x4e21, 0x10001, @private0={0xfc, 0x0, '\x00', 0x1}, 0x200}, 0x1c, &(0x7f00000011c0)=[{&(0x7f00000010c0)="f9", 0x1}], 0x1}}, {{&(0x7f0000001400)={0xa, 0x4e20, 0x3ff, @private2, 0x595ee5e6}, 0x1c, &(0x7f0000001480)=[{&(0x7f0000001440)="8e", 0x1}], 0x1}}], 0x2, 0x48040)
shutdown(r0, 0x1)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000001140)={0x0, 0x6}, 0x8)

455.605µs ago: executing program 3 (id=4603):
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6gre0\x00', <r2=>0x0})
sendto$packet(r0, &(0x7f0000000180)="10031412e4ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14)

0s ago: executing program 3 (id=4604):
syz_mount_image$squashfs(&(0x7f0000000040), &(0x7f0000000240)='./file0\x00', 0x80a, &(0x7f0000000480)=ANY=[], 0x1, 0x1cf, &(0x7f0000000280)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbGRvA9EIov+KW9ro1p/zOnPTU1Vomy8zQ6qktjywml9pj5Ca5mEeCmSE09ciiYiGG7MScnNSi4oUMFbeSkypOn2BguW5/TaVZgtPhjzyHQ5Kmgw7TER+PrBmNJZyTpDTF2NgyFc6e+SC/jk3jCMOjFcwb6zzzGusKU6fmNeQlVWVVZc2bOHHjzMbOxsaVE+ui0vxWMbakuGxq6mRkctiiJrCZ2VB9ko32hHftqx4mObD2ePg1nzJWep3KfMl4YZHUqRVVMyd8UZrNaPid4Q5P2QoJDQ0niSsSFg0mjB9Y/ze4gpyY0sCQphDGmKTGJta25cycEGZ+NrcFCi3JJ5hCj3IsnSlhcUCo6uRPS823DoluM7Y9dWA7w3P4OM+agj5Bo+MSDE4LBf/LgIxJaGgoAwWx7YIvRRp/JbxWGztlMLjbMy1rhgYkCzhcV0J5smA9CckrPHQ0NY1SkhMaNkkkJLkVGL5k2LqHc7VAAwtStKkwMDBsZ4TFLRRwMIyCUTAKRsEoGAWjYBSMglEwCkbBKBhBABAAAP//Yv6Xew==")

kernel console output (not intermixed with test programs):

630'.
[  295.380464][T12826] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  295.413155][T12828] loop6: detected capacity change from 0 to 128
[  296.823166][T12866] netdevsim netdevsim3 netdevsim0: left promiscuous mode
[  296.825963][T12866] netdevsim netdevsim3 netdevsim0: entered allmulticast mode
[  296.834273][T12866] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  296.961507][T12880] loop6: detected capacity change from 0 to 64
[  296.970994][T12880] BFS-fs: bfs_fill_super(): loop6 is unclean, continuing
[  297.046090][   T33] audit: type=1804 audit(1755132622.940:66): pid=12882 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2659" name="/newroot/243/file1" dev="fuse" ino=1 res=1 errno=0
[  297.642903][T12899] IPVS: length: 140 != 8
[  297.783274][T12897] loop5: detected capacity change from 0 to 32768
[  297.789321][T12897] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.2665 (12897)
[  297.811849][T12897] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  297.820746][T12897] BTRFS info (device loop5): using sha256 (sha256-lib) checksum algorithm
[  297.825612][T12897] BTRFS info (device loop5): using free-space-tree
[  298.222782][T12934] loop6: detected capacity change from 0 to 40427
[  298.227300][T12934] F2FS-fs (loop6): build fault injection rate: 14
[  298.230015][T12934] F2FS-fs (loop6): build fault injection type: 0x3bfe8c
[  298.235080][T12934] F2FS-fs (loop6): invalid crc value
[  298.243607][    C1] F2FS-fs (loop6): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  298.250263][    C1] F2FS-fs (loop6): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  298.261825][   T12] BTRFS info (device loop5): qgroup scan completed (inconsistency flag cleared)
[  298.276909][T12934] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  298.279939][T12934] F2FS-fs (loop6): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0
[  298.284954][T12934] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  298.337126][T12934] F2FS-fs (loop6): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  298.347978][T12934] F2FS-fs (loop6): inject dquot initialize in f2fs_dquot_initialize of f2fs_new_inode+0x509/0x1050
[  298.354072][T12934] F2FS-fs (loop6): inject page alloc in f2fs_grab_cache_folio of f2fs_new_node_folio+0x131/0xa40
[  298.357078][ T9980] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  298.383356][T11317] syz-executor: attempt to access beyond end of device
[  298.383356][T11317] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  298.392964][T11317] CPU: 0 UID: 0 PID: 11317 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  298.393000][T11317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  298.393008][T11317] Call Trace:
[  298.393015][T11317]  <TASK>
[  298.393019][T11317]  dump_stack_lvl+0x189/0x250
[  298.393041][T11317]  ? __pfx_dump_stack_lvl+0x10/0x10
[  298.393053][T11317]  ? __pfx_queue_work_on+0x10/0x10
[  298.393064][T11317]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  298.393073][T11317]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  298.393088][T11317]  f2fs_handle_critical_error+0x37c/0x540
[  298.393108][T11317]  f2fs_write_end_io+0x886/0xb60
[  298.393126][T11317]  __submit_merged_bio+0x27a/0x6a0
[  298.393137][T11317]  __submit_merged_write_cond+0x255/0x530
[  298.393148][T11317]  f2fs_write_data_pages+0x261d/0x3000
[  298.393172][T11317]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  298.393187][T11317]  ? is_bpf_text_address+0x26/0x2b0
[  298.393214][T11317]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[  298.393221][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  298.393235][T11317]  ? __lock_acquire+0xab9/0xd20
[  298.393249][T11317]  ? do_raw_spin_lock+0x121/0x290
[  298.393262][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  298.393270][T11317]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  298.393282][T11317]  do_writepages+0x32e/0x550
[  298.393297][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  298.393307][T11317]  filemap_fdatawrite+0x199/0x240
[  298.393318][T11317]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  298.393369][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  298.393380][T11317]  f2fs_sync_dirty_inodes+0x31f/0x830
[  298.393398][T11317]  f2fs_write_checkpoint+0x95a/0x1df0
[  298.393417][T11317]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  298.393451][T11317]  ? kill_f2fs_super+0x298/0x6c0
[  298.393467][T11317]  kill_f2fs_super+0x2c3/0x6c0
[  298.393483][T11317]  ? __pfx_kill_f2fs_super+0x10/0x10
[  298.393494][T11317]  ? radix_tree_delete_item+0x2b6/0x400
[  298.393510][T11317]  ? shrinker_free+0x2ce/0x3e0
[  298.393524][T11317]  deactivate_locked_super+0xbc/0x130
[  298.393534][T11317]  cleanup_mnt+0x425/0x4c0
[  298.393542][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  298.393551][T11317]  task_work_run+0x1d4/0x260
[  298.393562][T11317]  ? __pfx_task_work_run+0x10/0x10
[  298.393570][T11317]  ? __x64_sys_umount+0x122/0x160
[  298.393581][T11317]  ? exit_to_user_mode_loop+0x40/0x110
[  298.393594][T11317]  exit_to_user_mode_loop+0xec/0x110
[  298.393604][T11317]  do_syscall_64+0x2bd/0x3b0
[  298.393612][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  298.393619][T11317]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  298.393626][T11317]  ? exc_page_fault+0x9f/0xf0
[  298.393635][T11317]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  298.393643][T11317] RIP: 0033:0x7f8a4138ff17
[  298.393656][T11317] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  298.393665][T11317] RSP: 002b:00007ffd3c0cff18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  298.393678][T11317] RAX: 0000000000000000 RBX: 00007f8a41411c05 RCX: 00007f8a4138ff17
[  298.393686][T11317] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3c0cffd0
[  298.393693][T11317] RBP: 00007ffd3c0cffd0 R08: 0000000000000000 R09: 0000000000000000
[  298.393700][T11317] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd3c0d1060
[  298.393707][T11317] R13: 00007f8a41411c05 R14: 0000000000048db2 R15: 00007ffd3c0d10a0
[  298.393727][T11317]  </TASK>
[  298.394678][T11317] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  298.680418][T12942] loop5: detected capacity change from 0 to 256
[  298.759830][T12942] FAT-fs (loop5): Directory bread(block 64) failed
[  298.765021][T12942] FAT-fs (loop5): Directory bread(block 65) failed
[  298.767954][T12942] FAT-fs (loop5): Directory bread(block 66) failed
[  298.771298][T12942] FAT-fs (loop5): Directory bread(block 67) failed
[  298.774400][T12942] FAT-fs (loop5): Directory bread(block 68) failed
[  298.777201][T12942] FAT-fs (loop5): Directory bread(block 69) failed
[  298.786582][T12942] FAT-fs (loop5): Directory bread(block 70) failed
[  298.790005][T12942] FAT-fs (loop5): Directory bread(block 71) failed
[  298.819248][T12942] FAT-fs (loop5): Directory bread(block 72) failed
[  298.822937][T12942] FAT-fs (loop5): Directory bread(block 73) failed
[  298.856832][T12942] syz.5.2676: attempt to access beyond end of device
[  298.856832][T12942] loop5: rw=524288, sector=1160, nr_sectors = 4 limit=256
[  298.871101][T12942] syz.5.2676: attempt to access beyond end of device
[  298.871101][T12942] loop5: rw=0, sector=1160, nr_sectors = 4 limit=256
[  298.882537][   T33] audit: type=1800 audit(1755132624.886:67): pid=12942 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2676" name="file0" dev="loop5" ino=1048739 res=0 errno=0
[  299.242316][ T5996] usb 7-1: new high-speed USB device number 5 using dummy_hcd
[  299.412697][ T5996] usb 7-1: Using ep0 maxpacket: 8
[  299.417318][ T5996] usb 7-1: unable to get BOS descriptor or descriptor too short
[  299.421824][ T5996] usb 7-1: config 8 has an invalid interface number: 24 but max is 1
[  299.424534][ T5996] usb 7-1: config 8 has an invalid interface number: 242 but max is 1
[  299.431490][ T5996] usb 7-1: config 8 has no interface number 0
[  299.433558][ T5996] usb 7-1: config 8 has no interface number 1
[  299.435610][ T5996] usb 7-1: config 8 interface 24 altsetting 2 endpoint 0xE has invalid maxpacket 1535, setting to 1024
[  299.446927][ T5996] usb 7-1: config 8 interface 24 altsetting 2 endpoint 0x85 has an invalid bInterval 255, changing to 11
[  299.461494][ T5996] usb 7-1: config 8 interface 24 has no altsetting 0
[  299.463785][ T5996] usb 7-1: config 8 interface 242 has no altsetting 0
[  299.471139][ T5996] usb 7-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af
[  299.474547][ T5996] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  299.477391][ T5996] usb 7-1: Product: syz
[  299.499402][ T5996] usb 7-1: Manufacturer: syz
[  299.501067][ T5996] usb 7-1: SerialNumber: syz
[  299.521975][T12951] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  299.877402][ T5996] comedi comedi5: driver 'vmk80xx' has successfully auto-configured 'K8055 (VM110)'.
[  299.887810][ T5996] vmk80xx 7-1:8.242: driver 'vmk80xx' failed to auto-configure device.
[  299.900628][ T5996] usb 7-1: USB disconnect, device number 5
[  302.024428][T13029] loop5: detected capacity change from 0 to 1024
[  302.056106][T13031] netlink: 'syz.6.2716': attribute type 21 has an invalid length.
[  302.121024][T12582] hfsplus: b-tree write err: -5, ino 4
[  302.301777][T13038] netdevsim netdevsim6 netdevsim0: entered promiscuous mode
[  302.609824][T13053] ptrace attach of "/syz-executor exec"[11317] was attempted by ""[13053]
[  302.815268][T13061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  302.875343][T13061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  302.934619][T13061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  303.161583][T13083] netlink: 6 bytes leftover after parsing attributes in process `syz.5.2740'.
[  303.481978][T13099] netlink: 64 bytes leftover after parsing attributes in process `syz.6.2747'.
[  303.600358][  T794] IPVS: starting estimator thread 0...
[  303.689339][T13108] IPVS: using max 44 ests per chain, 105600 per kthread
[  304.414080][T13136] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2763'.
[  304.719871][T13152] netem: unknown loss type 0
[  304.723106][T13152] netem: change failed
[  304.970870][T13171] loop5: detected capacity change from 0 to 4096
[  304.981477][T13171] ntfs3(loop5): Different NTFS sector size (4096) and media sector size (512).
[  304.987031][T13171] ntfs3(loop5): RAW NTFS volume: Filesystem size 0.00 Gb > volume size 0.00 Gb. Mount in read-only.
[  304.991996][T13171] ntfs3(loop5): It is recommened to use chkdsk.
[  304.997208][T13171] ntfs3(loop5): $Bitmap is corrupted.
[  305.024661][ T8343] usb 7-1: new high-speed USB device number 6 using dummy_hcd
[  305.064907][T13173] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3)
[  305.067901][T13173] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  305.075476][T13173] vhci_hcd vhci_hcd.0: Device attached
[  305.080576][T13174] vhci_hcd: connection closed
[  305.083828][ T5993] vhci_hcd: stop threads
[  305.088454][ T5993] vhci_hcd: release socket
[  305.090643][ T5993] vhci_hcd: disconnect device
[  305.174865][ T8343] usb 7-1: Using ep0 maxpacket: 32
[  305.178595][ T8343] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  305.182464][ T8343] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7
[  305.187813][ T8343] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0
[  305.191505][ T8343] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  305.195434][ T8343] usb 7-1: config 1 interface 1 has no altsetting 0
[  305.200574][ T8343] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  305.204591][ T8343] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  305.207227][ T8343] usb 7-1: Product: syz
[  305.208655][ T8343] usb 7-1: Manufacturer: syz
[  305.210204][ T8343] usb 7-1: SerialNumber: syz
[  305.413034][ T8343] usb 7-1: 2:1 : no or invalid class specific endpoint descriptor
[  305.417437][ T8343] usb 7-1: 2:1 : no or invalid class specific endpoint descriptor
[  305.446979][ T8343] usb 7-1: USB disconnect, device number 6
[  305.477261][T11335] udevd[11335]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  306.400467][T13197] loop6: detected capacity change from 0 to 128
[  306.508458][T13201] loop5: detected capacity change from 0 to 512
[  306.520971][T13201] EXT4-fs: Ignoring removed nobh option
[  306.543870][T13201] EXT4-fs error (device loop5): ext4_orphan_get:1392: inode #15: comm syz.5.2794: iget: bad i_size value: 38620345925642
[  306.552967][T13201] EXT4-fs error (device loop5): ext4_orphan_get:1397: comm syz.5.2794: couldn't read orphan inode 15 (err -117)
[  306.569461][T13201] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  306.599045][T13201] EXT4-fs error (device loop5): ext4_validate_block_bitmap:432: comm syz.5.2794: bg 0: block 5: invalid block bitmap
[  306.615393][T13201] EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2 with error 28
[  306.621467][T13201] EXT4-fs (loop5): This should not happen!! Data will be lost
[  306.621467][T13201] 
[  306.644386][T13201] EXT4-fs (loop5): Total free blocks count 0
[  306.651260][T13201] EXT4-fs (loop5): Free/Dirty block details
[  306.653852][T13201] EXT4-fs (loop5): free_blocks=0
[  306.672727][T13201] EXT4-fs (loop5): dirty_blocks=2
[  306.674882][T13201] EXT4-fs (loop5): Block reservation details
[  306.677526][T13201] EXT4-fs (loop5): i_reserved_data_blocks=2
[  306.848145][ T9980] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  307.083651][T13227] overlayfs: failed to get inode (-116)
[  307.096265][T13227] overlayfs: failed to get inode (-116)
[  307.098724][T13227] overlayfs: failed to get inode (-116)
[  307.102788][T13227] overlayfs: failed to get inode (-116)
[  307.175018][T13235] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  309.007707][T13261] loop6: detected capacity change from 0 to 1024
[  309.135509][ T3588] hfsplus: b-tree write err: -5, ino 4
[  309.271440][T13263] loop6: detected capacity change from 0 to 8
[  309.287780][T13263] SQUASHFS error: lzo decompression failed, data probably corrupt
[  309.291518][T13263] SQUASHFS error: Failed to read block 0x91: -5
[  309.297023][T13263] SQUASHFS error: Unable to read metadata cache entry [8f]
[  309.302315][T13263] SQUASHFS error: Unable to read inode 0x11f
[  309.810124][T13275] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:16x16 (0x32314742, 8, 0, 0, 0)
[  310.099069][T13286] loop6: detected capacity change from 0 to 512
[  310.106509][T13286] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[  310.146756][T13286] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  310.152598][T13286] ext4 filesystem being mounted at /250/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  310.178355][T13286] EXT4-fs error (device loop6): ext4_get_verity_descriptor_location:335: inode #15: comm syz.6.2830: verity file corrupted; can't find descriptor
[  310.188109][T13286] fs-verity (loop6, inode 15): Error -117 getting verity descriptor size
[  310.251090][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  310.481577][T13293] loop6: detected capacity change from 0 to 128
[  311.877052][T13330] loop6: detected capacity change from 0 to 32768
[  311.883667][T13330] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.2848 (13330)
[  311.906520][T13330] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  311.911544][T13330] BTRFS info (device loop6): using sha256 (sha256-lib) checksum algorithm
[  311.914488][T13330] BTRFS info (device loop6): using free-space-tree
[  312.017728][T11317] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  312.120323][T13372] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2862'.
[  313.084661][T13402] loop6: detected capacity change from 0 to 32768
[  313.417721][T13406] overlayfs: failed to clone upperpath
[  314.064279][T13417] netlink: 277 bytes leftover after parsing attributes in process `syz.6.2880'.
[  314.314360][T13438] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2886'.
[  314.317605][T13438] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2886'.
[  314.327781][T13438] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1
[  314.331729][T13438] ip6gretap1: entered allmulticast mode
[  314.483826][T13447] capability: warning: `syz.6.2889' uses 32-bit capabilities (legacy support in use)
[  314.544418][T13447] Falling back ldisc for ttyS3.
[  314.727182][T13466] loop5: detected capacity change from 0 to 512
[  314.794791][T13471] netlink: 'syz.3.2898': attribute type 2 has an invalid length.
[  314.815281][T13466] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  314.833631][T13471] : entered promiscuous mode
[  314.862385][T13466] ext4 filesystem being mounted at /306/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  314.940653][ T9980] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  314.982374][T13486] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2902'.
[  315.486194][T13514] loop6: detected capacity change from 0 to 8
[  315.702166][T13529] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check.
[  315.884259][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  316.085563][T13543] trusted_key: encrypted_key: keyword 'updat`fault' not recognized
[  316.789067][T13553] NILFS (nullb0): couldn't find nilfs on the device
[  317.612777][T13567] netlink: 'syz.3.2936': attribute type 3 has an invalid length.
[  317.865035][   T33] audit: type=1326 audit(1755132644.923:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13564 comm="syz.5.2935" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdfc8b8ebe9 code=0x7ffe0000
[  317.940668][T13575] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2939'.
[  318.542005][T13592] openvswitch: netlink: IPv4 tun info is not correct
[  319.376108][T13603] loop6: detected capacity change from 0 to 32768
[  319.437934][T13603] XFS (loop6): DAX unsupported by block device. Turning off DAX.
[  319.441890][T13603] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  319.473827][T13603] XFS (loop6): Ending clean mount
[  319.494697][T13603] XFS (loop6): Quotacheck needed: Please wait.
[  319.555452][T13603] XFS (loop6): Quotacheck: Done.
[  319.569570][T13616] loop5: detected capacity change from 0 to 256
[  319.575725][T13616] exfat: Deprecated parameter 'namecase'
[  319.584297][T13616] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xbe66f6fd, utbl_chksum : 0xe619d30d)
[  320.078014][T11317] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  320.658863][T13630] netlink: 'syz.3.2960': attribute type 29 has an invalid length.
[  320.665830][T13630] netlink: 'syz.3.2960': attribute type 29 has an invalid length.
[  320.840581][T13641] netlink: 'syz.3.2965': attribute type 1 has an invalid length.
[  320.965637][T13646] loop6: detected capacity change from 0 to 512
[  320.968277][T13646] ext4: Unknown parameter 'fsuuid'
[  320.973444][T13646] tmpfs: Bad value for 'mpol'
[  321.140262][T13657] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  323.641174][T13725] loop6: detected capacity change from 0 to 4096
[  323.938755][T13725] ntfs3(loop6): Mark volume as dirty due to NTFS errors
[  323.946248][T13725] ntfs3(loop6): Failed to load $Extend (-22).
[  323.949027][T13725] ntfs3(loop6): Failed to initialize $Extend.
[  324.343254][T13751] netlink: 'syz.5.3009': attribute type 21 has an invalid length.
[  324.346238][T13751] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3009'.
[  324.475661][T13759] Bluetooth: hci0: Opcode 0x0401 failed: -22
[  324.716950][T13775] loop5: detected capacity change from 0 to 512
[  324.721580][T13775] EXT4-fs: Ignoring removed oldalloc option
[  324.730979][T13775] EXT4-fs error (device loop5): ext4_xattr_inode_iget:433: comm syz.5.3021: Parent and EA inode have the same ino 15
[  324.738057][T13775] EXT4-fs (loop5): Remounting filesystem read-only
[  324.740439][T13775] EXT4-fs warning (device loop5): ext4_evict_inode:274: xattr delete (err -30)
[  324.743493][T13775] EXT4-fs (loop5): 1 orphan inode deleted
[  324.746249][T13775] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  324.767595][ T9980] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  324.869049][ T5296] udevd[5296]: worker [6572] terminated by signal 33 (Unknown signal 33)
[  324.877130][ T5296] udevd[5296]: worker [6572] failed while handling '/devices/virtual/block/loop5'
[  325.597643][T13817] bridge: RTM_NEWNEIGH with invalid ether address
[  325.700597][T13820] openvswitch: netlink: Message has 1 unknown bytes.
[  326.201198][T13831] netlink: 92 bytes leftover after parsing attributes in process `syz.6.3047'.
[  326.306018][T13839] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3051'.
[  326.324631][T13839] loop6: detected capacity change from 0 to 256
[  326.335131][T13839] FAT-fs (loop6): Directory bread(block 64) failed
[  326.337586][T13839] FAT-fs (loop6): Directory bread(block 65) failed
[  326.340763][T13839] FAT-fs (loop6): Directory bread(block 66) failed
[  326.343678][T13839] FAT-fs (loop6): Directory bread(block 67) failed
[  326.346499][T13839] FAT-fs (loop6): Directory bread(block 68) failed
[  326.349208][T13839] FAT-fs (loop6): Directory bread(block 69) failed
[  326.352468][T13839] FAT-fs (loop6): Directory bread(block 70) failed
[  326.355219][T13839] FAT-fs (loop6): Directory bread(block 71) failed
[  326.357940][T13839] FAT-fs (loop6): Directory bread(block 72) failed
[  326.361502][T13839] FAT-fs (loop6): Directory bread(block 73) failed
[  326.377569][ T5947] Bluetooth: hci0: command tx timeout
[  326.505099][T13845] loop6: detected capacity change from 0 to 1024
[  326.870322][T13849] loop6: detected capacity change from 0 to 40427
[  326.877836][T13849] F2FS-fs (loop6): invalid crc value
[  326.957306][T13849] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  326.966207][T13849] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4
[  326.980744][   T33] audit: type=1800 audit(1755132654.554:69): pid=13849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.3056" name="file1" dev="loop6" ino=10 res=0 errno=0
[  326.997207][T13849] syz.6.3056: attempt to access beyond end of device
[  326.997207][T13849] loop6: rw=34817, sector=53248, nr_sectors = 8 limit=40427
[  327.024640][T11317] syz-executor: attempt to access beyond end of device
[  327.024640][T11317] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  327.030573][T11317] CPU: 0 UID: 0 PID: 11317 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  327.030591][T11317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  327.030599][T11317] Call Trace:
[  327.030604][T11317]  <TASK>
[  327.030611][T11317]  dump_stack_lvl+0x189/0x250
[  327.030633][T11317]  ? __pfx_dump_stack_lvl+0x10/0x10
[  327.030648][T11317]  ? __pfx_queue_work_on+0x10/0x10
[  327.030661][T11317]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  327.030675][T11317]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  327.030698][T11317]  f2fs_handle_critical_error+0x37c/0x540
[  327.030719][T11317]  f2fs_write_end_io+0x886/0xb60
[  327.030750][T11317]  __submit_merged_bio+0x27a/0x6a0
[  327.030769][T11317]  __submit_merged_write_cond+0x255/0x530
[  327.030789][T11317]  f2fs_write_data_pages+0x261d/0x3000
[  327.030830][T11317]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  327.030894][T11317]  ? unwind_next_frame+0xa5/0x2390
[  327.030907][T11317]  ? rcu_is_watching+0x15/0xb0
[  327.030918][T11317]  ? __kasan_check_byte+0x12/0x40
[  327.030941][T11317]  ? is_bpf_text_address+0x26/0x2b0
[  327.030956][T11317]  ? rcu_is_watching+0x15/0xb0
[  327.030969][T11317]  ? rcu_is_watching+0x15/0xb0
[  327.030979][T11317]  ? lock_release+0x4b/0x3e0
[  327.030994][T11317]  ? lock_release+0x4b/0x3e0
[  327.031021][T11317]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  327.031036][T11317]  do_writepages+0x32e/0x550
[  327.031069][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  327.031087][T11317]  filemap_fdatawrite+0x199/0x240
[  327.031102][T11317]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  327.031113][T11317]  ? __pfx_SOFTIRQ_verbose+0x10/0x10
[  327.031161][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  327.031203][T11317]  f2fs_sync_dirty_inodes+0x31f/0x830
[  327.031234][T11317]  f2fs_write_checkpoint+0x95a/0x1df0
[  327.031272][T11317]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  327.031326][T11317]  ? kill_f2fs_super+0x298/0x6c0
[  327.031349][T11317]  kill_f2fs_super+0x2c3/0x6c0
[  327.031368][T11317]  ? __pfx_kill_f2fs_super+0x10/0x10
[  327.031382][T11317]  ? radix_tree_delete_item+0x2b6/0x400
[  327.031401][T11317]  ? shrinker_free+0x2ce/0x3e0
[  327.031415][T11317]  deactivate_locked_super+0xbc/0x130
[  327.031431][T11317]  cleanup_mnt+0x425/0x4c0
[  327.031445][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  327.031461][T11317]  task_work_run+0x1d4/0x260
[  327.031478][T11317]  ? __pfx_task_work_run+0x10/0x10
[  327.031491][T11317]  ? __x64_sys_umount+0x122/0x160
[  327.031510][T11317]  ? exit_to_user_mode_loop+0x40/0x110
[  327.031529][T11317]  exit_to_user_mode_loop+0xec/0x110
[  327.031545][T11317]  do_syscall_64+0x2bd/0x3b0
[  327.031557][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  327.031570][T11317]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  327.031582][T11317]  ? exc_page_fault+0x9f/0xf0
[  327.031598][T11317]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  327.031609][T11317] RIP: 0033:0x7f8a4138ff17
[  327.031621][T11317] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  327.031631][T11317] RSP: 002b:00007ffd3c0cff18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  327.031644][T11317] RAX: 0000000000000000 RBX: 00007f8a41411c05 RCX: 00007f8a4138ff17
[  327.031652][T11317] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3c0cffd0
[  327.031659][T11317] RBP: 00007ffd3c0cffd0 R08: 0000000000000000 R09: 0000000000000000
[  327.031666][T11317] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd3c0d1060
[  327.031672][T11317] R13: 00007f8a41411c05 R14: 00000000000503d6 R15: 00007ffd3c0d10a0
[  327.031695][T11317]  </TASK>
[  327.031700][T11317] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  327.564796][T13890] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3074'.
[  327.568197][T13890] netlink: 'syz.6.3074': attribute type 7 has an invalid length.
[  327.570768][T13890] netlink: 'syz.6.3074': attribute type 8 has an invalid length.
[  327.574351][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3074'.
[  327.779650][T13906] loop5: detected capacity change from 0 to 256
[  327.846366][T13908] loop5: detected capacity change from 0 to 1024
[  327.868913][T13908] EXT4-fs (loop5): Can't support bigalloc feature without extents feature
[  327.868913][T13908] 
[  327.873687][T13908] EXT4-fs (loop5): couldn't mount as ext2 due to feature incompatibilities
[  328.084115][T13900] loop6: detected capacity change from 0 to 32768
[  329.089923][T13925] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3091'.
[  329.220485][T13933] openvswitch: netlink: Key type 31 is not supported
[  329.288626][T13937] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms)
[  329.311276][T13937] bridge0: port 2(bridge_slave_1) entered disabled state
[  329.316722][T13937] bridge0: port 1(bridge_slave_0) entered disabled state
[  329.337224][T13939] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3097'.
[  329.387663][T13939] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3097'.
[  329.448869][T13947] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3101'.
[  329.454250][T13947] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3101'.
[  329.487588][T13953] raw_sendmsg: syz.6.3104 forgot to set AF_INET. Fix it!
[  329.532869][T13958] loop6: detected capacity change from 0 to 2048
[  329.541722][T13958] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024)
[  329.544909][T13958] NILFS (loop6): mounting unchecked fs
[  329.555629][ T5956] udevd[5956]: incorrect nilfs2 checksum on /dev/loop6
[  329.558870][T13958] NILFS (loop6): recovery complete
[  329.561657][T13959] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  329.635142][   T33] audit: type=1326 audit(1755132657.359:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.653843][   T33] audit: type=1326 audit(1755132657.359:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.664181][   T33] audit: type=1326 audit(1755132657.359:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.672827][   T33] audit: type=1326 audit(1755132657.359:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.686146][   T33] audit: type=1326 audit(1755132657.359:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.694677][   T33] audit: type=1326 audit(1755132657.370:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.703582][   T33] audit: type=1326 audit(1755132657.370:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.713544][   T33] audit: type=1326 audit(1755132657.370:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  329.727446][   T33] audit: type=1326 audit(1755132657.370:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  330.394441][T13973] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3111'.
[  330.466464][T13975] loop5: detected capacity change from 0 to 256
[  330.472830][T13975] exfat: Deprecated parameter 'utf8'
[  330.477994][T13975] exfat: Deprecated parameter 'utf8'
[  330.480288][T13975] exfat: Deprecated parameter 'utf8'
[  330.512974][T13975] exfat: Deprecated parameter 'utf8'
[  330.527067][T13975] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xac5c0b1f, utbl_chksum : 0xe619d30d)
[  330.863033][T13989] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3119'.
[  331.727248][   T33] kauditd_printk_skb: 6415 callbacks suppressed
[  331.727263][   T33] audit: type=1326 audit(1755132659.552:6494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.765239][   T33] audit: type=1326 audit(1755132659.562:6495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.805670][   T33] audit: type=1326 audit(1755132659.562:6496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.820578][   T33] audit: type=1326 audit(1755132659.562:6497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.833225][   T33] audit: type=1326 audit(1755132659.562:6498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.847836][   T33] audit: type=1326 audit(1755132659.562:6499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.857526][   T33] audit: type=1326 audit(1755132659.562:6500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.870821][   T33] audit: type=1326 audit(1755132659.562:6501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.880766][   T33] audit: type=1326 audit(1755132659.562:6502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  331.895178][   T33] audit: type=1326 audit(1755132659.562:6503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13963 comm="syz.6.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x50000
[  332.549939][T14018] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3131'.
[  333.645384][T14045] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  334.069287][T14080] IPVS: persistence engine module ip_vs_pe_s not found
[  334.398518][T14089] netlink: 'syz.6.3164': attribute type 2 has an invalid length.
[  334.412009][T14089] k*]: entered promiscuous mode
[  334.907431][ T5997] usb 7-1: new full-speed USB device number 7 using dummy_hcd
[  335.059793][ T5997] usb 7-1: config index 0 descriptor too short (expected 1051, got 27)
[  335.063252][ T5997] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10
[  335.068291][ T5997] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0
[  335.075411][ T5997] usb 7-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9
[  335.079442][ T5997] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  335.082757][ T5997] usb 7-1: Product: syz
[  335.084472][ T5997] usb 7-1: Manufacturer: syz
[  335.086847][ T5997] usb 7-1: SerialNumber: syz
[  335.090911][ T5997] usb 7-1: config 0 descriptor??
[  335.288055][ T5996] usb 7-1: USB disconnect, device number 7
[  336.653582][T14131] loop6: detected capacity change from 0 to 256
[  336.667777][T14131] FAT-fs (loop6): Directory bread(block 64) failed
[  336.672554][T14131] FAT-fs (loop6): Directory bread(block 65) failed
[  336.675700][T14131] FAT-fs (loop6): Directory bread(block 66) failed
[  336.678493][T14131] FAT-fs (loop6): Directory bread(block 67) failed
[  336.682417][T14131] FAT-fs (loop6): Directory bread(block 68) failed
[  336.685252][T14131] FAT-fs (loop6): Directory bread(block 69) failed
[  336.687916][T14131] FAT-fs (loop6): Directory bread(block 70) failed
[  336.693922][T14131] FAT-fs (loop6): Directory bread(block 71) failed
[  336.696754][T14131] FAT-fs (loop6): Directory bread(block 72) failed
[  336.701355][T14131] FAT-fs (loop6): Directory bread(block 73) failed
[  336.727514][T14133] loop5: detected capacity change from 0 to 8
[  336.739721][T14133] SQUASHFS error: Failed to read block 0x738: -5
[  336.741836][T14133] SQUASHFS error: Unable to read metadata cache entry [736]
[  336.769239][T14135] tmpfs: Unexpected value for 'inode32'
[  336.880720][T14145] loop5: detected capacity change from 0 to 512
[  336.894338][T14147] loop6: detected capacity change from 0 to 512
[  336.924337][T14145] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  336.938297][T14145] ext4 filesystem being mounted at /391/file2 supports timestamps until 2038-01-19 (0x7fffffff)
[  336.988888][T14145] EXT4-fs (loop5): re-mounted 00000000-0000-0000-0000-000000000000 ro.
[  337.013066][T14145] EXT4-fs (loop5): re-mounted 00000000-0000-0000-0000-000000000000 r/w.
[  337.064384][ T9980] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  337.183981][T14168] loop6: detected capacity change from 0 to 1024
[  337.187277][T14168] EXT4-fs: Ignoring removed bh option
[  337.193073][T14168] EXT4-fs: inline encryption not supported
[  337.197874][T14168] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled
[  337.222251][T14168] EXT4-fs error (device loop6): ext4_map_blocks:778: inode #3: block 2: comm syz.6.3201: lblock 2 mapped to illegal pblock 2 (length 1)
[  337.233100][T14168] __quota_error: 1074 callbacks suppressed
[  337.233134][T14168] Quota error (device loop6): qtree_write_dquot: dquota write failed
[  337.238797][T14168] EXT4-fs error (device loop6): ext4_map_blocks:778: inode #3: block 48: comm syz.6.3201: lblock 0 mapped to illegal pblock 48 (length 1)
[  337.244174][T14168] Quota error (device loop6): v2_write_file_info: Can't write info structure
[  337.249458][T14168] EXT4-fs error (device loop6): ext4_acquire_dquot:6933: comm syz.6.3201: Failed to acquire dquot type 0
[  337.253811][T14168] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6334: Corrupt filesystem
[  337.257367][T14168] EXT4-fs error (device loop6): ext4_evict_inode:254: inode #11: comm syz.6.3201: mark_inode_dirty error
[  337.263181][T14168] EXT4-fs warning (device loop6): ext4_evict_inode:257: couldn't mark inode dirty (err -117)
[  337.267822][T14168] EXT4-fs (loop6): 1 orphan inode deleted
[  337.276789][T14168] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  337.282631][   T27] EXT4-fs error (device loop6): ext4_map_blocks:778: inode #3: block 1: comm kworker/u10:0: lblock 1 mapped to illegal pblock 1 (length 1)
[  337.295162][   T27] Quota error (device loop6): remove_tree: Can't read quota data block 1
[  337.298081][T14168] EXT4-fs error (device loop6): ext4_map_blocks:778: inode #2: block 16: comm syz.6.3201: lblock 0 mapped to illegal pblock 16 (length 1)
[  337.298553][   T27] EXT4-fs error (device loop6): ext4_release_dquot:6969: comm kworker/u10:0: Failed to release dquot type 0
[  337.381387][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  337.388762][T11317] EXT4-fs error (device loop6): __ext4_get_inode_loc:4861: comm syz-executor: Invalid inode table block 1 in block_group 0
[  337.402634][T11317] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6334: Corrupt filesystem
[  337.407375][T11317] EXT4-fs error (device loop6): ext4_quota_off:7217: inode #3: comm syz-executor: mark_inode_dirty error
[  338.829393][T14200] hugetlbfs: syz.5.3211 (14200): Using mlock ulimits for SHM_HUGETLB is obsolete
[  338.996017][T14202] IPv4: Oversized IP packet from 172.20.20.24
[  339.000451][    C0] IPv4: Oversized IP packet from 172.20.20.24
[  339.003178][    C0] IPv4: Oversized IP packet from 172.20.20.24
[  339.235093][T14213] atomic_op ffff888020fed198 conn xmit_atomic 0000000000000000
[  341.562961][T14246] loop6: detected capacity change from 0 to 512
[  341.601967][T14246] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e842c11c, mo2=0002]
[  341.614768][T14246] System zones: 0-2, 18-18, 34-34
[  341.623124][T14246] EXT4-fs error (device loop6): ext4_validate_block_bitmap:441: comm syz.6.3235: bg 0: block 248: padding at end of block bitmap is not set
[  341.648312][T14246] Quota error (device loop6): write_blk: dquota write failed
[  341.651710][T14246] Quota error (device loop6): qtree_write_dquot: Error -117 occurred while creating quota
[  341.657571][T14246] EXT4-fs error (device loop6): ext4_acquire_dquot:6933: comm syz.6.3235: Failed to acquire dquot type 1
[  341.667266][T14246] EXT4-fs (loop6): 1 truncate cleaned up
[  341.676157][T14246] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  341.685147][T14246] ext4 filesystem being mounted at /387/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  341.692120][T14256] netlink: 'syz.3.3238': attribute type 22 has an invalid length.
[  341.701278][T14256] netlink: 168 bytes leftover after parsing attributes in process `syz.3.3238'.
[  341.740393][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  342.030841][T14272] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0)
[  342.083231][T14276] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3248'.
[  342.169795][T14282] netlink: 'syz.6.3251': attribute type 3 has an invalid length.
[  342.185410][T14282] netlink: 'syz.6.3251': attribute type 1 has an invalid length.
[  342.188899][T14282] netlink: 192 bytes leftover after parsing attributes in process `syz.6.3251'.
[  342.204779][T14282] NCSI netlink: No device for ifindex 0
[  342.739859][T14318] lo speed is unknown, defaulting to 1000
[  342.750986][T14318] lo speed is unknown, defaulting to 1000
[  342.767216][T14318] lo speed is unknown, defaulting to 1000
[  342.789244][T14318] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  342.824481][T14318] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  342.911545][T14318] lo speed is unknown, defaulting to 1000
[  342.926678][T14318] lo speed is unknown, defaulting to 1000
[  342.930448][T14318] lo speed is unknown, defaulting to 1000
[  343.448251][T14340] netlink: 188 bytes leftover after parsing attributes in process `syz.3.3278'.
[  343.489322][T14342] program syz.6.3279 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  343.739524][T14353] loop6: detected capacity change from 0 to 4096
[  343.749464][T14353] EXT4-fs (loop6): Test dummy encryption mode enabled
[  343.772724][T14353] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003]
[  343.781030][T14353] System zones: 0-5
[  343.787651][T14353] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  343.830240][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  344.798177][T14361] loop6: detected capacity change from 0 to 32768
[  344.822723][T14361] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  344.870695][T14361] XFS (loop6): Ending clean mount
[  344.936472][T11317] XFS (loop6): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  345.365570][T14383] loop6: detected capacity change from 0 to 32768
[  345.374148][T14383] ERROR: (device loop6): xtSearch: xt_getpage: xtree page corrupt
[  345.374148][T14383] 
[  345.378744][T14383] ERROR: (device loop6): remounting filesystem as read-only
[  345.381763][T14383] xtLookup: xtSearch returned -5
[  345.384038][T14383] read_mapping_page failed!
[  345.386174][T14383] jfs_mount: diMount(ipaimap2) failed, rc = -5
[  345.388900][T14383] Mount JFS Failure: -5
[  345.390592][T14383] jfs_mount failed w/return code = -5
[  345.711419][T14396] loop6: detected capacity change from 0 to 32768
[  345.746228][T14396] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode.
[  345.809182][T11317] ocfs2: Unmounting device (7,6) on (node local)
[  346.102875][T14410] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3306'.
[  346.422222][T14422] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  346.424896][T14422] IPv6: NLM_F_CREATE should be set when creating new route
[  347.366273][   T33] audit: type=1804 audit(1755132676.031:7578): pid=14433 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.3315" name="/newroot/415/file1" dev="fuse" ino=1 res=1 errno=0
[  347.507693][T14447] loop6: detected capacity change from 0 to 64
[  347.517298][T14447] Trying to free block not in datazone
[  347.536082][T14447] minix_free_block (loop6:21): bit already cleared
[  347.744952][T14457] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3326'.
[  349.390408][T14515] syzkaller1: entered promiscuous mode
[  349.392577][T14515] syzkaller1: entered allmulticast mode
[  350.434859][T14517] comedi comedi3: reset error (fatal)
[  350.590510][T14542] netlink: 3 bytes leftover after parsing attributes in process `syz.6.3367'.
[  350.594881][T14542] netlink: 3 bytes leftover after parsing attributes in process `syz.6.3367'.
[  350.600782][T14542] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  352.424265][T14603] loop6: detected capacity change from 0 to 512
[  352.429200][T14603] EXT4-fs error (device loop6): ext4_orphan_get:1392: inode #15: comm syz.6.3392: iget: bad extended attribute block 1
[  352.434518][T14603] EXT4-fs error (device loop6): ext4_orphan_get:1397: comm syz.6.3392: couldn't read orphan inode 15 (err -117)
[  352.440917][T14603] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  352.479989][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  352.667873][T14616] delete_channel: no stack
[  354.020892][T14681] IPv6: addrconf: prefix option has invalid lifetime
[  354.386159][ T5996] usb 7-1: new full-speed USB device number 8 using dummy_hcd
[  354.788627][T14699] loop5: detected capacity change from 0 to 16
[  354.793184][T14699] erofs (device loop5): rootino(nid 36) is not a directory(i_mode 16700)
[  354.806548][ T5996] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64
[  354.815611][ T5996] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  354.819908][ T5996] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64
[  354.837227][ T5996] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  354.840905][ T5996] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  354.855234][ T5996] usb 7-1: Product: syz
[  354.856993][ T5996] usb 7-1: Manufacturer: syz
[  354.858908][ T5996] usb 7-1: SerialNumber: syz
[  354.877103][ T5996] usb 7-1: config 0 descriptor??
[  354.879943][T14687] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22
[  354.883002][T14687] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22
[  354.888414][ T5996] usb 7-1: ucan: probing device on interface #0
[  355.348881][ T5996] usb 7-1: ucan: failed to retrieve device info
[  355.353647][ T5996] usb 7-1: ucan: probe failed; try to update the device firmware
[  355.366247][ T5996] usb 7-1: USB disconnect, device number 8
[  356.162921][T14734] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3447'.
[  356.535543][T14751] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  356.964852][T14764] loop5: detected capacity change from 0 to 1764
[  357.119961][T14772] loop6: detected capacity change from 0 to 4096
[  357.132990][T14772] ntfs3(loop6): Different NTFS sector size (1024) and media sector size (512).
[  357.370113][T14784] loop6: detected capacity change from 0 to 1024
[  357.375279][T14784] EXT4-fs: Ignoring removed orlov option
[  357.377967][T14784] EXT4-fs (loop6): stripe (5) is not aligned with cluster size (16), stripe is disabled
[  357.400112][T14784] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  357.432399][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  357.638312][T14796] 9pnet: p9_errstr2errno: server reported unknown error @c0xffffffffffffffff
[  357.682215][T14800] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3475'.
[  357.764852][T14800] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3475'.
[  357.808036][ T5996] usb 7-1: new high-speed USB device number 9 using dummy_hcd
[  357.887430][T14811] netlink: 'syz.3.3479': attribute type 4 has an invalid length.
[  357.892434][T14809] loop5: detected capacity change from 0 to 1764
[  357.918400][T14809] ISOFS: root inode is unusable. Disabling Rock Ridge and switching to Joliet.
[  357.999324][T14815] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3482'.
[  358.061839][ T5996] usb 7-1: Using ep0 maxpacket: 16
[  358.066180][ T5996] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  358.069864][ T5996] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  358.076453][ T5996] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  358.079644][ T5996] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  358.082881][ T5996] usb 7-1: Product: syz
[  358.084331][ T5996] usb 7-1: Manufacturer: syz
[  358.086323][ T5996] usb 7-1: SerialNumber: syz
[  358.320563][T14823] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0xf
[  358.375484][T14825] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  358.508923][ T5996] usb 7-1: cannot find UAC_HEADER
[  358.531072][ T5996] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22
[  358.550542][ T5956] udevd[5956]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  358.805843][ T5996] usb 7-1: USB disconnect, device number 9
[  359.082175][T14835] loop5: detected capacity change from 0 to 32768
[  359.086547][T14835] XFS: ikeep mount option is deprecated.
[  359.119647][T14835] XFS (loop5): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  359.140922][T14835] XFS (loop5): Ending clean mount
[  359.158355][T14835] XFS (loop5): Quotacheck needed: Please wait.
[  359.201234][T14835] XFS (loop5): Quotacheck: Done.
[  359.236489][ T9980] XFS (loop5): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  359.825412][T14869] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3501'.
[  359.836691][T14869] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3501'.
[  360.094820][T14883] binder: 14882:14883 ioctl 4018620d 0 returned -22
[  360.488303][T14895] Bluetooth: MGMT ver 1.23
[  360.573301][T14905] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3516'.
[  360.861541][T14919] input: syz0 as /devices/virtual/input/input11
[  361.973528][T14943] loop6: detected capacity change from 0 to 32768
[  362.013072][T14943] (syz.6.3534,14943,0):ocfs2_load_local_alloc:339 ERROR: inconsistent detected, clean journal with unrecovered local alloc, please run fsck.ocfs2!
[  362.013072][T14943] found = 0, set = 0, taken = 0, off = 1280
[  362.031906][T14943] (syz.6.3534,14943,0):ocfs2_load_local_alloc:356 ERROR: status = -22
[  362.035142][T14943] (syz.6.3534,14943,0):ocfs2_check_volume:2404 ERROR: status = -22
[  362.038290][T14943] (syz.6.3534,14943,0):ocfs2_check_volume:2432 ERROR: status = -22
[  362.041272][T14943] (syz.6.3534,14943,0):ocfs2_mount_volume:1764 ERROR: status = -22
[  362.051903][T14943] (syz.6.3534,14943,1):ocfs2_fill_super:1177 ERROR: status = -22
[  362.478557][T14968] loop5: detected capacity change from 0 to 32768
[  362.497692][T14968] 
[  362.497692][T14968]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  362.497692][T14968] 
[  362.600485][ T3588] read_mapping_page failed!
[  362.613668][ T3588] ERROR: (device loop5): txCommit: 
[  362.613668][ T3588] 
[  362.624926][ T3588] ERROR: (device loop5): remounting filesystem as read-only
[  362.632531][ T3588] jfs_write_inode: jfs_commit_inode failed!
[  362.634940][ T9980] 
[  362.634940][ T9980]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  362.634940][ T9980] 
[  362.644651][ T9980] 
[  362.644651][ T9980]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  362.644651][ T9980] 
[  362.836278][T15004] loop6: detected capacity change from 0 to 256
[  362.852517][T15004] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  362.878309][T15004] exFAT-fs (loop6): Medium has reported failures. Some data may be lost.
[  362.898073][T15004] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  363.018704][T15005] loop5: detected capacity change from 0 to 40427
[  363.026176][T15005] F2FS-fs (loop5): build fault injection rate: 14
[  363.040333][T15005] F2FS-fs (loop5): build fault injection type: 0x3bfe8c
[  363.055206][T15005] F2FS-fs (loop5): invalid crc value
[  363.064514][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  363.073035][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  363.168591][T15005] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  363.173226][T15005] F2FS-fs (loop5): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0
[  363.188320][T15005] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  363.238810][T15005] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  363.245795][T15005] F2FS-fs (loop5): inject dquot initialize in f2fs_dquot_initialize of f2fs_new_inode+0x509/0x1050
[  363.254661][T15005] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of __vfs_getxattr+0x3f4/0x430
[  363.305019][ T9980] syz-executor: attempt to access beyond end of device
[  363.305019][ T9980] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  363.311412][ T9980] CPU: 0 UID: 0 PID: 9980 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  363.311426][ T9980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  363.311431][ T9980] Call Trace:
[  363.311434][ T9980]  <TASK>
[  363.311438][ T9980]  dump_stack_lvl+0x189/0x250
[  363.311455][ T9980]  ? __pfx_dump_stack_lvl+0x10/0x10
[  363.311464][ T9980]  ? __pfx_queue_work_on+0x10/0x10
[  363.311472][ T9980]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  363.311482][ T9980]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  363.311494][ T9980]  f2fs_handle_critical_error+0x37c/0x540
[  363.311507][ T9980]  f2fs_write_end_io+0x886/0xb60
[  363.311526][ T9980]  __submit_merged_bio+0x27a/0x6a0
[  363.311538][ T9980]  __submit_merged_write_cond+0x255/0x530
[  363.311550][ T9980]  f2fs_write_data_pages+0x261d/0x3000
[  363.311574][ T9980]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  363.311608][ T9980]  ? folios_put_refs+0x559/0x640
[  363.311623][ T9980]  ? __pfx_folios_put_refs+0x10/0x10
[  363.311629][ T9980]  ? rcu_is_watching+0x15/0xb0
[  363.311641][ T9980]  ? __lock_acquire+0xab9/0xd20
[  363.311658][ T9980]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  363.311668][ T9980]  do_writepages+0x32e/0x550
[  363.311683][ T9980]  ? do_raw_spin_unlock+0x4d/0x240
[  363.311693][ T9980]  filemap_fdatawrite+0x199/0x240
[  363.311703][ T9980]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  363.311734][ T9980]  ? do_raw_spin_unlock+0x4d/0x240
[  363.311744][ T9980]  f2fs_sync_dirty_inodes+0x31f/0x830
[  363.311766][ T9980]  f2fs_write_checkpoint+0x95a/0x1df0
[  363.311786][ T9980]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  363.311817][ T9980]  ? kill_f2fs_super+0x298/0x6c0
[  363.311829][ T9980]  kill_f2fs_super+0x2c3/0x6c0
[  363.311841][ T9980]  ? __pfx_kill_f2fs_super+0x10/0x10
[  363.311849][ T9980]  ? radix_tree_delete_item+0x2b6/0x400
[  363.311861][ T9980]  ? shrinker_free+0x2ce/0x3e0
[  363.311871][ T9980]  deactivate_locked_super+0xbc/0x130
[  363.311881][ T9980]  cleanup_mnt+0x425/0x4c0
[  363.311890][ T9980]  ? lockdep_hardirqs_on+0x9c/0x150
[  363.311900][ T9980]  task_work_run+0x1d4/0x260
[  363.311911][ T9980]  ? __pfx_task_work_run+0x10/0x10
[  363.311919][ T9980]  ? __x64_sys_umount+0x122/0x160
[  363.311931][ T9980]  ? exit_to_user_mode_loop+0x40/0x110
[  363.311943][ T9980]  exit_to_user_mode_loop+0xec/0x110
[  363.311953][ T9980]  do_syscall_64+0x2bd/0x3b0
[  363.311987][ T9980]  ? lockdep_hardirqs_on+0x9c/0x150
[  363.311996][ T9980]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  363.312003][ T9980]  ? exc_page_fault+0x9f/0xf0
[  363.312012][ T9980]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  363.312019][ T9980] RIP: 0033:0x7fdfc8b8ff17
[  363.312028][ T9980] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  363.312034][ T9980] RSP: 002b:00007ffcf784af38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  363.312043][ T9980] RAX: 0000000000000000 RBX: 00007fdfc8c11c05 RCX: 00007fdfc8b8ff17
[  363.312048][ T9980] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcf784aff0
[  363.312052][ T9980] RBP: 00007ffcf784aff0 R08: 0000000000000000 R09: 0000000000000000
[  363.312056][ T9980] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcf784c080
[  363.312061][ T9980] R13: 00007fdfc8c11c05 R14: 00000000000598fe R15: 00007ffcf784c0c0
[  363.312073][ T9980]  </TASK>
[  363.312076][ T9980] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  363.667129][T15027] bond0: option lp_interval: invalid value (0)
[  363.677910][T15027] bond0: option lp_interval: allowed values 1 - 2147483647
[  363.896413][ T5947] Bluetooth: hci2: command 0x0c1a tx timeout
[  363.897236][ T9275] Bluetooth: hci2: Opcode 0x0c1a failed: -110
[  363.919691][ T9275] Bluetooth: hci2: Error when powering off device on rfkill (-110)
[  363.947410][T15032] loop5: detected capacity change from 0 to 32768
[  363.979744][T15032] ialloc: diAlloc returned -5!
[  364.037671][T15033] loop6: detected capacity change from 0 to 32768
[  364.055112][T15033] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.3559 (15033)
[  364.073859][T15033] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  364.085646][T15033] BTRFS info (device loop6): using sha256 (sha256-lib) checksum algorithm
[  364.098822][T15033] BTRFS info (device loop6): using free-space-tree
[  364.210294][T15053] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3561'.
[  364.221003][T11317] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  364.282469][   T33] audit: type=1326 audit(1755132693.843:7579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15056 comm="syz.5.3565" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdfc8b8ebe9 code=0x0
[  364.527239][T15069] loop6: detected capacity change from 0 to 1024
[  364.585020][T15069] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  364.603945][T15069] ext4 filesystem being mounted at /510/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  364.642218][T15076] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  364.684458][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  365.097736][T15095] loop6: detected capacity change from 0 to 16
[  365.101567][T15095] MTD: Attempt to mount non-MTD device "/dev/loop6"
[  365.176076][T15097] loop6: detected capacity change from 0 to 512
[  365.195642][T15097] EXT4-fs (loop6): Cannot turn on journaled quota: type 0: error -2
[  365.200319][T15097] EXT4-fs (loop6): Cannot turn on journaled quota: type 1: error -2
[  365.204385][T15097] EXT4-fs (loop6): 1 truncate cleaned up
[  365.209326][T15097] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  365.231822][T15097] EXT4-fs: user quota file already specified
[  365.260011][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  365.608368][T15100] loop6: detected capacity change from 0 to 32768
[  365.654518][T15100] syz.6.3580: attempt to access beyond end of device
[  365.654518][T15100] loop6: rw=0, sector=153240, nr_sectors = 8 limit=32768
[  365.673563][T15100] lbmIODone: I/O error in JFS log
[  365.676347][T15100] syz.6.3580: attempt to access beyond end of device
[  365.676347][T15100] loop6: rw=2049, sector=153240, nr_sectors = 8 limit=32768
[  365.681481][T15100] lbmIODone: I/O error in JFS log
[  365.691819][T15100] lmLogInit: exit(-5)
[  365.696622][T15100] lmLogOpen: exit(-5)
[  365.698278][T15100] jfs_mount_rw failed, return code = -5
[  365.708495][   T33] audit: type=1800 audit(1755132695.348:7580): pid=15114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.3585" name="file1" dev="tmpfs" ino=2563 res=0 errno=0
[  366.109080][T15128] loop6: detected capacity change from 0 to 128
[  366.115475][T15128] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  366.134907][T15128] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[  366.494634][T15127] loop5: detected capacity change from 0 to 32768
[  366.500077][T15127] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.3592 (15127)
[  366.516494][T15127] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  366.520764][T15127] BTRFS info (device loop5): using sha256 (sha256-lib) checksum algorithm
[  366.524010][T15127] BTRFS info (device loop5): using free-space-tree
[  366.590651][T15127] BTRFS info (device loop5): device stats zeroed by syz.5.3592 (15127)
[  366.620005][ T9980] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  366.869160][T15151] loop6: detected capacity change from 0 to 4096
[  366.897437][T15151] ntfs3(loop6): Failed to initialize $Extend/$ObjId.
[  367.818657][T15179] binder: 15178:15179 ioctl c00c6211 0 returned -14
[  368.109296][T15194] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3606'.
[  368.127812][T15194] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3606'.
[  368.522213][T15201] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  368.525445][T15201] IPv6: NLM_F_CREATE should be set when creating new route
[  368.750032][T15209] loop6: detected capacity change from 0 to 128
[  368.760478][T15209] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  368.770785][T15209] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[  368.883984][ T1090] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[  369.320701][T15234] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.3622'.
[  369.668553][T15244] loop5: detected capacity change from 0 to 128
[  369.693581][T15244] syz.5.3630: attempt to access beyond end of device
[  369.693581][T15244] loop5: rw=2051, sector=128, nr_sectors = 913 limit=128
[  370.326594][T15275] loop5: detected capacity change from 0 to 40427
[  370.388861][T15275] F2FS-fs (loop5): invalid crc value
[  370.443498][T15275] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  370.449558][T15275] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4
[  371.000516][T15300] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3654'.
[  371.038605][T15302] netlink: zone id is out of range
[  371.040405][T15302] netlink: set zone limit has 4 unknown bytes
[  371.576682][T15337] loop6: detected capacity change from 0 to 256
[  371.785956][T15337] exFAT-fs (loop6): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d18cac, utbl_chksum : 0xe619d30d)
[  371.849360][T15339] IPv6: NLM_F_CREATE should be specified when creating new route
[  371.860778][T15339] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  371.863941][T15339] IPv6: NLM_F_CREATE should be set when creating new route
[  371.866878][T15339] IPv6: NLM_F_CREATE should be set when creating new route
[  371.870021][T15339] IPv6: NLM_F_CREATE should be set when creating new route
[  371.874373][T15339] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  372.002674][T15347] tipc: Started in network mode
[  372.004770][T15347] tipc: Node identity 7, cluster identity 4711
[  372.007324][T15347] tipc: Node number set to 7
[  372.193624][T15357] loop6: detected capacity change from 0 to 512
[  372.226353][T15357] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  372.234947][T15357] ext4 filesystem being mounted at /541/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  372.259360][T15364] netlink: 392 bytes leftover after parsing attributes in process `syz.3.3680'.
[  372.289529][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  372.361977][T15370] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3683'.
[  373.482236][T15393] : entered promiscuous mode
[  373.528400][T15395] loop6: detected capacity change from 0 to 2048
[  373.531209][T15395] EXT4-fs: Ignoring removed mblk_io_submit option
[  373.554270][T15395] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  373.578786][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  373.809683][T15406] loop6: detected capacity change from 0 to 1024
[  373.846165][T15406] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  373.854567][T15406] ext4 filesystem being mounted at /554/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  373.889228][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  374.063850][T15418] loop6: detected capacity change from 0 to 2048
[  374.122763][T15420] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  374.174403][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  374.529845][T15439] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3713'.
[  374.534265][T15439] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3713'.
[  375.217086][T15455] sctp: [Deprecated]: syz.3.3721 (pid 15455) Use of struct sctp_assoc_value in delayed_ack socket option.
[  375.217086][T15455] Use struct sctp_sack_info instead
[  375.828303][T15472] netlink: 'syz.6.3728': attribute type 2 has an invalid length.
[  375.872960][T15472] bridge: entered promiscuous mode
[  376.036401][T15476] netlink: 'syz.6.3730': attribute type 12 has an invalid length.
[  376.194752][T15489] delete_channel: no stack
[  376.223797][T15490] loop5: detected capacity change from 0 to 1764
[  376.248360][T15490] loop5: detected capacity change from 0 to 128
[  376.251926][T15490] omfs: Bad value for 'dmask'
[  376.261488][T15490] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount.
[  376.270267][T15490] CIFS mount error: No usable UNC path provided in device string!
[  376.270267][T15490] 
[  376.273815][T15490] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string!
[  376.394616][T15504] netlink: 'syz.5.3744': attribute type 21 has an invalid length.
[  376.401525][T15504] netlink: 'syz.5.3744': attribute type 6 has an invalid length.
[  376.409277][T15504] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3744'.
[  376.459483][T15512] netlink: 324 bytes leftover after parsing attributes in process `syz.6.3748'.
[  376.465225][T15512] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3748'.
[  376.472710][T15512] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3748'.
[  376.533833][T15519] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3751'.
[  376.851137][ T9275] usb 7-1: new full-speed USB device number 10 using dummy_hcd
[  376.996440][ T9275] usb 7-1: config index 0 descriptor too short (expected 897, got 27)
[  376.999278][ T9275] usb 7-1: config 2 has an invalid interface number: 1 but max is -1
[  377.002100][ T9275] usb 7-1: config 2 has an invalid interface number: 1 but max is -1
[  377.006269][ T9275] usb 7-1: config 2 has 1 interface, different from the descriptor's value: 0
[  377.009313][ T9275] usb 7-1: config 2 has no interface number 0
[  377.014298][ T9275] usb 7-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=20.da
[  377.017355][ T9275] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  377.020468][ T9275] usb 7-1: Product: syz
[  377.023632][ T9275] usb 7-1: Manufacturer: syz
[  377.025291][ T9275] usb 7-1: SerialNumber: syz
[  377.236851][ T9275] cdc_ncm 7-1:2.1: CDC Union missing and no IAD found
[  377.243948][ T9275] cdc_ncm 7-1:2.1: bind() failure
[  377.250930][ T9275] usb 7-1: no audio or video endpoints found
[  377.255349][ T9275] usb 7-1: USB disconnect, device number 10
[  377.633480][T15539] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[  379.494349][T15566] loop6: detected capacity change from 0 to 262144
[  379.537435][T15566] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  379.542031][T15566] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  379.896177][T15599] (unnamed net_device) (uninitialized): option downdelay: invalid value (18446744073709551609)
[  379.899515][T15599] (unnamed net_device) (uninitialized): option downdelay: allowed values 0 - 2147483647
[  381.433598][T15642] loop6: detected capacity change from 0 to 40427
[  381.519245][T15642] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  381.529693][T15642] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  381.643813][T11317] syz-executor: attempt to access beyond end of device
[  381.643813][T11317] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  381.649935][T11317] CPU: 0 UID: 0 PID: 11317 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  381.649953][T11317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  381.649959][T11317] Call Trace:
[  381.649964][T11317]  <TASK>
[  381.649969][T11317]  dump_stack_lvl+0x189/0x250
[  381.649991][T11317]  ? __pfx_dump_stack_lvl+0x10/0x10
[  381.650005][T11317]  ? __pfx_queue_work_on+0x10/0x10
[  381.650017][T11317]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  381.650030][T11317]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  381.650052][T11317]  f2fs_handle_critical_error+0x37c/0x540
[  381.650072][T11317]  f2fs_write_end_io+0x886/0xb60
[  381.650102][T11317]  __submit_merged_bio+0x27a/0x6a0
[  381.650121][T11317]  __submit_merged_write_cond+0x255/0x530
[  381.650141][T11317]  f2fs_write_data_pages+0x261d/0x3000
[  381.650181][T11317]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  381.650239][T11317]  ? folios_put_refs+0x559/0x640
[  381.650264][T11317]  ? __lock_acquire+0xab9/0xd20
[  381.650286][T11317]  ? do_raw_spin_lock+0x121/0x290
[  381.650307][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  381.650321][T11317]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  381.650335][T11317]  do_writepages+0x32e/0x550
[  381.650358][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  381.650374][T11317]  filemap_fdatawrite+0x199/0x240
[  381.650390][T11317]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  381.650440][T11317]  ? do_raw_spin_unlock+0x4d/0x240
[  381.650456][T11317]  f2fs_sync_dirty_inodes+0x31f/0x830
[  381.650483][T11317]  f2fs_write_checkpoint+0x95a/0x1df0
[  381.650523][T11317]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  381.650574][T11317]  ? kill_f2fs_super+0x298/0x6c0
[  381.650595][T11317]  kill_f2fs_super+0x2c3/0x6c0
[  381.650614][T11317]  ? __pfx_kill_f2fs_super+0x10/0x10
[  381.650627][T11317]  ? radix_tree_delete_item+0x2b6/0x400
[  381.650646][T11317]  ? shrinker_free+0x2ce/0x3e0
[  381.650660][T11317]  deactivate_locked_super+0xbc/0x130
[  381.650675][T11317]  cleanup_mnt+0x425/0x4c0
[  381.650689][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  381.650703][T11317]  task_work_run+0x1d4/0x260
[  381.650722][T11317]  ? __pfx_task_work_run+0x10/0x10
[  381.650733][T11317]  ? __x64_sys_umount+0x122/0x160
[  381.650751][T11317]  ? exit_to_user_mode_loop+0x40/0x110
[  381.650769][T11317]  exit_to_user_mode_loop+0xec/0x110
[  381.650785][T11317]  do_syscall_64+0x2bd/0x3b0
[  381.650797][T11317]  ? lockdep_hardirqs_on+0x9c/0x150
[  381.650808][T11317]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  381.650821][T11317]  ? exc_page_fault+0x9f/0xf0
[  381.650834][T11317]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  381.650844][T11317] RIP: 0033:0x7f8a4138ff17
[  381.650878][T11317] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  381.650888][T11317] RSP: 002b:00007ffd3c0cff18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  381.650902][T11317] RAX: 0000000000000000 RBX: 00007f8a41411c05 RCX: 00007f8a4138ff17
[  381.650910][T11317] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3c0cffd0
[  381.650916][T11317] RBP: 00007ffd3c0cffd0 R08: 0000000000000000 R09: 0000000000000000
[  381.650921][T11317] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd3c0d1060
[  381.650928][T11317] R13: 00007f8a41411c05 R14: 000000000005e459 R15: 00007ffd3c0d10a0
[  381.650950][T11317]  </TASK>
[  381.650954][T11317] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  381.840529][T15665] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3811'.
[  381.844727][T15665] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3811'.
[  382.289238][T15681] loop5: detected capacity change from 0 to 256
[  382.324631][T15681] exFAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  382.348681][T15681] exFAT-fs (loop5): Medium has reported failures. Some data may be lost.
[  382.368340][T15681] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  382.816057][T15700] overlayfs: failed to clone lowerpath
[  382.828232][T15700] overlayfs: failed to clone upperpath
[  382.845292][T15686] loop5: detected capacity change from 0 to 32768
[  382.851492][T15686] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.3820 (15686)
[  382.872040][T15686] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  382.876240][T15686] BTRFS info (device loop5): using crc32c (crc32c-lib) checksum algorithm
[  382.881166][T15686] BTRFS info (device loop5): using free-space-tree
[  382.955324][T15686] BTRFS info (device loop5): rebuilding free space tree
[  383.050671][   T33] audit: type=1800 audit(1755132713.578:7581): pid=15686 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.3820" name="file1" dev="loop5" ino=260 res=0 errno=0
[  383.208421][   T33] audit: type=1326 audit(1755132713.757:7582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15726 comm="syz.6.3832" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x7ffc0000
[  383.240709][   T33] audit: type=1326 audit(1755132713.757:7583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15726 comm="syz.6.3832" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x7ffc0000
[  383.270043][   T33] audit: type=1326 audit(1755132713.757:7584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15726 comm="syz.6.3832" exe="/syz-executor" sig=0 arch=c000003e syscall=191 compat=0 ip=0x7f8a4138ebe9 code=0x7ffc0000
[  383.288538][   T33] audit: type=1326 audit(1755132713.757:7585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15726 comm="syz.6.3832" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x7ffc0000
[  383.324840][   T33] audit: type=1326 audit(1755132713.757:7586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15726 comm="syz.6.3832" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a4138ebe9 code=0x7ffc0000
[  383.455813][ T9980] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  384.426822][T15752] loop5: detected capacity change from 0 to 8
[  384.478757][T15752] SQUASHFS error: zlib decompression failed, data probably corrupt
[  384.482937][T15752] SQUASHFS error: Failed to read block 0x9b: -5
[  384.495928][T15752] SQUASHFS error: Unable to read metadata cache entry [99]
[  384.510284][T15752] SQUASHFS error: Unable to read inode 0x127
[  385.025114][T15761] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3846'.
[  386.382692][T15810] syz.5.3865 (15810): attempted to duplicate a private mapping with mremap.  This is not supported.
[  386.935426][T15822] loop5: detected capacity change from 0 to 1024
[  386.940947][T15822] EXT4-fs (loop5): stripe (2) is not aligned with cluster size (16), stripe is disabled
[  386.956890][T15822] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  387.003407][ T9980] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  387.040016][T15829] loop5: detected capacity change from 0 to 128
[  387.044462][T15829] UDF-fs: error (device loop5): udf_read_tagged: read failed, block=256, location=256
[  387.050550][T15829] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  387.500281][T15840] GUP no longer grows the stack in syz.6.3875 (15840): 200000004000-200000005000 (200000002000)
[  387.504244][T15840] CPU: 1 UID: 0 PID: 15840 Comm: syz.6.3875 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  387.504255][T15840] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  387.504260][T15840] Call Trace:
[  387.504263][T15840]  <TASK>
[  387.504266][T15840]  dump_stack_lvl+0x189/0x250
[  387.504280][T15840]  ? __pfx_dump_stack_lvl+0x10/0x10
[  387.504288][T15840]  ? __pfx__printk+0x10/0x10
[  387.504296][T15840]  ? find_vma+0xe7/0x160
[  387.504310][T15840]  __get_user_pages+0x24d0/0x2ce0
[  387.504327][T15840]  ? mtree_load+0x100/0x700
[  387.504340][T15840]  get_user_pages_remote+0x2f1/0xad0
[  387.504348][T15840]  ? __pfx_mtree_load+0x10/0x10
[  387.504358][T15840]  ? __pfx_get_user_pages_remote+0x10/0x10
[  387.504366][T15840]  ? __access_remote_vm+0x367/0x7d0
[  387.504376][T15840]  __access_remote_vm+0x211/0x7d0
[  387.504388][T15840]  ? __pfx___access_remote_vm+0x10/0x10
[  387.504398][T15840]  ? alloc_pages_noprof+0xbe/0x190
[  387.504408][T15840]  proc_pid_cmdline_read+0x430/0x810
[  387.504419][T15840]  ? __pfx_proc_pid_cmdline_read+0x10/0x10
[  387.504427][T15840]  ? rw_verify_area+0x2a6/0x4d0
[  387.504438][T15840]  vfs_readv+0x5aa/0x850
[  387.504445][T15840]  ? __pfx_proc_pid_cmdline_read+0x10/0x10
[  387.504460][T15840]  ? __pfx_vfs_readv+0x10/0x10
[  387.504473][T15840]  ? __fget_files+0x2a/0x420
[  387.504486][T15840]  ? __fget_files+0x3a0/0x420
[  387.504495][T15840]  ? __fget_files+0x2a/0x420
[  387.504508][T15840]  __x64_sys_preadv+0x197/0x2a0
[  387.504519][T15840]  ? __pfx___x64_sys_preadv+0x10/0x10
[  387.504527][T15840]  ? rcu_is_watching+0x15/0xb0
[  387.504537][T15840]  ? do_syscall_64+0xbe/0x3b0
[  387.504548][T15840]  do_syscall_64+0xfa/0x3b0
[  387.504556][T15840]  ? lockdep_hardirqs_on+0x9c/0x150
[  387.504564][T15840]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  387.504571][T15840]  ? exc_page_fault+0x9f/0xf0
[  387.504579][T15840]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  387.504586][T15840] RIP: 0033:0x7f8a4138ebe9
[  387.504592][T15840] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  387.504598][T15840] RSP: 002b:00007f8a4226a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[  387.504606][T15840] RAX: ffffffffffffffda RBX: 00007f8a415b5fa0 RCX: 00007f8a4138ebe9
[  387.504611][T15840] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003
[  387.504615][T15840] RBP: 00007f8a41411e19 R08: 00000000fffffff9 R09: 0000000000000000
[  387.504619][T15840] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000
[  387.504623][T15840] R13: 00007f8a415b6038 R14: 00007f8a415b5fa0 R15: 00007ffd3c0d0c88
[  387.504633][T15840]  </TASK>
[  387.661388][T15842] netlink: 14593 bytes leftover after parsing attributes in process `syz.6.3877'.
[  388.111252][T15864] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3887'.
[  388.149706][   T33] audit: type=1326 audit(1755132718.952:7587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15867 comm="syz.5.3888" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdfc8b8ebe9 code=0x0
[  388.677894][T15873] loop6: detected capacity change from 0 to 1024
[  388.713105][T15877] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3892'.
[  388.713806][T15873] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  388.723324][T15873] ext4 filesystem being mounted at /621/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  388.735162][   T33] audit: type=1800 audit(1755132719.562:7588): pid=15873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.3890" name="file1" dev="loop6" ino=15 res=0 errno=0
[  388.743763][T15873] EXT4-fs error (device loop6): ext4_map_blocks:814: inode #15: block 1: comm syz.6.3890: lblock 1 mapped to illegal pblock 1 (length 3)
[  388.759195][T15873] EXT4-fs error (device loop6): ext4_map_blocks:814: inode #15: block 3: comm syz.6.3890: lblock 3 mapped to illegal pblock 3 (length 1)
[  388.767879][T15873] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 117
[  388.777710][T15873] EXT4-fs (loop6): This should not happen!! Data will be lost
[  388.777710][T15873] 
[  388.834094][T15884] netlink: 'syz.3.3894': attribute type 11 has an invalid length.
[  389.079306][T15892] loop5: detected capacity change from 0 to 1024
[  389.156917][ T6959] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters
[  389.185413][ T6959] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 32 with max blocks 36 with error 28
[  389.193089][ T6959] EXT4-fs (loop6): This should not happen!! Data will be lost
[  389.193089][ T6959] 
[  389.200088][ T6959] EXT4-fs (loop6): Total free blocks count 0
[  389.202902][ T6959] EXT4-fs (loop6): Free/Dirty block details
[  389.209121][T15897] netlink: 3 bytes leftover after parsing attributes in process `+}[@'.
[  389.210956][ T6959] EXT4-fs (loop6): free_blocks=4293918720
[  389.221693][ T6959] EXT4-fs (loop6): dirty_blocks=48
[  389.232971][ T6959] EXT4-fs (loop6): Block reservation details
[  389.409858][T15913] netlink: 'syz.3.3908': attribute type 10 has an invalid length.
[  389.412709][T15913] bridge0: port 2(bridge_slave_1) entered disabled state
[  389.416447][T15913] bridge0: port 1(bridge_slave_0) entered disabled state
[  389.427089][T15913] bridge0: port 2(bridge_slave_1) entered blocking state
[  389.429533][T15913] bridge0: port 2(bridge_slave_1) entered forwarding state
[  389.432124][T15913] bridge0: port 1(bridge_slave_0) entered blocking state
[  389.434455][T15913] bridge0: port 1(bridge_slave_0) entered forwarding state
[  389.438577][T15913] bond0: (slave bridge0): Enslaving as an active interface with an up link
[  389.548396][T15927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3916'.
[  389.555067][T15927] bridge0: port 2(bridge_slave_1) entered disabled state
[  389.558019][T15927] bridge0: port 1(bridge_slave_0) entered disabled state
[  389.675928][T15945] syz.6.3922: attempt to access beyond end of device
[  389.675928][T15945] nbd6: rw=0, sector=2, nr_sectors = 2 limit=0
[  389.683620][T15945] vxfs: unable to read disk superblock at 1
[  389.686193][T15945] syz.6.3922: attempt to access beyond end of device
[  389.686193][T15945] nbd6: rw=0, sector=16, nr_sectors = 2 limit=0
[  389.692170][T15945] vxfs: unable to read disk superblock at 8
[  389.695153][T15945] vxfs: can't find superblock.
[  390.979617][T15979] loop6: detected capacity change from 0 to 4096
[  390.987355][T15979] ntfs3(loop6): Different NTFS sector size (4096) and media sector size (512).
[  390.997851][T15979] ntfs3(loop6): Mark volume as dirty due to NTFS errors
[  391.009344][T15979] ntfs3(loop6): volume is dirty and "force" flag is not set!
[  391.273189][T15985] loop6: detected capacity change from 0 to 32768
[  391.278338][T15985] (syz.6.3941,15985,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  391.295737][T15985] (syz.6.3941,15985,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  391.320421][T15985] (syz.6.3941,15985,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xcfdff595, computed 0xefed4a20. Applying ECC.
[  391.331499][T15985] JBD2: Ignoring recovery information on journal
[  391.376026][T15985] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode.
[  391.412498][T15985] (syz.6.3941,15985,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0x4e60244d, computed 0x8b393e9b. Applying ECC.
[  391.420570][T15985] (syz.6.3941,15985,0):ocfs2_block_check_validate:416 ERROR: Fixed CRC32 failed: stored: 0x4e60244d, computed 0x9b4be5b3
[  391.427386][T15985] (syz.6.3941,15985,0):ocfs2_trim_mainbm:7630 ERROR: status = -5
[  391.466894][T11317] ocfs2: Unmounting device (7,6) on (node local)
[  391.554884][T16012] usb usb6: usbfs: process 16012 (syz.6.3951) did not claim interface 63 before use
[  392.640681][T16047] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate.
[  392.663762][T16048] loop5: detected capacity change from 0 to 2048
[  392.676073][T16048] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  393.091342][T16086] loop6: detected capacity change from 0 to 64
[  393.114186][T16086] syz.6.3987: attempt to access beyond end of device
[  393.114186][T16086] loop6: rw=0, sector=16777216, nr_sectors = 2 limit=64
[  393.125311][T16086] Buffer I/O error on dev loop6, logical block 8388608, async page read
[  393.139776][T16086] syz.6.3987: attempt to access beyond end of device
[  393.139776][T16086] loop6: rw=0, sector=16777216, nr_sectors = 2 limit=64
[  393.151312][T16078] loop5: detected capacity change from 0 to 32768
[  393.152175][T16086] Buffer I/O error on dev loop6, logical block 8388608, async page read
[  393.291414][T16094] loop6: detected capacity change from 0 to 512
[  393.295082][T16094] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[  393.331280][T16094] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  393.357443][T16094] ext4 filesystem being mounted at /651/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  393.589654][T16099] loop5: detected capacity change from 0 to 32768
[  393.598089][T16099] ocfs2: Slot 0 on device (7,5) was already allocated to this node!
[  393.619962][T16099] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode.
[  393.708015][ T9980] ocfs2: Unmounting device (7,5) on (node local)
[  393.837774][T16115] loop5: detected capacity change from 0 to 256
[  393.844644][T16115] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xecfd5def, utbl_chksum : 0xe619d30d)
[  394.255828][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  395.317328][T16157] loop6: detected capacity change from 0 to 128
[  395.684330][T16178] loop6: detected capacity change from 0 to 512
[  395.687159][T16178] EXT4-fs: Ignoring removed bh option
[  395.697594][T16178] EXT4-fs (loop6): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock
[  395.716913][T16178] EXT4-fs (loop6): revision level too high, forcing read-only mode
[  395.768632][T16178] EXT4-fs (loop6): orphan cleanup on readonly fs
[  395.771315][T16178] EXT4-fs error (device loop6): ext4_quota_enable:7120: comm syz.6.4025: Bad quota inum: 4294967291, type: 0
[  395.778302][T16178] EXT4-fs (loop6): Remounting filesystem read-only
[  395.781069][T16178] EXT4-fs warning (device loop6): ext4_enable_quotas:7168: Failed to enable quota tracking (type=0, err=-117, ino=4294967291). Please run e2fsck to fix.
[  395.791342][T16178] EXT4-fs (loop6): Cannot turn on quotas: error -117
[  395.797591][T16178] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  396.086617][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  396.951286][T16220] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4040'.
[  396.965207][T16220] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4040'.
[  398.649378][T16270] overlayfs: failed to clone upperpath
[  399.286656][   T33] audit: type=1800 audit(1755132986.647:7589): pid=16278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.3.4069" name="/" dev="sockfs" ino=43041 res=0 errno=0
[  399.488885][T16298] tc_dump_action: action bad kind
[  400.112849][T16343] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4100'.
[  400.124714][T16344] trusted_key: syz.3.4099 sent an empty control message without MSG_MORE.
[  400.132707][T16343] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4100'.
[  400.852884][T16381] loop5: detected capacity change from 0 to 4096
[  401.452167][T16403] netlink: 6 bytes leftover after parsing attributes in process `syz.3.4128'.
[  401.456012][T16403] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  401.547305][   T24] usb 7-1: new full-speed USB device number 11 using dummy_hcd
[  401.669844][T16417] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4135'.
[  401.694580][   T24] usb 7-1: config 13 has an invalid interface number: 144 but max is 0
[  401.698990][   T24] usb 7-1: config 13 has no interface number 0
[  401.704166][   T24] usb 7-1: config 13 interface 144 has no altsetting 0
[  401.711420][   T24] usb 7-1: New USB device found, idVendor=19ab, idProduct=1000, bcdDevice= 1.01
[  401.715445][   T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  401.719194][   T24] usb 7-1: Product: syz
[  401.721042][   T24] usb 7-1: Manufacturer: syz
[  401.723230][   T24] usb 7-1: SerialNumber: syz
[  401.933693][   T24] usb 7-1: Found UVC 0.00 device syz (19ab:1000)
[  401.937032][   T24] usb 7-1: No valid video chain found.
[  401.944454][   T24] usb 7-1: USB disconnect, device number 11
[  402.442903][T16431] overlayfs: failed to clone upperpath
[  403.313599][T16440] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  403.709406][T16447] loop6: detected capacity change from 0 to 2048
[  403.738109][T16447] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  403.921668][T16453] loop5: detected capacity change from 0 to 64
[  403.935249][T16453] Unable to read inode block
[  403.944779][T16453] MINIX-fs: get root inode failed
[  404.428989][T16460] overlayfs: upper fs does not support tmpfile.
[  404.744906][T16472] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4159'.
[  404.981021][T16478] loop6: detected capacity change from 0 to 2048
[  405.004479][T16478] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024)
[  405.011027][T16478] NILFS (loop6): mounting unchecked fs
[  405.013029][T16478] NILFS (loop6): recovery required for readonly filesystem
[  405.013168][ T5956] udevd[5956]: incorrect nilfs2 checksum on /dev/loop6
[  405.031057][T16478] NILFS (loop6): write access will be enabled during recovery
[  405.060777][ T5956] udevd[5956]: incorrect nilfs2 checksum on /dev/loop6
[  405.061034][T16478] NILFS (loop6): norecovery option specified, skipping roll-forward recovery
[  405.106013][T16478] NILFS (loop6): couldn't remount because the filesystem is in an incomplete recovery state
[  405.225888][T16483] delete_channel: no stack
[  405.307028][T16486] loop6: detected capacity change from 0 to 512
[  405.312644][T16486] EXT4-fs (loop6): Test dummy encryption mode enabled
[  405.315237][T16486] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode
[  405.327073][T16486] EXT4-fs error (device loop6): ext4_orphan_get:1418: comm syz.6.4167: bad orphan inode 131083
[  405.340474][T16486] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  405.395747][T16486] fscrypt: AES-256-CBC-CTS using implementation "cts(cbc(ecb(aes-fixed-time)))"
[  405.486045][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  406.402544][T16502] loop6: detected capacity change from 0 to 8192
[  406.681039][T16512] loop5: detected capacity change from 0 to 2048
[  406.689475][T16512] UDF-fs: error (device loop5): udf_process_sequence: Primary Volume Descriptor not found!
[  406.695823][T16512] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  406.719504][ T9275] usb 7-1: new high-speed USB device number 12 using dummy_hcd
[  406.873447][ T9275] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  406.881073][ T9275] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  406.885039][ T9275] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  406.898148][ T9275] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  406.901208][ T9275] usb 7-1: SerialNumber: syz
[  406.994863][T16520] loop5: detected capacity change from 0 to 40427
[  407.046312][T16520] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  407.050306][T16520] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  407.075802][T16520] F2FS-fs (loop5): Inconsistent error blkaddr:5633, sit bitmap:0
[  407.078449][T16520] CPU: 0 UID: 0 PID: 16520 Comm: syz.5.4181 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  407.078463][T16520] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  407.078468][T16520] Call Trace:
[  407.078473][T16520]  <TASK>
[  407.078476][T16520]  dump_stack_lvl+0x189/0x250
[  407.078493][T16520]  ? __pfx_dump_stack_lvl+0x10/0x10
[  407.078502][T16520]  ? __pfx_f2fs_get_dnode_of_data+0x10/0x10
[  407.078520][T16520]  __f2fs_is_valid_blkaddr+0xd84/0x14f0
[  407.078534][T16520]  f2fs_map_blocks+0xd84/0x4130
[  407.078549][T16520]  ? __page_table_check_zero+0x406/0x530
[  407.078579][T16520]  ? __pfx_f2fs_map_blocks+0x10/0x10
[  407.078589][T16520]  ? xa_load+0x60/0x210
[  407.078605][T16520]  ? xa_load+0x1ea/0x210
[  407.078618][T16520]  f2fs_mpage_readpages+0xcb2/0x1ac0
[  407.078637][T16520]  ? __pfx_f2fs_mpage_readpages+0x10/0x10
[  407.078650][T16520]  ? __folio_batch_add_and_move+0x20a/0xd20
[  407.078666][T16520]  ? f2fs_readahead+0x177/0x330
[  407.078676][T16520]  read_pages+0x17a/0x580
[  407.078689][T16520]  ? __pfx_read_pages+0x10/0x10
[  407.078703][T16520]  ? filemap_add_folio+0x1af/0x270
[  407.078743][T16520]  page_cache_ra_unbounded+0x6b0/0x7b0
[  407.078763][T16520]  f2fs_readdir+0x49b/0xa60
[  407.078784][T16520]  ? __pfx_f2fs_readdir+0x10/0x10
[  407.078800][T16520]  ? down_read_killable+0x1d1/0x350
[  407.078812][T16520]  iterate_dir+0x399/0x570
[  407.078824][T16520]  __se_sys_getdents64+0xe4/0x260
[  407.078833][T16520]  ? __pfx___se_sys_getdents64+0x10/0x10
[  407.078841][T16520]  ? __pfx_filldir64+0x10/0x10
[  407.078850][T16520]  ? rcu_is_watching+0x15/0xb0
[  407.078859][T16520]  ? do_syscall_64+0xbe/0x3b0
[  407.078869][T16520]  do_syscall_64+0xfa/0x3b0
[  407.078877][T16520]  ? lockdep_hardirqs_on+0x9c/0x150
[  407.078885][T16520]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.078891][T16520]  ? exc_page_fault+0x9f/0xf0
[  407.078899][T16520]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.078906][T16520] RIP: 0033:0x7fdfc8b8ebe9
[  407.078914][T16520] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  407.078919][T16520] RSP: 002b:00007fdfc9a24038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  407.078928][T16520] RAX: ffffffffffffffda RBX: 00007fdfc8db5fa0 RCX: 00007fdfc8b8ebe9
[  407.078933][T16520] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
[  407.078937][T16520] RBP: 00007fdfc8c11e19 R08: 0000000000000000 R09: 0000000000000000
[  407.078941][T16520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  407.078945][T16520] R13: 00007fdfc8db6038 R14: 00007fdfc8db5fa0 R15: 00007ffcf784bca8
[  407.078956][T16520]  </TASK>
[  407.173480][ T9275] usb 7-1: 0:2 : does not exist
[  407.174522][T16520] F2FS-fs (loop5): Inconsistent error blkaddr:5633, sit bitmap:0
[  407.179946][T16520] CPU: 0 UID: 0 PID: 16520 Comm: syz.5.4181 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  407.179961][T16520] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  407.179966][T16520] Call Trace:
[  407.179971][T16520]  <TASK>
[  407.179974][T16520]  dump_stack_lvl+0x189/0x250
[  407.179989][T16520]  ? __pfx_dump_stack_lvl+0x10/0x10
[  407.180000][T16520]  ? __pfx_f2fs_get_dnode_of_data+0x10/0x10
[  407.180017][T16520]  ? __filemap_get_folio+0x79f/0xaf0
[  407.180027][T16520]  ? __pfx_f2fs_lookup_read_extent_cache_block+0x10/0x10
[  407.180040][T16520]  __f2fs_is_valid_blkaddr+0xd84/0x14f0
[  407.180053][T16520]  f2fs_get_read_data_folio+0x3d2/0x7d0
[  407.180061][T16520]  ? __pfx_folio_mark_accessed+0x10/0x10
[  407.180071][T16520]  ? __pfx_f2fs_get_read_data_folio+0x10/0x10
[  407.180083][T16520]  ? __filemap_get_folio+0x79f/0xaf0
[  407.180094][T16520]  f2fs_find_data_folio+0x195/0x3c0
[  407.180104][T16520]  f2fs_readdir+0x4b0/0xa60
[  407.180121][T16520]  ? __pfx_f2fs_readdir+0x10/0x10
[  407.180137][T16520]  ? down_read_killable+0x1d1/0x350
[  407.180148][T16520]  iterate_dir+0x399/0x570
[  407.180160][T16520]  __se_sys_getdents64+0xe4/0x260
[  407.180170][T16520]  ? __pfx___se_sys_getdents64+0x10/0x10
[  407.180178][T16520]  ? __pfx_filldir64+0x10/0x10
[  407.180187][T16520]  ? rcu_is_watching+0x15/0xb0
[  407.180197][T16520]  ? do_syscall_64+0xbe/0x3b0
[  407.180209][T16520]  do_syscall_64+0xfa/0x3b0
[  407.180218][T16520]  ? lockdep_hardirqs_on+0x9c/0x150
[  407.180226][T16520]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.180233][T16520]  ? exc_page_fault+0x9f/0xf0
[  407.180245][T16520]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.180256][T16520] RIP: 0033:0x7fdfc8b8ebe9
[  407.180266][T16520] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  407.180274][T16520] RSP: 002b:00007fdfc9a24038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[  407.180286][T16520] RAX: ffffffffffffffda RBX: 00007fdfc8db5fa0 RCX: 00007fdfc8b8ebe9
[  407.180295][T16520] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
[  407.180303][T16520] RBP: 00007fdfc8c11e19 R08: 0000000000000000 R09: 0000000000000000
[  407.180308][T16520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  407.180313][T16520] R13: 00007fdfc8db6038 R14: 00007fdfc8db5fa0 R15: 00007ffcf784bca8
[  407.180325][T16520]  </TASK>
[  407.180842][T16526] F2FS-fs (loop5): Inconsistent error blkaddr:5633, sit bitmap:0
[  407.259936][T16526] CPU: 0 UID: 0 PID: 16526 Comm: syz.5.4181 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  407.259952][T16526] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  407.259957][T16526] Call Trace:
[  407.259962][T16526]  <TASK>
[  407.259966][T16526]  dump_stack_lvl+0x189/0x250
[  407.259983][T16526]  ? __pfx_dump_stack_lvl+0x10/0x10
[  407.259992][T16526]  ? __pfx_f2fs_get_dnode_of_data+0x10/0x10
[  407.260007][T16526]  ? __filemap_get_folio+0x79f/0xaf0
[  407.260016][T16526]  ? __pfx_f2fs_lookup_read_extent_cache_block+0x10/0x10
[  407.260029][T16526]  __f2fs_is_valid_blkaddr+0xd84/0x14f0
[  407.260045][T16526]  f2fs_get_read_data_folio+0x3d2/0x7d0
[  407.260053][T16526]  ? __pfx_folio_mark_accessed+0x10/0x10
[  407.260062][T16526]  ? __pfx_f2fs_get_read_data_folio+0x10/0x10
[  407.260073][T16526]  ? __filemap_get_folio+0x79f/0xaf0
[  407.260083][T16526]  f2fs_find_data_folio+0x195/0x3c0
[  407.260092][T16526]  f2fs_readdir+0x4b0/0xa60
[  407.260110][T16526]  ? __pfx_f2fs_readdir+0x10/0x10
[  407.260126][T16526]  ? down_read_killable+0x1d1/0x350
[  407.260138][T16526]  iterate_dir+0x399/0x570
[  407.260147][T16526]  ? 0xffffffff81000000
[  407.260155][T16526]  __se_sys_getdents+0xe4/0x250
[  407.260164][T16526]  ? __pfx___se_sys_getdents+0x10/0x10
[  407.260172][T16526]  ? exc_page_fault+0x76/0xf0
[  407.260179][T16526]  ? __pfx_filldir+0x10/0x10
[  407.260188][T16526]  ? 0xffffffff81000000
[  407.260194][T16526]  ? rcu_is_watching+0x15/0xb0
[  407.260204][T16526]  ? do_syscall_64+0xbe/0x3b0
[  407.260214][T16526]  do_syscall_64+0xfa/0x3b0
[  407.260222][T16526]  ? lockdep_hardirqs_on+0x9c/0x150
[  407.260229][T16526]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.260236][T16526]  ? exc_page_fault+0x9f/0xf0
[  407.260244][T16526]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.260251][T16526] RIP: 0033:0x7fdfc8b8ebe9
[  407.260257][T16526] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  407.260263][T16526] RSP: 002b:00007fdfc9a03038 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
[  407.260272][T16526] RAX: ffffffffffffffda RBX: 00007fdfc8db6090 RCX: 00007fdfc8b8ebe9
[  407.260278][T16526] RDX: 0000000000000058 RSI: ffffffff81000000 RDI: 0000000000000006
[  407.260282][T16526] RBP: 00007fdfc8c11e19 R08: 0000000000000000 R09: 0000000000000000
[  407.260286][T16526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  407.260290][T16526] R13: 00007fdfc8db6128 R14: 00007fdfc8db6090 R15: 00007ffcf784bca8
[  407.260299][T16526]  ? 0xffffffff81000000
[  407.260306][T16526]  </TASK>
[  407.353053][ T9275] usb 7-1: USB disconnect, device number 12
[  407.373953][ T5956] udevd[5956]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  407.400368][ T9980] syz-executor: attempt to access beyond end of device
[  407.400368][ T9980] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  407.407169][ T9980] CPU: 1 UID: 0 PID: 9980 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  407.407183][ T9980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  407.407188][ T9980] Call Trace:
[  407.407191][ T9980]  <TASK>
[  407.407195][ T9980]  dump_stack_lvl+0x189/0x250
[  407.407211][ T9980]  ? __pfx_dump_stack_lvl+0x10/0x10
[  407.407220][ T9980]  ? __pfx_queue_work_on+0x10/0x10
[  407.407229][ T9980]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  407.407238][ T9980]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  407.407249][ T9980]  f2fs_handle_critical_error+0x37c/0x540
[  407.407262][ T9980]  f2fs_write_end_io+0x886/0xb60
[  407.407279][ T9980]  __submit_merged_bio+0x27a/0x6a0
[  407.407290][ T9980]  __submit_merged_write_cond+0x255/0x530
[  407.407301][ T9980]  f2fs_write_data_pages+0x261d/0x3000
[  407.407323][ T9980]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  407.407330][ T9980]  ? is_bpf_text_address+0x26/0x2b0
[  407.407358][ T9980]  ? ktime_get+0x3e/0x1f0
[  407.407366][ T9980]  ? ktime_get+0x3e/0x1f0
[  407.407373][ T9980]  ? seqcount_lockdep_reader_access+0x15f/0x1c0
[  407.407381][ T9980]  ? __pfx_seqcount_lockdep_reader_access+0x10/0x10
[  407.407393][ T9980]  ? rcu_is_watching+0x15/0xb0
[  407.407404][ T9980]  ? __lock_acquire+0xab9/0xd20
[  407.407421][ T9980]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  407.407429][ T9980]  do_writepages+0x32e/0x550
[  407.407444][ T9980]  ? do_raw_spin_unlock+0x4d/0x240
[  407.407453][ T9980]  filemap_fdatawrite+0x199/0x240
[  407.407463][ T9980]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  407.407489][ T9980]  ? do_raw_spin_unlock+0x4d/0x240
[  407.407499][ T9980]  f2fs_sync_dirty_inodes+0x31f/0x830
[  407.407520][ T9980]  f2fs_write_checkpoint+0x95a/0x1df0
[  407.407538][ T9980]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  407.407565][ T9980]  ? kill_f2fs_super+0x298/0x6c0
[  407.407577][ T9980]  kill_f2fs_super+0x2c3/0x6c0
[  407.407588][ T9980]  ? __pfx_kill_f2fs_super+0x10/0x10
[  407.407596][ T9980]  ? radix_tree_delete_item+0x2b6/0x400
[  407.407607][ T9980]  ? shrinker_free+0x2ce/0x3e0
[  407.407617][ T9980]  deactivate_locked_super+0xbc/0x130
[  407.407625][ T9980]  cleanup_mnt+0x425/0x4c0
[  407.407633][ T9980]  ? lockdep_hardirqs_on+0x9c/0x150
[  407.407642][ T9980]  task_work_run+0x1d4/0x260
[  407.407652][ T9980]  ? __pfx_task_work_run+0x10/0x10
[  407.407659][ T9980]  ? __x64_sys_umount+0x122/0x160
[  407.407670][ T9980]  ? exit_to_user_mode_loop+0x40/0x110
[  407.407682][ T9980]  exit_to_user_mode_loop+0xec/0x110
[  407.407691][ T9980]  do_syscall_64+0x2bd/0x3b0
[  407.407699][ T9980]  ? lockdep_hardirqs_on+0x9c/0x150
[  407.407706][ T9980]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.407735][ T9980]  ? exc_page_fault+0x9f/0xf0
[  407.407743][ T9980]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  407.407750][ T9980] RIP: 0033:0x7fdfc8b8ff17
[  407.407758][ T9980] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  407.407764][ T9980] RSP: 002b:00007ffcf784af38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  407.407773][ T9980] RAX: 0000000000000000 RBX: 00007fdfc8c11c05 RCX: 00007fdfc8b8ff17
[  407.407778][ T9980] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcf784aff0
[  407.407782][ T9980] RBP: 00007ffcf784aff0 R08: 0000000000000000 R09: 0000000000000000
[  407.407786][ T9980] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcf784c080
[  407.407790][ T9980] R13: 00007fdfc8c11c05 R14: 0000000000064e15 R15: 00007ffcf784c0c0
[  407.407801][ T9980]  </TASK>
[  407.407804][ T9980] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  408.664583][T16571] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4198'.
[  409.160895][T16608] loop5: detected capacity change from 0 to 16
[  409.350044][T16608] erofs (device loop5): mounted with root inode @ nid 36.
[  410.239819][T16653] kernel read not supported for file / 7âW)s!Qfsl{Tr)rO2:"T+͟v|ղADvc֠6xc: (pid: 16653 comm: syz.3.4234)
[  410.245216][   T33] audit: type=1800 audit(1755133254.160:7590): pid=16653 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.4234" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B2414476638E93D8D6A0C536D278E3633A dev="mqueue" ino=43589 res=0 errno=0
[  410.923352][T16676] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  410.996011][  T794] usb 7-1: new high-speed USB device number 13 using dummy_hcd
[  411.150088][  T794] usb 7-1: Using ep0 maxpacket: 16
[  411.154654][  T794] usb 7-1: config 0 has an invalid interface number: 49 but max is 0
[  411.158548][  T794] usb 7-1: config 0 has no interface number 0
[  411.160781][  T794] usb 7-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16
[  411.164333][  T794] usb 7-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x69, changing to 0x9
[  411.174236][  T794] usb 7-1: config 0 interface 49 altsetting 0 endpoint 0x9 has an invalid bInterval 0, changing to 7
[  411.184077][  T794] usb 7-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7
[  411.190059][  T794] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  411.193352][  T794] usb 7-1: Product: syz
[  411.194952][  T794] usb 7-1: Manufacturer: syz
[  411.197928][  T794] usb 7-1: SerialNumber: syz
[  411.203456][  T794] usb 7-1: config 0 descriptor??
[  411.207640][T16672] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  411.422353][  T794] usb 7-1: USB disconnect, device number 13
[  411.831145][T16692] loop5: detected capacity change from 0 to 64
[  411.852344][T16692] BFS-fs: bfs_fill_super(): loop5 is unclean, continuing
[  412.747054][T16708] loop6: detected capacity change from 0 to 512
[  412.756468][T16708] EXT4-fs (loop6): Test dummy encryption mode enabled
[  412.762293][T16708] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode
[  412.783605][T16708] EXT4-fs error (device loop6): ext4_orphan_get:1418: comm syz.6.4259: bad orphan inode 131083
[  412.796588][T16708] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  412.828151][T16708] fscrypt: AES-256-XTS using implementation "xts(ecb(aes-fixed-time))"
[  412.860785][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  413.211730][T16740] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4273'.
[  413.819247][T16758] loop6: detected capacity change from 0 to 8
[  413.838140][T16760] tmpfs: Bad value for 'mpol'
[  414.366150][T16782] loop6: detected capacity change from 0 to 4096
[  414.372597][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc0c00
[  414.375958][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc0c00
[  414.381626][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc0c00
[  414.384791][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc0c00
[  414.392973][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc1c00
[  414.404024][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc2c00
[  414.407784][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc4c00
[  414.411186][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffc8c00
[  414.439154][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffd0c00
[  414.442500][T16782] ntfs3(loop6): try to read out of volume at offset 0x3fffffe0c00
[  415.460443][T16801] loop5: detected capacity change from 0 to 32768
[  415.506034][T16801] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  415.589806][T16801] XFS (loop5): Ending clean mount
[  415.631558][T16801] XFS (loop5): Quotacheck needed: Please wait.
[  415.679376][T16801] XFS (loop5): Quotacheck: Done.
[  415.753051][ T9980] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  416.195648][T16834] netlink: 'syz.3.4314': attribute type 1 has an invalid length.
[  416.198919][T16834] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4314'.
[  416.268417][T16838] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.4316'.
[  417.233549][ T9275] usb 7-1: new high-speed USB device number 14 using dummy_hcd
[  417.415544][ T9275] usb 7-1: Using ep0 maxpacket: 32
[  417.421945][ T9275] usb 7-1: config 0 has an invalid interface number: 239 but max is 0
[  417.425630][ T9275] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  417.428918][ T9275] usb 7-1: config 0 has no interface number 0
[  417.431218][ T9275] usb 7-1: config 0 interface 239 altsetting 4 bulk endpoint 0x2 has invalid maxpacket 8
[  417.437036][ T9275] usb 7-1: config 0 interface 239 altsetting 4 endpoint 0x8 has invalid maxpacket 1023, setting to 64
[  417.441129][ T9275] usb 7-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xA9, changing to 0x89
[  417.449641][ T9275] usb 7-1: config 0 interface 239 altsetting 4 endpoint 0x89 has invalid maxpacket 28648, setting to 1024
[  417.462908][ T9275] usb 7-1: config 0 interface 239 altsetting 4 bulk endpoint 0x89 has invalid maxpacket 1024
[  417.466444][ T9275] usb 7-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xD5, changing to 0x85
[  417.470477][ T9275] usb 7-1: config 0 interface 239 altsetting 4 endpoint 0x85 has an invalid bInterval 0, changing to 7
[  417.475564][ T9275] usb 7-1: config 0 interface 239 has no altsetting 0
[  417.480403][ T9275] usb 7-1: New USB device found, idVendor=105b, idProduct=1799, bcdDevice=36.e9
[  417.484417][ T9275] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  417.487708][ T9275] usb 7-1: Product: syz
[  417.489227][ T9275] usb 7-1: Manufacturer: syz
[  417.495595][ T9275] usb 7-1: SerialNumber: syz
[  417.499295][ T9275] usb 7-1: config 0 descriptor??
[  417.511291][T16858] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  417.514573][T16858] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  417.738743][ T9275] usb 7-1: USB disconnect, device number 14
[  417.742174][ T5947] Bluetooth: hci3: BCM: Reset failed (-71)
[  418.406029][   T33] audit: type=1326 audit(1755133262.727:7591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16913 comm="syz.3.4349" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f392b98ebe9 code=0x0
[  418.533224][T16910] loop6: detected capacity change from 0 to 32768
[  418.538202][T16910] XFS: noikeep mount option is deprecated.
[  418.570849][T16910] XFS (loop6): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[  418.598899][T16910] XFS (loop6): Ending clean mount
[  418.609094][T16910] XFS (loop6): Quotacheck needed: Please wait.
[  418.664125][T16910] XFS (loop6): Quotacheck: Done.
[  418.731548][T11317] XFS (loop6): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[  419.952622][T16953] loop6: detected capacity change from 0 to 8192
[  420.321464][ T9275] usb 7-1: new high-speed USB device number 15 using dummy_hcd
[  420.473073][ T9275] usb 7-1: Using ep0 maxpacket: 32
[  420.477235][ T9275] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  420.481607][ T9275] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2
[  420.485430][ T9275] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  420.495003][ T9275] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  420.503568][ T9275] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  420.509345][ T9275] usb 7-1: Product: syz
[  420.512067][ T9275] usb 7-1: Manufacturer: syz
[  420.515261][ T9275] usb 7-1: SerialNumber: syz
[  420.526998][ T9275] cdc_ncm 7-1:1.0: skipping garbage
[  420.535936][ T9275] cdc_ncm 7-1:1.0: CDC Union missing and no IAD found
[  420.539354][ T9275] cdc_ncm 7-1:1.0: bind() failure
[  420.721102][ T9275] usb 7-1: USB disconnect, device number 15
[  421.041170][T16977] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4373'.
[  421.089064][T16981] netlink: 'syz.3.4375': attribute type 10 has an invalid length.
[  421.099752][T16981] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets).
[  421.235303][T16986] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[  421.240282][T16986] team0: Device ipvlan2 is already an upper device of the team interface
[  421.478524][T17006] loop5: detected capacity change from 0 to 128
[  421.492051][T17006] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback.
[  421.501697][T17006] ext4 filesystem being mounted at /655/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  421.516104][T17006] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:375: inode #2: comm syz.5.4387: No space for directory leaf checksum. Please run e2fsck -D.
[  421.528448][T17006] EXT4-fs error (device loop5): htree_dirblock_to_tree:1051: inode #2: comm syz.5.4387: Directory block failed checksum
[  421.580409][ T9980] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  421.769214][T17021] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4392'.
[  421.775479][T17021] vlan0: entered promiscuous mode
[  422.018365][T17027] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4394'.
[  422.341559][T17033] netlink: 'syz.3.4397': attribute type 21 has an invalid length.
[  422.578458][T17037] loop6: detected capacity change from 0 to 1024
[  422.588333][T17037] EXT4-fs (loop6): stripe (3) is not aligned with cluster size (16), stripe is disabled
[  422.603893][T17037] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  422.629825][T17037] EXT4-fs (loop6): re-mounted 00000000-0000-0000-0000-000000000000.
[  422.640172][T17037] EXT4-fs error (device loop6): ext4_xattr_inode_iget:437: inode #11: comm syz.6.4399: missing EA_INODE flag
[  422.654033][T17037] EXT4-fs (loop6): Remounting filesystem read-only
[  422.714906][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  422.823463][T17041] loop6: detected capacity change from 0 to 65
[  422.844247][T17041] BFS-fs: bfs_fill_super(): loop6 is unclean, continuing
[  422.853015][T17041] BFS-fs: bfs_fill_super(): NOTE: filesystem loop6 was created with 512 inodes, the real maximum is 511, mounting anyway
[  424.017505][T17056] loop5: detected capacity change from 0 to 64
[  424.725548][T17082] loop5: detected capacity change from 0 to 32768
[  424.779341][T17082] ERROR: (device loop5): dbAlloc: the hint is outside the map
[  424.779341][T17082] 
[  424.786587][T17082] ERROR: (device loop5): remounting filesystem as read-only
[  424.789199][T17082] ialloc: diAlloc returned -5!
[  425.322942][T17120] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received
[  426.133284][T17139] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4443'.
[  426.855906][T17148] delete_channel: no stack
[  427.558273][T17152] loop6: detected capacity change from 0 to 32768
[  427.569062][T17152] jfs_mount: dbMount failed w/rc = -5
[  427.571524][T17152] Mount JFS Failure: -5
[  427.573288][T17152] jfs_mount failed w/return code = -5
[  427.972918][T17166] loop6: detected capacity change from 0 to 128
[  428.003309][T17166] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  428.014408][T17166] ext4 filesystem being mounted at /790/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[  428.098327][T11317] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  428.353886][T17174] loop6: detected capacity change from 0 to 2048
[  428.383549][T17174] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  428.439222][   T33] audit: type=1800 audit(1755133273.237:7592): pid=17174 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.4455" name="bus" dev="loop6" ino=18 res=0 errno=0
[  428.476695][T11317] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  429.000287][T17207] qrtr: Invalid version 0
[  429.033363][T17209] loop6: detected capacity change from 0 to 8
[  429.037866][T17209] MTD: Attempt to mount non-MTD device "/dev/loop6"
[  429.546576][   T24] usb 7-1: new high-speed USB device number 16 using dummy_hcd
[  429.806713][   T24] usb 7-1: Using ep0 maxpacket: 8
[  429.819375][   T24] usb 7-1: config 0 has an invalid interface number: 1 but max is 0
[  429.825652][   T24] usb 7-1: config 0 has no interface number 0
[  429.836400][   T24] usb 7-1: config 0 interface 1 has no altsetting 0
[  429.844031][   T24] usb 7-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f
[  429.854555][   T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  429.857968][   T24] usb 7-1: Product: syz
[  429.864315][   T24] usb 7-1: Manufacturer: syz
[  429.866264][   T24] usb 7-1: SerialNumber: syz
[  429.883730][   T24] usb 7-1: config 0 descriptor??
[  430.088046][   T24] i2c-cp2615 7-1:0.1: probe with driver i2c-cp2615 failed with error -22
[  430.366374][   T24] usb 7-1: USB disconnect, device number 16
[  431.543082][T17281] bridge: RTM_NEWNEIGH with invalid ether address
[  432.066155][T17297] netlink: 76 bytes leftover after parsing attributes in process `syz.6.4504'.
[  432.659752][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  432.878147][T17315] netlink: 'syz.3.4515': attribute type 10 has an invalid length.
[  432.895075][T17315] team0: Port device team_slave_0 removed
[  433.699537][T17332] loop6: detected capacity change from 0 to 2048
[  433.704354][T17332] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024)
[  433.707928][T17332] NILFS (loop6): mounting unchecked fs
[  433.709989][T17332] NILFS (loop6): recovery required for readonly filesystem
[  433.715643][T17332] NILFS (loop6): write access will be enabled during recovery
[  433.717733][ T5956] udevd[5956]: incorrect nilfs2 checksum on /dev/loop6
[  433.719723][T17332] NILFS (loop6): norecovery option specified, skipping roll-forward recovery
[  433.739082][ T5956] udevd[5956]: incorrect nilfs2 checksum on /dev/loop6
[  434.111443][   T24] usb 7-1: new high-speed USB device number 17 using dummy_hcd
[  434.255068][   T24] usb 7-1: Using ep0 maxpacket: 8
[  434.259973][   T24] usb 7-1: config 0 has no interfaces?
[  434.262052][   T24] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  434.267712][   T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  434.282476][   T24] usb 7-1: config 0 descriptor??
[  434.666927][  T794] usb 7-1: USB disconnect, device number 17
[  435.250622][T17371] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4538'.
[  435.574862][T17392] netlink: 'syz.5.4547': attribute type 11 has an invalid length.
[  436.179140][T17414] loop6: detected capacity change from 0 to 256
[  436.191983][T17414] FAT-fs (loop6): Directory bread(block 64) failed
[  436.194724][T17414] FAT-fs (loop6): Directory bread(block 65) failed
[  436.197624][T17414] FAT-fs (loop6): Directory bread(block 66) failed
[  436.200281][T17414] FAT-fs (loop6): Directory bread(block 67) failed
[  436.203100][T17414] FAT-fs (loop6): Directory bread(block 68) failed
[  436.205908][T17414] FAT-fs (loop6): Directory bread(block 69) failed
[  436.208988][T17414] FAT-fs (loop6): Directory bread(block 70) failed
[  436.211779][T17414] FAT-fs (loop6): Directory bread(block 71) failed
[  436.214767][T17414] FAT-fs (loop6): Directory bread(block 72) failed
[  436.218129][T17414] FAT-fs (loop6): Directory bread(block 73) failed
[  436.519435][T17429] netlink: 3 bytes leftover after parsing attributes in process `syz.6.4564'.
[  436.524791][T17429] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  436.657039][T17437] loop5: detected capacity change from 0 to 64
[  436.669631][   T33] audit: type=1800 audit(1755133281.899:7593): pid=17437 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.4568" name="file1" dev="loop5" ino=5 res=0 errno=0
[  436.874761][T17443] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4567'.
[  437.835320][T17463] ieee802154 phy0 wpan0: encryption failed: -22
[  438.318918][T17469] loop5: detected capacity change from 0 to 32768
[  438.478608][T17475] Mount JFS Failure: -22
[  438.768933][   T24] usb 7-1: new full-speed USB device number 18 using dummy_hcd
[  438.961284][   T24] usb 7-1: config 0 has an invalid interface number: 147 but max is 0
[  438.965692][   T24] usb 7-1: config 0 has no interface number 0
[  438.969758][   T24] usb 7-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
[  438.994238][   T24] usb 7-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03
[  438.999220][   T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  439.002977][   T24] usb 7-1: Product: syz
[  439.005229][   T24] usb 7-1: Manufacturer: syz
[  439.007828][   T24] usb 7-1: SerialNumber: syz
[  439.128659][   T24] usb 7-1: config 0 descriptor??
[  439.135868][T17479] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  439.249062][   T24] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work!
[  439.351215][   T24] usb 7-1: USB disconnect, device number 18
[  439.351587][   T13] usb 7-1: Failed to submit usb control message: -71
[  439.357043][   T13] usb 7-1: unable to send the bmi data to the device: -71
[  439.363481][   T13] usb 7-1: unable to get target info from device
[  439.365936][   T13] usb 7-1: could not get target info (-71)
[  439.368134][   T13] usb 7-1: could not probe fw (-71)
[  439.712426][T17507] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4594'.
[  439.717465][T17507] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  440.080326][T17518] loop6: detected capacity change from 0 to 65536
[  440.096383][T17532] ==================================================================
[  440.099077][T17532] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[  440.101770][T17532] Read of size 2 at addr ffff888109cd4ec2 by task syz.3.4605/17532
[  440.104791][T17532] 
[  440.105850][T17532] CPU: 1 UID: 0 PID: 17532 Comm: syz.3.4605 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  440.105861][T17532] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  440.105866][T17532] Call Trace:
[  440.105870][T17532]  <TASK>
[  440.105874][T17532]  dump_stack_lvl+0x189/0x250
[  440.105886][T17532]  ? __kasan_check_byte+0x12/0x40
[  440.105899][T17532]  ? __pfx_dump_stack_lvl+0x10/0x10
[  440.105908][T17532]  ? lock_release+0x4b/0x3e0
[  440.105920][T17532]  ? __virt_addr_valid+0x4a5/0x5c0
[  440.105933][T17532]  print_report+0xca/0x240
[  440.105940][T17532]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  440.105949][T17532]  kasan_report+0x118/0x150
[  440.105958][T17532]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  440.105967][T17532]  __xfrm_state_lookup+0x6ad/0x8d0
[  440.105977][T17532]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  440.105988][T17532]  ? xfrm_state_lookup+0x45/0x1e0
[  440.105999][T17532]  xfrm_state_lookup+0x11e/0x1e0
[  440.106013][T17532]  pfkey_delete+0x357/0x6d0
[  440.106026][T17532]  ? __pfx_pfkey_delete+0x10/0x10
[  440.106036][T17532]  ? kmem_cache_free+0x18f/0x400
[  440.106050][T17532]  pfkey_sendmsg+0xbfe/0x1090
[  440.106062][T17532]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  440.106074][T17532]  ? aa_sock_msg_perm+0xf1/0x1d0
[  440.106083][T17532]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  440.106091][T17532]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  440.106099][T17532]  __sock_sendmsg+0x21c/0x270
[  440.106107][T17532]  ____sys_sendmsg+0x505/0x830
[  440.106117][T17532]  ? __pfx_____sys_sendmsg+0x10/0x10
[  440.106127][T17532]  ? import_iovec+0x74/0xa0
[  440.106134][T17532]  ___sys_sendmsg+0x21f/0x2a0
[  440.106143][T17532]  ? __pfx____sys_sendmsg+0x10/0x10
[  440.106157][T17532]  ? __fget_files+0x2a/0x420
[  440.106167][T17532]  ? __fget_files+0x3a0/0x420
[  440.106177][T17532]  __x64_sys_sendmsg+0x19b/0x260
[  440.106186][T17532]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  440.106197][T17532]  ? rcu_is_watching+0x15/0xb0
[  440.106205][T17532]  ? do_syscall_64+0xbe/0x3b0
[  440.106214][T17532]  do_syscall_64+0xfa/0x3b0
[  440.106222][T17532]  ? lockdep_hardirqs_on+0x9c/0x150
[  440.106229][T17532]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  440.106236][T17532]  ? exc_page_fault+0x9f/0xf0
[  440.106244][T17532]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  440.106250][T17532] RIP: 0033:0x7f392b98ebe9
[  440.106257][T17532] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  440.106264][T17532] RSP: 002b:00007f392c744038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  440.106272][T17532] RAX: ffffffffffffffda RBX: 00007f392bbb5fa0 RCX: 00007f392b98ebe9
[  440.106278][T17532] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003
[  440.106282][T17532] RBP: 00007f392ba11e19 R08: 0000000000000000 R09: 0000000000000000
[  440.106286][T17532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  440.106290][T17532] R13: 00007f392bbb6038 R14: 00007f392bbb5fa0 R15: 00007ffd92b89e38
[  440.106297][T17532]  </TASK>
[  440.106300][T17532] 
[  440.126412][T17518] XFS (loop6): Mounting V5 Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2
[  440.127783][T17532] Allocated by task 9567:
[  440.157065][T17518] XFS (loop6): Ending clean mount
[  440.158328][T17532]  kasan_save_track+0x3e/0x80
[  440.162418][T17518] XFS (loop6): Quotacheck needed: Please wait.
[  440.163754][T17532]  __kasan_slab_alloc+0x6c/0x80
[  440.203426][T17518] XFS (loop6): Quotacheck: Done.
[  440.205959][T17532]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  440.223231][T17532]  xfrm_state_alloc+0x24/0x2f0
[  440.224846][T17532]  __find_acq_core+0x8a7/0x1c00
[  440.226633][T17532]  xfrm_find_acq+0x78/0xa0
[  440.228324][T17532]  xfrm_alloc_userspi+0x6b3/0xc90
[  440.230019][T17532]  xfrm_user_rcv_msg+0x7a3/0xab0
[  440.231629][T17532]  netlink_rcv_skb+0x208/0x470
[  440.233255][T17532]  xfrm_netlink_rcv+0x79/0x90
[  440.234817][T17532]  netlink_unicast+0x82f/0x9e0
[  440.236554][T17532]  netlink_sendmsg+0x805/0xb30
[  440.238190][T17532]  __sock_sendmsg+0x21c/0x270
[  440.239783][T17532]  ____sys_sendmsg+0x505/0x830
[  440.241374][T17532]  ___sys_sendmsg+0x21f/0x2a0
[  440.242970][T17532]  __x64_sys_sendmsg+0x19b/0x260
[  440.244688][T17532]  do_syscall_64+0xfa/0x3b0
[  440.246279][T17532]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  440.248582][T17532] 
[  440.249388][T17532] Freed by task 47:
[  440.250676][T17532]  kasan_save_track+0x3e/0x80
[  440.252244][T17532]  kasan_save_free_info+0x46/0x50
[  440.253964][T17532]  __kasan_slab_free+0x5b/0x80
[  440.255572][T17532]  kmem_cache_free+0x18f/0x400
[  440.257372][T17532]  xfrm_state_gc_task+0x52d/0x6b0
[  440.259095][T17532]  process_scheduled_works+0xae1/0x17b0
[  440.260932][T17532]  worker_thread+0x8a0/0xda0
[  440.262472][T17532]  kthread+0x711/0x8a0
[  440.263910][T17532]  ret_from_fork+0x3fc/0x770
[  440.265449][T17532]  ret_from_fork_asm+0x1a/0x30
[  440.267400][T17532] 
[  440.268414][T17532] The buggy address belongs to the object at ffff888109cd4d80
[  440.268414][T17532]  which belongs to the cache xfrm_state of size 928
[  440.272955][T17532] The buggy address is located 322 bytes inside of
[  440.272955][T17532]  freed 928-byte region [ffff888109cd4d80, ffff888109cd5120)
[  440.277670][T17532] 
[  440.278603][T17532] The buggy address belongs to the physical page:
[  440.280911][T17532] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888109cd5200 pfn:0x109cd4
[  440.284273][T17532] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  440.287364][T17532] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  440.289943][T17532] page_type: f5(slab)
[  440.291284][T17532] raw: 057ff00000000040 ffff888104e64780 dead000000000122 0000000000000000
[  440.294278][T17532] raw: ffff888109cd5200 00000000800e000a 00000000f5000000 0000000000000000
[  440.297159][T17532] head: 057ff00000000040 ffff888104e64780 dead000000000122 0000000000000000
[  440.300035][T17532] head: ffff888109cd5200 00000000800e000a 00000000f5000000 0000000000000000
[  440.302862][T17532] head: 057ff00000000002 ffffea0004273501 00000000ffffffff 00000000ffffffff
[  440.305948][T17532] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  440.309571][T17532] page dumped because: kasan: bad access detected
[  440.312273][T17532] page_owner tracks the page as allocated
[  440.314738][T17532] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7220, tgid 7219 (syz.0.556), ts 119235581104, free_ts 119189735293
[  440.322745][T17532]  post_alloc_hook+0x240/0x2a0
[  440.324793][T17532]  get_page_from_freelist+0x21e4/0x22c0
[  440.327165][T17532]  __alloc_frozen_pages_noprof+0x181/0x370
[  440.329670][T17532]  alloc_pages_mpol+0x232/0x4a0
[  440.331795][T17532]  allocate_slab+0x8a/0x370
[  440.333759][T17532]  ___slab_alloc+0xbeb/0x1410
[  440.335790][T17532]  kmem_cache_alloc_noprof+0x283/0x3c0
[  440.338161][T17532]  xfrm_state_alloc+0x24/0x2f0
[  440.340223][T17532]  __find_acq_core+0x8a7/0x1c00
[  440.342331][T17532]  xfrm_find_acq+0x78/0xa0
[  440.344273][T17532]  xfrm_alloc_userspi+0x6b3/0xc90
[  440.346263][T17532]  xfrm_user_rcv_msg+0x7a3/0xab0
[  440.347962][T17532]  netlink_rcv_skb+0x208/0x470
[  440.349555][T17532]  xfrm_netlink_rcv+0x79/0x90
[  440.351167][T17532]  netlink_unicast+0x82f/0x9e0
[  440.352751][T17532]  netlink_sendmsg+0x805/0xb30
[  440.354317][T17532] page last free pid 6959 tgid 6959 stack trace:
[  440.356561][T17532]  __free_frozen_pages+0xbc4/0xd30
[  440.358747][T17532]  free_large_kmalloc+0x13a/0x1f0
[  440.360664][T17532]  io_ring_ctx_free+0x41d/0x4e0
[  440.362251][T17532]  io_ring_exit_work+0x8c4/0x930
[  440.363878][T17532]  process_scheduled_works+0xae1/0x17b0
[  440.365709][T17532]  worker_thread+0x8a0/0xda0
[  440.367299][T17532]  kthread+0x711/0x8a0
[  440.368659][T17532]  ret_from_fork+0x3fc/0x770
[  440.370180][T17532]  ret_from_fork_asm+0x1a/0x30
[  440.371838][T17532] 
[  440.372645][T17532] Memory state around the buggy address:
[  440.374457][T17532]  ffff888109cd4d80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  440.377466][T17532]  ffff888109cd4e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  440.380060][T17532] >ffff888109cd4e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  440.382726][T17532]                                            ^
[  440.384761][T17532]  ffff888109cd4f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  440.387474][T17532]  ffff888109cd4f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  440.390560][T17532] ==================================================================
[  440.413109][T17532] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  440.416215][T17532] CPU: 1 UID: 0 PID: 17532 Comm: syz.3.4605 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  440.421262][T17532] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  440.425374][T17532] Call Trace:
[  440.426838][T17532]  <TASK>
[  440.428137][T17532]  dump_stack_lvl+0x99/0x250
[  440.430125][T17532]  ? __asan_memcpy+0x40/0x70
[  440.432094][T17532]  ? __pfx_dump_stack_lvl+0x10/0x10
[  440.434314][T17532]  ? __pfx__printk+0x10/0x10
[  440.436288][T17532]  vpanic+0x281/0x750
[  440.438007][T17532]  ? preempt_schedule+0xae/0xc0
[  440.440080][T17532]  ? __pfx_vpanic+0x10/0x10
[  440.442015][T17532]  ? preempt_schedule_common+0x83/0xd0
[  440.444375][T17532]  ? preempt_schedule+0xae/0xc0
[  440.446479][T17532]  ? __pfx_preempt_schedule+0x10/0x10
[  440.448798][T17532]  panic+0xb9/0xc0
[  440.450405][T17532]  ? __pfx_panic+0x10/0x10
[  440.452316][T17532]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  440.454841][T17532]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  440.457099][T17532]  check_panic_on_warn+0x89/0xb0
[  440.459184][T17532]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  440.461336][T17532]  end_report+0x78/0x160
[  440.463059][T17532]  kasan_report+0x129/0x150
[  440.464889][T17532]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  440.467146][T17532]  __xfrm_state_lookup+0x6ad/0x8d0
[  440.469360][T17532]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  440.471778][T17532]  ? xfrm_state_lookup+0x45/0x1e0
[  440.473918][T17532]  xfrm_state_lookup+0x11e/0x1e0
[  440.476022][T17532]  pfkey_delete+0x357/0x6d0
[  440.477972][T17532]  ? __pfx_pfkey_delete+0x10/0x10
[  440.480100][T17532]  ? kmem_cache_free+0x18f/0x400
[  440.482049][T17532]  pfkey_sendmsg+0xbfe/0x1090
[  440.483768][T17532]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  440.485550][T17532]  ? aa_sock_msg_perm+0xf1/0x1d0
[  440.487558][T17532]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  440.489828][T17532]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  440.491991][T17532]  __sock_sendmsg+0x21c/0x270
[  440.493994][T17532]  ____sys_sendmsg+0x505/0x830
[  440.496004][T17532]  ? __pfx_____sys_sendmsg+0x10/0x10
[  440.498231][T17532]  ? import_iovec+0x74/0xa0
[  440.500065][T17532]  ___sys_sendmsg+0x21f/0x2a0
[  440.502173][T17532]  ? __pfx____sys_sendmsg+0x10/0x10
[  440.504362][T17532]  ? __fget_files+0x2a/0x420
[  440.506306][T17532]  ? __fget_files+0x3a0/0x420
[  440.508362][T17532]  __x64_sys_sendmsg+0x19b/0x260
[  440.510515][T17532]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  440.512933][T17532]  ? rcu_is_watching+0x15/0xb0
[  440.515058][T17532]  ? do_syscall_64+0xbe/0x3b0
[  440.517085][T17532]  do_syscall_64+0xfa/0x3b0
[  440.518942][T17532]  ? lockdep_hardirqs_on+0x9c/0x150
[  440.521071][T17532]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  440.523557][T17532]  ? exc_page_fault+0x9f/0xf0
[  440.525492][T17532]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  440.527917][T17532] RIP: 0033:0x7f392b98ebe9
[  440.529733][T17532] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  440.537361][T17532] RSP: 002b:00007f392c744038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  440.540974][T17532] RAX: ffffffffffffffda RBX: 00007f392bbb5fa0 RCX: 00007f392b98ebe9
[  440.544477][T17532] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003
[  440.547772][T17532] RBP: 00007f392ba11e19 R08: 0000000000000000 R09: 0000000000000000
[  440.550986][T17532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  440.554328][T17532] R13: 00007f392bbb6038 R14: 00007f392bbb5fa0 R15: 00007ffd92b89e38
[  440.557621][T17532]  </TASK>
[  440.559698][T17532] Kernel Offset: disabled
[  440.561572][T17532] Rebooting in 86400 seconds..

VM DIAGNOSIS:
00:39:58  Registers:
info registers vcpu 0

CPU#0
RAX=1ffff92000890f42 RBX=ffffffff82231276 RCX=1ffff92000890f01 RDX=ffffffff90403952
RSI=0000000000000002 RDI=ffffc90004487d40 RBP=dffffc0000000000 RSP=ffffc900044878f8
R8 =000000000000000a R9 =ffffffff8172c195 R10=ffffc90004487a18 R11=ffffffff81ac38c0
R12=ffffc90004488000 R13=1ffff92000890f3b R14=ffffc900044879c8 R15=ffffc90004487a10
RIP=ffffffff8172cd47 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f492d0e0c80 ffffffff 00c00000
GS =0000 ffff8880b8623000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f8a413733e0 CR3=0000000027372000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f XMM01=622f617461642f76 6564752f6e75722f
XMM02=0000000000000000 00ff00000000ff00 XMM03=ff00000000000000 0000000000000000
XMM04=0000000000000000 000000ff00000000 XMM05=622d656236342d64 3563382d64626439
XMM06=366636646632785c 646975752d796266 XMM07=32785c6b73696466 32785c2f736b6e69
XMM08=00000000ffffffff ffffffffffffffff XMM09=6666786300000000 363a37622f326265
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=00000000000003f9
RSI=00000000000013e7 RDI=00000000000013e8 RBP=00000000000003f9 RSP=ffffc90009c76e30
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff854e7660
R12=dffffc0000000000 R13=dffffc0000000000 R14=ffffffff99de74e0 R15=0000000000000000
RIP=ffffffff854e76dc RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f392c7446c0 ffffffff 00c00000
GS =0000 ffff8881a3c23000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000100 CR3=000000010ec9a000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f392bb87498 00007f392bb87470 XMM03=00007f392bb874a8 00007f392bb874a0
XMM04=00007f392c6ed100 00007f392bb87460 XMM05=00007f392bb87478 00007f392bb874c0
XMM06=00007f392bb874b8 00007f392bb874b0 XMM07=00007f392bb874a8 00007f392bb874a0
XMM08=6161616161616161 6161616161616161 XMM09=0000000000000000 00007f392ba12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
