last executing test programs:

7m29.076227146s ago: executing program 2 (id=492):
r0 = socket$kcm(0x10, 0x2, 0x4)
close(r0)
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000380)={<r1=>0x0, 0x0})
close(r1)
socket$kcm(0x10, 0x400000002, 0x0)
setsockopt$sock_attach_bpf(r1, 0x10e, 0xb, &(0x7f0000000180), 0x4)
sendmsg$inet(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="6000000068007f089e", 0x9}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b729866f0dd480004fbffffffff0200258f2e4409b8f9e6aa0500bea1231cc9d1bd78a39e5c3da47fdc2c6726e81b1ae24f89a565ee52dcd729cd39093c510293bca0b646a3ce904f6e6b788b32", 0x57}], 0x2}, 0x0)

7m28.946525127s ago: executing program 2 (id=494):
getsockname(0xffffffffffffffff, &(0x7f0000000080)=@hci, &(0x7f0000000000)=0x80)
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000010c0)=0x8)

7m28.94592231s ago: executing program 2 (id=496):
syz_mount_image$exfat(&(0x7f00000005c0), &(0x7f0000000240)='./file0\x00', 0x3000050, &(0x7f0000000600)=ANY=[], 0x2, 0x14fe, &(0x7f0000008900)="$eJzs3Au0ztXWMPA511p/NklPkvuaa/55kssiSXJJSCRJkiS5JSRJkoTEJrckJCH3JPeQ3GIn9/st9yQ5kiQJCUnWN3Q6n/e8nfftnO+c7/V9Z8/fGGvsNff/mfNZa889nv9ljL2/7Ti4av1qlesyM/xT8M9fUgEgBQD6AcA1ABABQKlspbIBDoNMGlP/uTcR/1oPTbvSKxBXkvQ/fZP+p2/S//RN+p++Sf/TN+l/+ib9T9+k/0KkZ1un575WRvod/3PP/0Ge//8/R87//0YOFxvz5fpi13f6B1Kk/+mb9D99k/6nb9L/9E36n75J///NRQCV/pvD0v/0TfovRHp2pZ8/y7iy40r//gkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESB/OhcsMAPxlfqXXJYQQQgghhBBCiH+dkPFKr0AIIYQQQgghhBD/9yEo0GAgggyQEVIgE2SGqyALXA1Z4RpIwLWQDa6D7HA95ICckAtyQx7IC/nAAoEDhhjyQwFIwg1QEG6EQlAYikBR8FAMisNNUAJuhpJwC5SCW6E03AZloCyUg/JwO1SAO6AiVILKcCdUgbugKlSDu6E63AM14F6oCfdBLbgfasMDUAcehLrwENSDh6E+PAIN4FFoCI2gMTSBpv9H+S9CV3gJukF3SIUe0BNehl7QG/pAX+gHr0B/eBUGwGswEAbBYHgdhsAbMBTehGEwHEbAWzASRsFoGANjYRyMh7dhArwDE+FdmASTYQpMhWkwHWbAezATZsFseB/mwAcwF+bBfFgAC+FDWASLIQ0+giXwMSyFZbAcVsBKWAWrYQ2shXWwHjbARtgEm2ELbIVPYBtshx2wE3bBbtgDn8Je+Az2weewH774B/PP/qf8TggIqFChQYMZMAOmYApmxsyYBbNgVsyKCUxgNsyG2TE75sAcmAtzYR7Mg/kwHxISMjLmx/yYxCQWxIJYCAthESyCHj0Wx+JYAm/GklgSS2EpLI2lsQyWxbJYHstjBayAFbEiVsbKWAWrYFWsinfj3XgP1sAaWBNrYi2shbWxNtbBOlgX62I9rIf1sT42wAbYEBtiY2yMTbEpNsNm2BybY0tsia2wFbbG1tgG22BbbIvtsB22x/bYATtgR+yInbAzdsYX8UV8CV/C7lhF9cCe2BN7YS/sg32xL76C/fFVfBVfw4E4CAfj6/g6voFD8QwOw+E4AkdgBTUKR+MYZDUOx+N4nIATcCJOxEk4GSfjVJyG03EGzsCZOAtn4fs4Bz/AD3AezsMFuBAX4iJcjGmYhkvwLC7FZbgcV+BKXIUrcQ2uxTW4HjfgetyEm3ALbsFP8BPcjttxJ+7E3bgbP8VP8TP8DAfiftyPB/AAHsSDeAgP4WE8jEfwCB7Fo3gMj+FxPI4n8CSewpN4Gk/jGTyL5/AcnsfzeAGfz/N1vd2F1w0EdYlRRmVQGVSKSlGZVWaVRWVRWVVWlVAJlU1lU9lVdpVD5VC5VC6VR+VR+VQ+RYoUq1jlV/lVUiVVQVVQFVKFVBFVRHnlVXFVXJVQJVRJVVKVUreq0uo2VUaVVS18eVVeVVAtfUVVSVVWlVUVdZeqqqqpaqq6qq5qqBqqpqqpaqlaqrZ6QNVRPbAPPqQudaa+GoQN1GBsqBqpxqqJegMfU83UUGyuWqiW6gk1HIdha9XMt1FPq7ZqNLZTz6ox+JzqoMZhR/WC6qQ6qy7qRdVVNffdMvz2EaimYi/VW/VRfdVMvEtd6lhV9ZoaqAapwep1tQDfUEPVm2qYGq5GqLfUSDVKjVZj1Fg1To1Xb6sJ6h01Ub2rJqnJaoqaqqap6WqGek/NVLPUbPW+mqM+UHPVPDVfLVAL1YdqkVqs0tRHaon6WC1Vy9RytUKtVKvUarVGrVXr1Hq1QW1Um9RmtUVtVZ+obWq72qF2ql1qt9qjPlV71Wdqn/pc7VdfqAPqT+qg+lIdUl+pw+prdUR9o46qb9Ux9Z06rr5XJ9RJdUr9oE6rH9UZdVadUz+p8+pndUH9oi6qoECjVlproyOdQWfUKTqTzqyv0ln01TqrvkYn9LU6m75OZ9fX6xw6p86lc+s8Oq/Op60m7TTrWOfXBXRS36AL6ht1IV1YF9FFtdfFdHF9ky6hb9Yl9S26lL5Vl9a36TK6rC6ny+vbdQV9h66oK+nK+k5dRd+lq+pq+m5dXd+ja+h7dU19n66l79e19QO6jn5Q19UP6Xr6YV1fP6Ib6Ed1Q91IN9ZNdFP9mG6mH9fNdQvdUj+hW+kndWv9lG6jn9Zt9TO6nX5Wt9fP6Q76ed1Rv6A76c66i/5FX9RBd9PddaruoXvql3Uv3Vv30X11P/2K7q9f1QP0a3qgHqQH69f1EP2GHqrf1MP0cD1Cv6VH6lF6tB6jx+pxerx+W0/Q7+iJ+l09SU/WU/RUPU1P131+qzT778h/52/kD/j13bforfoTvU1v1zv0Tr1L79Z79B69V+/V+/Q+vV/v1wf0AX1QH9SH9CF9WB/WR/QRfVQf1cf0MX1cH9cn9En9k/5Bn9Y/6jP6rD6rf9Ln9Xl94befARg0ymhjTGQymIwmxWQymc1VJou52mQ115iEudZkM9eZ7OZ6k8PkNLlMbpPH5DX5jDVknGETm/ymgEmaG0xBc6MpZAqbIqao8aaYKW5u+qfz/2h9TU1T08w0M81Nc9PStDStTCvT2rQ2bUwb09a0Ne1MO9PetDcdTAfT0XQ0nUwn08V0MV1NV9PNdDOpJtX0NC+bXqa36WP6mn7mFdPf9DcDzAAz0Aw0g81gM8QMMUPNUDPMDDMjzAgz0ow0o81oM9aMNePNeDPBTDATzUQzyUwyU8wUM81MMzPMDDPTzDSzzWwzx8wxc81cM9/MNwvNQrPILDJpJs0sMUvMUrPMLDMrzAqzyqwya8was86sMxvMBrPJbDJLzVaz1Wwz28wOs8PsMrvMHrPH7DV7zT6zz+w3+80Bc8AcNAfNIXPIHDaHzRFzxBw1R80xc8wcN8fNCXPCnDKnzGlz2pwxZ8w5c86cN+fNBXPBXDQXL132RSpSkYlMlCHKEKVEKVHmKHOUJcoSZY2yRokoEWWLskXZo+ujHFHOKFeUO8oT5Y1SwUYUuYijOMofFYiS0Q1RwejGqFBUOCoSFY18VCwqHt0UlYhujkpGt0Sloluj0tFtUZmobFQuKh/dHlWI7ogqRpWiytGdUZXorqhqVC26O6oe3RPViO6Nakb3RbWi+6Pa0QNRnejBqG70UFQvejiqHz0SNYgejRpGjaLGUZOo6b+0fghncj7uu9nuNtX2sD3ty7aX7W372L62n33F9rev2gH2NTvQDrKD7et2iH3DDrVv2mF2uB1h37Ij7Sg72o6xY+04O96+bSfYd+xE+66dZCfbKXaqnWan2xn2PTvTzrKz7ft2jv3AzrXz7Hy7wC60H9pFdrFNsx/ZJfZju9Qus8vtCrvSrrKr7Rq71q6z6+0Gu9FuspvtFrvVfmK32e12h91pd9nddo/91O61n9l99nO7335hD9g/2YP2S3vIfmUP26/tEfuNPWq/tcfsd/a4/d6esCftKfuDPW1/tGfsWXvO/mTP25/tBfuLvWjDpYv7S6d3MmQoA2WgFEqhzJSZslAWykpZKUEJykbZKDtlpxyUg3JRLspDeSgf5aNLmJjyU35KUpIKUkEqRIWoCBUhT56KU3EqQSWoJJWkUlSKSlNpKkNlqByVo9vpdrqD7qBKVInupDvpLrqLqlE1qk7VqQbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpATWghtSQGlNjakpNqRk1o+bUnFpSS2pFrag1taY21IbaUltqR+2oPbWnDtSBOlJH6kSdqAt1oa7UlbpRN0qlVOpJPakX9aI+1If6UT/qT/1pAA2ggTSQBtNgGkJDaCgNpWE0nEbQWzSSRtFoGkNjaRyNp/E0gSbQRJpIk2gSTaEpNI2m0QyaQTNpJs2m2TSH5tBcmkvzaT4tpIW0iBZRGqXRElpCS2kpLafltJJW0mpaTWtpLa2n9bSRNtJm2kxbaStto220g3bQLtpFe2gP7aW9tI/20X7aTwfoAB2kg3SIDtFhOkxH6AgdpaN0jI7RcTpOJ+gEnaJTdJpO0xk6Q+foHJ2nn+kC/UIXKVCKU5DZXeWyuKtdVneNS3GZ3KU4AoBLcS6X2+VxeV0+Z10Ol/OvYnLOFXKFXRFX1HlXzBV3N/0uLuPKunKuvLvdVXB3uIq/i6u7e1wNd6+r6e5z1dzdfxXXcve72u4RV8c96uq6Rq6ea+Lqu0dcA/eoa+gaucauiWvlnnSt3VOujXvatXXP/C5e5Ba7tW6dW+82uL3uM3fO/eSOum/defez6+a6u37uFdffveoGuNfcQDfod/EI95Yb6Ua50W6MG+vG/S6e4qa6aW66m+HeczPdrN/FC92Hbo5Lc3PdPDffLfg1vrSmNPeRW+I+dkvdMrfcrXAr3Sq32q3532td4Ta5zW6L2+M+ddvcdrfD7XS73O5f40v72Oc+d/vdF+6I+8YddF+6Q+6YO+y+/jW+tL9j7jt33H3vTriT7pT7wZ12P7oz7uyv+7+09x/cL+6iCw4YWbFmwxFn4Iycwpk4M1/FWfhqzsrXcIKv5Wx8HWfn6zkH5+RcnJvzcF7Ox5aJHTPHnJ8LcJJv4IJ8IxfiwlyEi7LnYlycb+ISfDOX5Fu4FN/Kpfk2LsNluRyX59u5At/BFbkSV+Y7uUoIXJWr8d1cne/hGnwv1+T7uBbfz7X5Aa7DD3Jdfojr8cNcnx/hBvwoN+RG3JibcFN+jJvx49ycW3BLfoJb8ZPcmp/iNvw0t+VnuB0/y+35Oe7Az3NHfoE7cWfuwi9yV36Ju3F3TuUe3JNf5l7cm/twX+7Hr3B/fpUH8Gs8kAfxYH6dh/AbPJTf5GE8nEfwWzySR/FoHsNjeRyP57d5Ar/DE/ldnsSTeQpP5Wk8nWfwezyTZ/Fsfp/n8Ac8l+fxfF7AC/lDXsSLOY0/4iX8MS/lZbycV/BKXsWreQ2v5XW8njfwRt7Em3kLb+VPeBtv5x28k3fxbt7Dn/Je/oz38ee8n7/gA/wnPshf8iH+ig/z13yEv+Gj/C0f4+/4OH/PJ/gkn+If+DT/yGf4LJ/jn/g8/8wX+Be+yIEhxljFOjZxFGeIM8YpcaY4c3xVnCW+Os4aXxMn4mvjbPF1cfb4+jhHnDPOFeeO88R543yxjSl2McdxnD8uECfjG+KC8Y1xobhwXCQuGvu4WFw8vikuEd8cl4xviUvFt8al49viMnHZ+JH7yse3xxXiO+KKcaW4cnxnXCW+K64aV4vvjqvH98Q14nvjmvF9ccn4/rh2/EBcJ34wrhs/FNeLH47rx4/EDeJH44Zxo7hx3CRuGj8WN4sfj5vHLeKW8RNxq/jJuHX8VNwmfjpuGz/zh8dT4x5xz/jl+OU4hHv1/OSC5MLkh8lFycXJtORHySXJj5NLk8uSy5MrkiuTq5Krk2uSa5PrkuuTG5Ibk5uSm5NbkiFUywgevfLaGx/5DD6jT/GZfGZ/lc/ir/ZZ/TU+4a/12fx1Pru/3ufwOX0un9vn8Xl9Pm89eefZxz6/L+CT/gZf0N/oC/nCvogv6r0v5ov7Jr6pb+qb+cd9c9/Ct/RP+Cf8k/5J/5R/yj/t2/pnfDv/rG/vn/Md/PP+ef+C7+Q7+y7+Rd/Vv+S7+e4+1af6nr6n7+V7+T6+j+/n+/n+vr8f4Af4gX6gH+wH+yF+iB/qh/phfpgf4Uf4kX6kH+1H+7F+rB/vx/sJfoKf6Cf6SX6Sn+Kn+Gl+mp/hZ/iZfqaf7Wf7OYXm+Ll+rp/v5/uFfqFf5Bf5NJ/ml/glfqlf6pf75X6lX+lX+9V+rV/r1/v1fqPf6Df7zX6r3+q3+W1+h9/hd/ldfo/f4/f6vX6f3+f3+/3+gD/gD/qD/pD/yh/2X/sj/ht/1H/rj/nv/HH/vT/hT/pT/gd/2v/oz/iz/pz/yZ/3P/sL/hd/0Qc/PvF2YkLincTExLuJSYnJiSmJqYlpiemJGYn3EjMTsxKzE+8n5iQ+SMxNzEvMTyxILEx8mFiUWJxIS3yUWJL4OLE0sSyxPLEisTKxKhFC3m1xyB8KhGS4IRQMN4ZCoXAoEooGH4qF4uGmUCLcHEqGW0KpcGsoHW4LZULZUC48GhqGRqFxaBKahsdCs/B4aB5ahJbhidAqPBlah6dCm/B0aBueCe3Cs6F9eC50CM+HjuGF0Cl0Dl3Ci6FreCl0C91DaugReoaXQ6/QO/QJfUO/8EroH14NA8JrYWAYFAaH18OQ8EYYGt4Mw8LwMCK8FUaGUWF0GBPGhnFhfHg7TAjvhInh3TApTA5TwtQwLUwPM8J7YWaYFWaH98Oc8EGYG+aF+WFBWBg+DIvC4pAWPgpLwsdhaVgWlocVYWVYFVaHNWFtWBfWhw1hY9gUNoctYWv4JGwL28OOsDPsCrvDnvBp2Bs+C/vC52F/+CIcCH8KB8OX4VD4KhwOX4cj4ZtwNHwbjoXvwvHwfTgRToZT4YdwOvwYzoSz4Vz4KZwPP4cL4ZdwUf5mTQghhBDi76L/4HiPv/G9DACgfpv3BICrt+c+/J9rbszx53lvladVAgCe7t7xob+MKlVSU1N/e+1SDVGBeQCQ+Ov6f4mXQUt4EtpACyjxN9fXW3U+z39QP3krQOb/kJMCl+PL9W/+L+o/9sSIRaXjc9n+m/rzAAoVuJyTCS7Hl+uX/C/q52z2B+vP9OV4gOb/IScLXI4v1y8Oj8Mz0OavXimEEEIIIYQQQvxZb1Wu/R/dP1+6P89jLudkhMvxH92fCyGEEEIIIYQQ4sp7rnOXpx5r06ZF+79vgr89F/jHsmQiE5n8fza50p9MQgghhBBCiH+1yxf9V3olQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFE+vU/8e/ErvQehRBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiCvtfwUAAP//luw5aQ==")
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r0 = getpid()
sched_setaffinity(0x0, 0x0, 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x18)
connect$can_bcm(0xffffffffffffffff, &(0x7f0000000180), 0x10)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x5031, 0xffffffffffffffff, 0xc2dcc000)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r4 = open(&(0x7f0000000080)='./file1\x00', 0xe4802, 0x6)
pwritev2(r4, &(0x7f0000000240)=[{}], 0x1, 0x7800, 0x0, 0x3)

7m27.984144181s ago: executing program 2 (id=509):
syz_mount_image$cramfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="00af268263b121dc03d7d9b98b9cdb76841d31005b31fdfd141b652968fbeae7aac982a517703dc5950f6728aecf5ec337b119ffd66d0a02970718ba573db352906385cece74366e628b6a775c9a6f6fff046416c6240e39a647186c4cf0b360bd17d4cdbd912dc61fd24e6f17d8"], 0x1, 0x152, &(0x7f00000007c0)="$eJzs0E1LKnEUx/Hf3Bnlcq/eBzKwFia0aEjMacRatdBIEtKBwk0rwSYKFCOhXBrRrkXQ1oXlVnwLlrWxRgh7E23cBS0n/o7Rw67977MZ5nsOh2FWlnoqgoAMx3KpuLdvlsvmVnDdSCc3ntrtuOhuAD8/zZ39qziwI54KMDgCRL7xAtu7BXMuXyqI90EcUAEkfjtdg7P7SzSf0+YhSaKp00Bn3Gn6aO9ji47apAIk/r7fsy+AGXHv/9s94BlApRZquZCxbNu2xfeepEJTY5LTm3cZq5sKzwbMUz050fD4ZWTN20skhvPHSDf8EGk1+z0rvWakjV5U1xeimqJpsb5xb6Vi1TMoq54DYPPLPTf8ASULHEvA+XA2uJa8ADr1F6P4Z7E++tfVQzkISJVaPud3NXK+fz8gq5BARERERERERERERERERET0Xa8BAAD//wFeZcY=")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f00000001c0)='./file0\x00')
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040), &(0x7f0000000240)=ANY=[], 0x25, 0x2)

7m27.752772941s ago: executing program 2 (id=511):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000100)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}], 0x1)
writev(r1, &(0x7f0000000040)=[{&(0x7f0000000240)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1)

7m27.354726121s ago: executing program 2 (id=516):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240), &(0x7f00000002c0)=0x14)

7m26.743004779s ago: executing program 32 (id=516):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240), &(0x7f00000002c0)=0x14)

6m10.191693498s ago: executing program 3 (id=1621):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
close_range(r0, r0, 0x6)

6m10.121820481s ago: executing program 3 (id=1622):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r1, 0x1, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24000140}, 0x20000804)

6m10.051367758s ago: executing program 3 (id=1624):
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'macsec0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x6, 0x6}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x803}, 0x20004004)

6m9.985139513s ago: executing program 3 (id=1629):
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0)
mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0)
mount$bind(0x0, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x80000, 0x0)

6m9.930367719s ago: executing program 3 (id=1631):
r0 = syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a00000008241c00000008000905810300020000000904010000020d00000904010102020d", @ANYBLOB="510f"], 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, 0x0, &(0x7f0000000800)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x816}}, &(0x7f0000000400)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, 0x0, 0x0}, 0x0)

6m9.81119643s ago: executing program 3 (id=1635):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = syz_open_dev$sg(0x0, 0x0, 0x5)
ioctl$SG_IO(r0, 0x2285, 0x0)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000001"], 0x50)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000040000850000001b000000b7000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x84, @remote, 0x0, 0x0, 'fo\x00', 0x0, 0x7f}, 0x2c)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0)
r7 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r7, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}], 0x1, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18)
r8 = openat$vimc2(0xffffffffffffff9c, &(0x7f000000f140), 0x2, 0x0)
ioctl$VIDIOC_QBUF(r8, 0xc058560f, &(0x7f000000f280)=@multiplanar_userptr={0x1, 0xa, 0x4, 0x10000, 0x1, {}, {0x2, 0x0, 0x5, 0x7, 0x8, 0x9, "525067fc"}, 0x79, 0x2, {0x0}})
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r5}, 0xc)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="60000000020601046c0001000000000000000000050005000a000000050001000600000005000400000000000900020073797a300000000014000300686173683a69702c706f72742c697000140007800800084000002f5408000640"], 0x60}}, 0x0)
sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)

6m9.632659233s ago: executing program 33 (id=1635):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = syz_open_dev$sg(0x0, 0x0, 0x5)
ioctl$SG_IO(r0, 0x2285, 0x0)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000001"], 0x50)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000040000850000001b000000b7000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x84, @remote, 0x0, 0x0, 'fo\x00', 0x0, 0x7f}, 0x2c)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0)
r7 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r7, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}], 0x1, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18)
r8 = openat$vimc2(0xffffffffffffff9c, &(0x7f000000f140), 0x2, 0x0)
ioctl$VIDIOC_QBUF(r8, 0xc058560f, &(0x7f000000f280)=@multiplanar_userptr={0x1, 0xa, 0x4, 0x10000, 0x1, {}, {0x2, 0x0, 0x5, 0x7, 0x8, 0x9, "525067fc"}, 0x79, 0x2, {0x0}})
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r5}, 0xc)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="60000000020601046c0001000000000000000000050005000a000000050001000600000005000400000000000900020073797a300000000014000300686173683a69702c706f72742c697000140007800800084000002f5408000640"], 0x60}}, 0x0)
sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)

4m19.291673932s ago: executing program 4 (id=3208):
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, 0xffffffffffffffff, 0x231cd000)
syz_clone(0x6004500, &(0x7f0000000700), 0x0, 0x0, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)

4m19.220489618s ago: executing program 4 (id=3209):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sys_exit\x00', r0}, 0x18)
syz_clone3(&(0x7f0000000400)={0x40000400, &(0x7f0000000040), &(0x7f0000000300), &(0x7f0000000100), {0xd}, &(0x7f0000000480)=""/92, 0xfffffffffffffd6b, &(0x7f0000001fc0)=""/4096, &(0x7f0000000200)=[0x0, 0xffffffffffffffff, 0x0, 0x0], 0x4}, 0x58)

4m19.219919039s ago: executing program 4 (id=3211):
r0 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x10, "00000000100000001000000000001010"}}}]}, 0x48}}, 0x0)

4m19.180814362s ago: executing program 4 (id=3213):
syz_mount_image$udf(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0x2000002, &(0x7f0000000300)={[{@volume={'volume', 0x3d, 0x3e}}, {@gid}, {@dmode={'dmode', 0x3d, 0x4}}, {@rootdir={'rootdir', 0x3d, 0x4}}, {@iocharset={'iocharset', 0x3d, 'cp1255'}}, {@unhide}, {@noadinicb}, {@iocharset={'iocharset', 0x3d, 'macturkish'}}, {@longad}]}, 0x1, 0xc32, &(0x7f0000000e00)="$eJzs3U1sXNd9N+D/uRyKI/l9KyZ2FCeNi0lbpLJiufqKqViFO6pptgFkWQjF7AJwJI7UgSmSIKlGNtKC6aaLLgIURRdZEWiNAikaGE0RdMm0LpBsvCiy6opoYSMoumCLAFkFLO6dM9KQIm1GFCVKeh6b+s3ce86dc+4Z3ysLOvcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDxe6+dP3EyPexWAAAP0sXxr5445f4PAE+Uy/7/HwAAAAAAAAAAAAAA9rsURTwdKeYurqXJ6n1X/UJn8OatidGxrasdTFXNgap8+VM/eer0mS+9NHK2lxc6Mx9R/377bLwxfvl849XZG3Pz7YWF9lRjYqZzdXaqveMj7Lb+ZseqE9C48ebNqWvXFhqnXjy9Yfet4Q+HnjoyfG7k+ePP9cpOjI6Njd8pUu8vX7vnhnRtN8PjQBRxPFK88L2fplZEFLH7c1F/sGO/2cGqE8eqTkyMjlUdme60ZhbLnZd6J6KIaPRVavbO0dZjEbXBB9qH7TUjlsrmlw0+VnZvfK4137oy3W5cas0vdhY7szOXUre1ZX8aUcTZFLEcEatDdx9uMIqoRYrvHF5LVyJioHcevlhNDN6+HcUe9nEHynY2BiOWi0dgzPaxoSji9Ujxs/eOxtV8namuNV+IeL3MH0S8U+YrEan8YpyJ+GCL7xGPploU8efl+J9bS1PV9aB3XbnwtcZXZq7N9pXtXVd+yfvDXVeKh3R/OLgpH4x9fm2qRxGt6oq/lu79NzsAAAAAAAAAAAAAAAAA3G8Ho4jPRIrX/u2PqnnFUc1LP3xu5PeH/3//nPFnP+Y4ZdkXI2Kp2Nmc3AN5YuCldCmlhzyX+ElWjyL+OM//+9bDbgwAAAAAAAAAAAAAAAAAAMATrYifRIqX3z+alqN/TfHOzPXG5daV6e6qsL21f3trpq+vr683UjebOSdzLuVczrmSczVnFLl+zmbOyZxLOZdzruRczRkDuX7OZs7JnEs5l3Ou5FzNGbVcP2cz52TOpZzLOVdyruaMfbJ2LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA46SIIn4RKb79jbUUKSKaEZPRzZWhh906AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA0lIr4fqRo/EHz9rZaRKTq366j5S9nonmgzE9Gc6TMV6J5PmerylrzWw+h/ezOYCrix5FiqP7u7QHP4z/YfXf7axDvfPPOu8/WujnQ2zn84dBTRw6fGxn7tWe3e522asCxC52Zm7caE6NjY+N9m2v50z/Zt204f25xf7pORCy89fabrenp9vy9vyi/Aruo/gi9SLUnpadeVC+iti+a8XD6zhOgvP9/ECl++/1/793wu/f/evy/7rvbd/j4+Z/cuf+/vPlAO7z/1zbXy/f/8p6+1f3/6b5tL+ffjQzWIuqLN+YGj0TUF956+3jnRut6+3p75syJE18eGfny6RODByLq1zrT7b5X9+V0AQAAAAAAAAAAAAAAADw4qYjfjRStH6+lRkTcquZrDZ8bef74cwMxUM232jBv+43xy+cbr87emJtvLyy0pxoTM52rs1PtnX5cvZruNTE6tied+VgH97j9B+uvzs69Nd+5/oeLW+4/VD9/ZWFxvnV1691xMIqIZv+WY1WDJ0bHqkZPd1ozVdVLW06m/+UNpiL+I1JcPdNIn8/b8vz/zTP8N8z/X9p8oD2a//+Jvm3lZ6ZUxM8jxW/9xbPx+aqdh+Kuc5bL/U2kOHb2c7lcHCjL9drQfa5Ad2ZgWfZ/IsU//GJj2d58yKfvlD254xP7iCjH/3Ck+P6ffTd+PW/b+PyHrcf/0OYD7dH4P9O37dCG5xXsuuvk8T8eKV55+t34jbzto57/0Xv2xtFc+PbzOfZo/D/Vt204f+5v3p+uAwAAAAAAAAAAPNIGUxF/Gyl+OFZLL+VtO/n7f1ObD7RHf//r033bpu7PekUf+2LXJxUAAAAA9onBVMRPIsX1xXdvz6HeOP+7b/7n79yZ/zmaNu2t/pzvV6rnBtzPP//rN5w/d3L33QYAAAAAAAAAAAAAAAAAAIB9JaUiXsrrqU9W8/mntl1PfSVSvPZfL+Ry6UhZrrcO/HD1a/3i7Mzx89PTs1dbi60r0+3G+Fzrarus+0ykWPvrz+W6RbW+em+9+e4a73fWYp+PFGN/1yvbXYu9tzb5M72yS+2TZdlPRIr//PuNZXvrWH/qznFPlWX/KlJ8/Z+2LnvkTtnTZdnvRooffb3RK3uoLNt7Puqn75R98epssQejAgAAAAAAAAAAAAAAAAAAwJNmMBXxp5Hiv28s357Ln9f/H+x7W3nnm33r/W9yq1rnf7ha/3+71/ey/n/1XIGl7T4VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeTymKeDtSzF1cSytD5fuu+oXOzM1bE6NjW1c7mKqaA1X58qd+8tTpM196aeRsLz+6/v32mXhj/PL5xquzN+bm2wsL7anGxEzn6uxUe8dH2G39zY5VJ6Bx482bU9euLTROvXh6w+5bwx8OPXVk+NzI88ef65WdGB0bG+8rUxu850+/S9pm+4Eo4i8jxQvf+2n64VBEEbs/Fx/z3dlrB6tOHKs6MTE6VnVkutOaWSx3XuqdiCKi0Vep2TtHD2AsdqUZsVQ2v2zwsbJ743Ot+daV6XbjUmt+sbPYmZ25lLqtLfvTiCLOpojliFgduvtwg1HEm5HiO4fX0j8PRQz0zsMXL45/9cSp7dtR7GEfd6BsZ2MwYrn4qDHbosNsMBRF/GOk+Nl7R+NfhiJq0f2JL0S8XuYPIt6J7nin8otxJuIDp/WxUYsi/rcc/3Nr6b2h8nrQu65c+FrjKzPXZvvK9q4rj/z94UHa5/eTehTxo+qKv5b+1X/XAAAAAAAAAAAAAAAAAPtIEb8aKV5+/2iq5gffnlPcmbneuNy6Mt2d1teb+9ebM72+vr7eSN1s5pzMuZRzOedKztWcUeT6OZtl1tfXJ/P7pZzLOVdyruaMgVw/ZzPnZM6lnMs5V3Ku5oxarp+zmXMy51LO5ZwrOVdzxj6ZuwcAAAAAAAAAAAAAAAAAADxeiuqfFN/+xlpaH6rWlx7o7VuxHuhj7/8CAAD//0pa+Ck=")
syz_mount_image$fuse(0x0, &(0x7f0000000140)='./bus\x00', 0x1a06496, 0x0, 0x2, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]})

4m19.086708121s ago: executing program 4 (id=3214):
capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280))
fanotify_init(0x4000, 0x180)

4m18.573452667s ago: executing program 4 (id=3218):
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/anycast6\x00')
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14)
preadv(r0, &(0x7f00000006c0)=[{&(0x7f0000002240)=""/13, 0xd}], 0x1, 0x3c, 0x3)

4m18.461915937s ago: executing program 34 (id=3218):
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/anycast6\x00')
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14)
preadv(r0, &(0x7f00000006c0)=[{&(0x7f0000002240)=""/13, 0xd}], 0x1, 0x3c, 0x3)

3m54.77161601s ago: executing program 5 (id=3605):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f0000000100)={[{@delalloc}, {@data_err_abort}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@init_itable_val={'init_itable', 0x3d, 0xbe6}}, {@data_err_ignore}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4007b1}}, {@data_err_ignore}, {@grpquota}, {@nobh}, {@acl}, {@bh}, {@dioread_nolock}]}, 0x1, 0x553, &(0x7f0000000a40)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x31)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
truncate(&(0x7f00000001c0)='./file1\x00', 0x200)
r1 = open(&(0x7f0000000100)='./file1\x00', 0x909042, 0xb9)
write$P9_RFLUSH(r1, 0x0, 0x0)
creat(&(0x7f0000000040)='./bus\x00', 0x0)
mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x185641, 0x0)
r2 = open(&(0x7f00000003c0)='./bus\x00', 0x84902, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r2, 0x0)
syz_mount_image$ext4(&(0x7f00000002c0)='ext2\x00', &(0x7f0000000500)='./bus\x00', 0x1000410, &(0x7f0000000b00)={[{@grpid}, {@bsdgroups}, {@dax_inode}, {@nobarrier}], [{@measure}, {@uid_lt={'uid<', 0xee00}}, {@euid_lt}, {@dont_hash}, {@euid_eq}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@dont_appraise}]}, 0x4, 0x4eb, &(0x7f0000000540)="$eJzs3c9vVFsdAPDvnXZoKQMFZaFGBRFFQ5j+ABqCC2GjMYTESFy5gNoOTdMZpum0SCuLsnRvIokr/RPcuTBh5cKdO925wYUJKnkv9CVvMS/3zqUd2g7te7Qd6Hw+ye2955xhvufMcM6Ze2B6AuhZZyNiNSKORMS9iBjO85P8iButI33cq5ePp9ZePp5Kotm8878kK0/zou3PpI7lzzkYET/7ccQvk61xG8src5PVamUhT48s1uZHGssrl2YLec74xNjE6LXLV8f3rK1nan968aPZWz//y5+/8fzvq9//dVqt0m+OZ2Xt7dhLraYXo9SW1x8Rt/YjWJf0539/+PCkve1LEXEu6//D0Ze9mwDAYdZsDkdzuD0NABx26f1/KZJCOV8LKEWhUC631vBOx1ChWm8sXhyuLz2YjmwN62QUC/dnq5XRfK3wZBSTND2WXW+kxzelL0fEqYj47cDRLF2eqlenu/nBBwB62LFN8//HA635HwA45Aa7XQEA4MCZ/wGg95j/AaD3fI7537cDAeCQcP8PAL3H/A8AvWfH+f/JwdQDADgQP719Oz2aa/nvv55+uLz0g9LDS9OVxly5tjRVnqovzJdn6vWZaqU81Wzu9HzVen1+7Mp6srG8crdWX3qweHe2NjlTuVsp7nN7AICdnTrz7J9JRKxeP5od0baXg7kaDrdCtysAdE1ftysAdI3v80Dv2sU9vmUAOOS22aL3DR3/i9BTm7/Ch+rCV63/Q6+y/g+964ut//9wz+sBHDzr/9C7ms3Env8A0GOs8QPv9O//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KNK2ZEUytle4Kvpz0K5HHE8Ik5GMbk/W62MRsSJiPjHQHEgTY91u9IAwDsq/CfJ9/+6MHy+tLn0SPLJQHaOiF/9/s7vHk0uLi6Mpfn/X89ffJrnjx/pRgMAgHY3tma15un83HYj/+rl46nXx0FW8cXN1uaiady1/GiV9Ed/dh6MYkQMfZTk6Zb080rfHsRffRIRX9lo/6O2CKVsDaS18+nm+Gns4/sQf+P13xy/8Eb8QlaWnovZa/HlPagL9JpnN1vjZN730i6W979CnM3O2/f/wWyEenevx7+1LeNfYX3869sSP8n6/Nn19Ntr8uLKX3+yJbM53Cp7EvG1/u3iJ+vxkw7j7/ldtvFfX//muU5lzT9EXIjt47fUsmF2ZLE2P9JYXrk0W5ucqcxUHoyPT4xNjF67fHV8JFujbv3823Yx/nv94olO8dP2D3WIP7hD+7+zy/b/8dN7v/jWW+J/79vbv/+n3xI/nRO/u8v4k0M3Om7fncaf7tD+nd7/i7uM//zfK9O7fCgAcAAayytzk9VqZWGHi/Sz5k6PcfFhXsRqxHtQDRfv1UW3RyZgv210+m7XBAAAAAAAAAAAAAAA6KSxvDI3EPv7daJutxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDD67MAAAD//w/PzvM=")
syz_pidfd_open(0x0, 0x0)
fallocate(r1, 0x10, 0x0, 0x7000000)

3m54.621382228s ago: executing program 5 (id=3609):
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000040)={0x18, r1, 0x1, 0x0, &(0x7f0000000100)=[{0x206bb, 0xfffffffffffffffb}]})
ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x2, r1, 0x0, &(0x7f0000000280)='\"', 0x1, 0x5})

3m54.511974098s ago: executing program 5 (id=3611):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x3, 0x0, 0x3, 0x11, 0x0, 0x70bd2c, 0x25dfdbfc, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x2}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x7}}]}, 0x88}, 0x1, 0x7}, 0x0)

3m54.351611982s ago: executing program 5 (id=3616):
syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f0000000080)='./file1\x00', 0x80, &(0x7f0000000140)={[{@nodecompose}, {@nobarrier}, {@nodecompose}, {@force}, {@nobarrier}, {@type={'type', 0x3d, "aff0aae8"}}, {@nls={'nls', 0x3d, 'iso8859-9'}}]}, 0x44, 0x6ff, &(0x7f0000000500)="$eJzs3U1sHGf5APBn1uu1N5XcbZu0/f+FFKsRETSQ2F5KgoREqBDyoUKRuPS6JE5jee1GtoucCBEXKBzhhHLooQiZQ0+oB6QiDohyRkLiinKPxD3iwKKZnVnvh73ebfyRhN9Pmp13Zt6PZ57OvN6dbbQB/M9afDsmtyOJxQtvbaXbD3bqzQc79dWiHBFTEVGKKLdXkaxFJJ9FXI32Ev+X7sy7S/Yb542Hn354/v7H9fZWOV+y+qVh7Xa1hoywnS8xGxET+XpM5f36ux5vDvR3b6yuk07cacLOFYmDk9YasD1O8xHuW+BJdy9iYnKP/bWIUxExnb8PiHx2KB1zeIdurFkOAAAAnkwTB1V4/lE8iq2YOZ5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4NmQtH8zMMmXUlGejaT4/f9Kvi9VqZxwvMN95YDjH9w8pkAAAAAAAAAA4Eh8kn9xf/ZRPIqtmCn2t5LsO//Xso3T2etz8V5sxFKsx8XYikZsxmasx3zE5ExXh5Wtxubm+vxgy19H2rLVat3LWy5ERG2g5cI+gZYO+cQBAAAAAAAA4Nn0k1iMmZMOAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuiURE+1VtpwuyrUolSNiOiIqab3tiD8V5afZn086AAAAADh61Xw9k/ynXWgl2Wf+l7PP/dPxXqzFZizHZjRjKW5kzwLan/pLf9+uNx/s1FfTZbDjb/9rrDiyHiNiIt7fZ+S5rMaZTovF+G58Py7EbFyL9ViOH0YjNmMpZqOankQ0Iolatf30olbEuXe8V3u2rvXHdrZv+9UskmrcjOUstotxvRLtxybZOaRjvto12h8qEX0jvp9mJ/lWbsQc3ej67/Wr/LlMrvX8iH0cjVp25pOdjMyluc+z8cLw3I95nfSPNB+lzjOo07ujpJv9IxU5/8E4OT/VXk2nLz/vzflhG/NRWn8mFqKUX30RL/fm/PYX77/Y2/jL//jLtVultZVbNzcuHOEpPY7ZgypMFoX+TNS7MvHK8Ksvz0QzzcT26JmY7N8xPWrLo1XJs5FNRSPOlt/JSo14resSfDduxFJcjrmYjysxF9+Ihah3rrB0OdOT13J9tTcn2b1WGpzfqkOCP/elrkq/OKDy8Urz8kJXXrtnulp2LN9z9Zcx13X1vTj86hv7r0A6/v/n5XSMn3b+4jwJejKRz81FdC8Nz8RvWunrRnNtZf1W4/aI453P1+lt+0Hv3Pzb0aPu/+t+GNLrJZ1xy9lWlpNqcb2kx17qRNubr0r+jUu7XWng2JnOsVrMxHJ8b987tZK/hxvsqX3sle5j/9ydOSv5+5viWM+7nHg3mtm7kD4HTtUAHLNTr5+qVB9W/1b9qPqz6q3qW9NvTl2Z+kIlJv9a/uPE70u/K30zeT0+ih/HzElHCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz4KNO3dXGs3m0nqnENP9ex63UNl3rOGFKB1YZ+e50TqMWsTwsZK8UDncc38aC9Xo21P8wtLj9vxJRAypU3ns4JOxr7GxC2keDqXDVqud1GxPa2KM5uWi1d51yrExHSuNpLzHHTe1exdEbaXR/Herp3k1um4Z4Bl3aXP19qWNO3e/urzaeGfpnaW1hSuXr1yuf33+a5duLjeX5tqvJx0lcBQ27tyd2GP3wC/dAgAAAAAAAAAAAE+O/P/+3/zc/5ihfECdyvrG3iOfPe5TBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ5Si2/H5HYkMT93cS7dfrBTb6ZLUd6tWY6IUkQkP4pIPou4Gu0lal3dJfuN88bDTz88f//j+m5f5aJ+aVi70WznS8xGxES+PtjUHt0M9ne9q7/tzxVe0jnDNGHnisTBSftvAAAA//9u//cB")
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='tracefs\x00', 0x800, 0x0)
mount$bpf(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x5006d, 0x0)
mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1002c, &(0x7f0000000200)={[{@mode={'mode', 0x3d, 0xf18c}}]})

3m54.243339723s ago: executing program 5 (id=3617):
syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000080)='./file1\x00', 0x3000851, &(0x7f00000002c0)={[{@noacl}, {@nodatacow}, {@nossd}, {@barrier}, {@discard}, {@space_cache_v1}, {@usebackuproot}, {@nossd_spread}]}, 0x1, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734fVCUoXQKNkkNY6beL22gUQtVdaUqhEpzbqhoCqi2NhrsnjBjm1KjEJkbCIaIShtkJIPRRhFUc0HqBWISAoIFymOUHlEVEUBBAqtIQoipSQRaYIUqtl7z+ydc3cefqzx0t9P8s6Z+Z/nnYfn3HvnXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/h4Feu+dtm8Ud/e96zL1w8fsWetRe/et15pz4ZwsTM4x1ZuKP/xtvHf373uffseWD1HfcdPv+jvXm5PB4Gqn868zs3xFoPLw7h/o4QutPAisEs0JPfH4z1vW8whFPCbKBWYrI/K5E2HL7fF8K+MBuoVfW9vhAGC4ELn3rk4Zuridv6QlgaQqikbTxfydroSwNn9GaB/jSwtTsL/OqtTC3w3c4sAMcsvhlqL/oDE/UZhucu1+D113PcOvb2SofXFRPDjfP9bO08d6qgN31g4pietlJ1zIvS2+Ogd9sCeLeVtvOtnrbiF6n8G8pbs6FK6Nw0uXnD1dM74yOdYXS0q1FN8/Q8P/P6lzYeSXrBvA5jB4aPy+vwlieW3t21/ILH71ux9OX9H9v7yrF280eFTVpMz7dKyF9zC+Z5jMZ9niyAt1/pW9KIL10hhM2f/73PNIuX5v/Dzef/8eUcbzvrcsda3xzK5ubxkcGYeG0om5sDAADAgrEQ9ppuHX3oE83qK83/R9o7/h8P+eeT+Wy0B0MYn0nsXRLCaTOPZ4G7YnOXLQnhgzOpifrA2iRwMIT3ziSW16pKSiyKJUaSwE+G8sB4EjgUAxNJ4FsxcGsSuCEGDiSBjTFwMAmcGwNhqn4cvz+Uj6PtQF8MrM824oF4FsIvhmJrybZ6rlYVAADAcZLPDnvq7xbOdTjWDHF6eaCvVYZ4BnbDDJWkhnQGW5tWNayhu1UNna1qqI17d/Phl2ruaFVz6TSMjvoMt//ybz4bmijN/8eaz/8rc3Sko3T8P4R1M39j7s48Ml2Lr5+oywAAAAAcg4H/ffGbzeKl+f94e+f/x30iXYXM4bG4G2LLkhDG6gNZtX9YDmRHvQfyAAAAACwEtePxtWPhU/ltdop2Op8u5584wvzxwP/4nPl7Dz64vll/S/P/ifbO/++vv806cSj24mtLQlhUCPwg9rIamDESAz/+ZH0gH/+huAFuilXlJybUqropllgfA2NJYF+jEj+slTitPpA/WbXG99bGMZWXKAQAAADghIu7A+Jx+Xj+/4d+s/qaZuVK8//1R3b+/8w8uHR6//RACCu7Q+hKfxjwWH+2MGAMDHbkiYf6s7q60qqu7w/hnOrA0qpezNf/707XGHyqL6sqBk770P7Xz6gmvtkXwspi4OnP3XlWNbEzCdQa/8u+ED5QHW3a+HcWZY33pI1/fVEI7y8EalVdtiiEamO9aVWPVPLrGKRV/XMlhHcVArWqzq6EsCsAsEDF/0o3FR/csevaLRumpye3z2Mi7sPvC5unpidHN26d3lRp0KdNSZ/rljG6vjymdq9881y+RNFF964bbCdd+53gWLGtfD9+6cTB/H78LtQzM87VPXV316RD/siHy02EwjepRkPunOch9xcrmX0SS/XH/L1hICy6esfk9tEvbti5c/uq7G+72Vdnf+NhpmxbrUq3Vf9cfWvj5dFwtazE0W6rZcVKVu68ctvKHbuuXTF15YbLJy+fvGrV2avHzhxbM/bxM1dWRzWW/W0x1GVzVZ0M9a072xzXcRzq6d2FSk7Ep4aEhMRCS2wdWNb0/+TS/H9b8/l//NSJn/z5+gyNjv8Px8P82eOzh/nXx8C+do//Dzc6ml87MWAkCeyOgd0O8wMAAPDOECf5cW9m3Cv90+XfeblZudL8f3d7v/8/Tuv/15auP7/RMv/LY4mxRuv/p8v819b/391o/f90mf/a+v/73ob1/6+uBZJN8gvr/wMAAO8EJ279/5bL+6cXCChlaLm8f3qBgFKGlsv4t3uBgCNe///5//yr/w5NlOb/t7Y3/7dwPwAAAJw8vvxn1/xOs3hp/r+vvfn/iV//LzQ6/3+kUWCi0cKA1v8DAABggWq0/t/wjf2XNitXmv8faG/+H0+76KzLHWt9cyhb0y6ka9q9NlT7yQAAAAAsDJ1hdLSnzbx1K6OuPfo2n8mXAm2WLnrxTw4f2fn/B9ub/9f9LuOWJ5be3bX8gsffvG/F0pf3f2zvK7PH/wEAAID50+5+CQAAAAAAAAAAAAAA4O334n/sWdMsXvr9f1g383ij3//H6/7F3xe8uy53rLX1+n/5/Qs/fc+umSULHxsK4cPFwJY9W04J+bX5lxUDD1+y/D3VxJ60xIMvnPtSNXFpGvjUilPfqCbOSQLr4yKJ700D8aqKbyxOAnF5xX9PA3F7HEgDvXngq4uzcXSk2+qng9m26ki31bODISwpBGrb6v7BrI2OdIC3JYHaAL+QBuIA/zwPdKa9umcg61UMDMaidwxkvQIA4KQVvwX2hM1T05Nj8St8vD29u/42qluy7PpytR1tNv9cvjTZRfeuG2wn3ZV+F5291nhPqFSHsKr0dbWYpWNmlMenlhab7t0NhtxqtbfOBuVSR7rpehuPqC8b0ejGrdObeloOfE3rLKu7W2ZZVZrsFLN0zmzSNmppoy9tjKjNbdNGl+P9zjA62pXk+oMYHA51Wr0i2v29fnGdv0avgmKeqw7v/VWz+krz/+H25v+V4rjeyC8GsDteWe/vlljmHwAAAObXV9f++hvx32dvfPTpZnlL8/+R9ub/cQ9Wfig429txMF7/f++SEGYurT+cBe6KzV22JIQPzqQmYonsgvrnxxJjWeCuuMNkeSyxfqK+qkUxcCAJ/GQoDxxMAodiIN9LsT/ku3L+fiiEs2ZS6+pLbIslhpPAZ2JgJAmMxsBYElgcA+NJ4NXFeWAiCfxbDISp+m117+J8WwEAAByJfJ7VU383pPO8A92tMnS0ytDfKkNnqwyVVhkajSLe/3bM0JOcvNJRyNST1tqX1FLKEC+Gf8T9KmUIP6zPmRYsNR3PP6idb9BRn+GBT3RXQhOl+f9Ye/P//vrbrPVDcf4/e/2/LPCD2L2vxVPHR2Lgx5+sD+Q7Bg7Fye5Ntaom8hL5pP2mWGI8BkaSwLYYGE8C69flgX3vqQ/kM+1a43trjU/lJQoBAAAAOOHiDoK4mybO/+/Y8ZWBZuVK8//x9ub/sb2BYmM3xFoPLw7h/o7Z3tQCKwazQNyPMRh/Hv++wRBOKezgqJWY7M9K9CYNh+/3Zb9Q702r+l5f9uODeP/Cpx55+OZq4ra+EJYW9r7U2ni+krXRlwbO6M0C/Wlga3cWiHt+aoHvdmYBOGa1vYLxBZWf6lIzPHe5Bq+/d8o1QdPhlfaBzpFvrt9czZfSDtd8n2rNkT1tTfffctyU3h4HvdsW4rtt2Lut+EUq/4by1myoEjo3TW7ecPX0zvhI8ZesJfP0PBd/pdpO+ji8DncffW9bq6QdGEs+PsbmLjf367AjVnfLE0vv7lp+weP3rVj68v6P7X2l7W40EH8o/Mh1/zr4o8LmnW+VkL/mFtznyYTPk4X438CIpy2EsO7Vr9/ULF6a/0+0N//vTm5n/DpuzB1LQvhIYeM+Fjf/Hy/JPgcLgexT8l3lQHbI/b+GGn5yAgAAwPFW291R218wld9mJ4Sn8+Ry/okjzB/3V4zPmb/dfvf/9SVLm8VL8//1zef/i5JuOv7v+D/zxPH/OZ3su6IXpQ/sPqZd0aXqmBeO/8/pZH+3Of4/J8f/Hf+fi+P/LTj+P6eT/WkrfUva5ktXCOHlP3ro2Wbx0vx/W3vzf+v/zb1oX239v/WN1v/b1mj9v93W/wMAAOZVg4Xm0nleafW+UoZ09b5ShpYLBLZcYtD6f0e8/t9Lpz//m9BEaf6/u735f3w5DBRbXyjr/42sa1DVrTGwzcKAAAAAnIwa7SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg7fXAP/zPpmbxR3973rMvXDx+xZ61F7963XmnPhnC1MzjHVm4o//G28d/fve59+x5YPUd9x0+/6OVvFxPfvu7dbljrW8OhbCv8MhgTLw2VL0zG7jw0/fs6q4mHhsK4cPFwJY9W06pJr41FMKyYuDhS5a/p5rYk5Z48IVzX6omLk0Dn1px6hvVxDl5oCPt7j8uzrrbkXb35sUhLCkEat29YnF9VbU2/jQPdKZt/NNg1kYMDMai3xjM2oiB6VhialEIK7tD6EqrerSSVdWVVvUvlayqrrSqL1dCOCeE0J1W9UJvVlV3OvIne7OqYuC0D+1//YxqYl9vCCuLgac/d+dZ1cQXkkCt8b/oDeED1ZdM2vi3e7LGe9LGb+sJ4f0hhN60xC+7sxK9aYkXu0N4VyFQa/zz3SHsCrwjxA+fuk+0Hbuu3bJhenpy+zwmevO2+sLmqenJ0Y1bpzdVkj410lFIv3X90Y/9ude/tLF6e9G96wbbSXfn5Xpmury6p+7umpO997Ff/cVKZp+PUv0xf28YCIuu3jG5ffSLG3bu3L4q+9tu9tXZ3648mm2rVQtlWy0rVrJy55XbVu7Yde2KqSs3XD55+eRVq85ePXbm2Jqxj5+5sjqqsezv8RjqnSd+qKd3Fyo5ER8AEhISCy3RWffpNnayf5CXvujPdrQnVGY+oEvTimKWjplRHo9Brz3KER/N95SWI1pVmjiUsqyeI8v19VnWlCYTs7X0ZVlmvteVJofFxjpnNmm83xlGR7sabYfh+rvFzfuzY9i8z+Sbrt00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/HDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8rcPo2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEsBAAD//+erI4o=")
mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2200020, 0x0)

3m54.020121946s ago: executing program 5 (id=3622):
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x140, 0x800, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x4}, {0xfffffffd}, {0x0, 0x4}, {0x0, 0x4, 0x8}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x69, 0x0, 0x100, 0x2, 0xc})

3m53.858490835s ago: executing program 35 (id=3622):
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x140, 0x800, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x4}, {0xfffffffd}, {0x0, 0x4}, {0x0, 0x4, 0x8}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x69, 0x0, 0x100, 0x2, 0xc})

1m16.697474976s ago: executing program 6 (id=6038):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x1, 0x0, 0x7, 0x0, 0x0, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x0, 0xffffffffffffffff}, 0xfffffffe}}, 0xb8}}, 0x4004)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x1, 0xa, 0x20}, {}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x4000}}, 0xb8}}, 0x0)

1m16.290970198s ago: executing program 6 (id=6039):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071042b000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)

1m16.226885518s ago: executing program 6 (id=6042):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000050030000090a030000000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d04001280080003400000011008000c400000edd8f802098060000280040001"], 0x398}}, 0x0)

1m16.221224481s ago: executing program 6 (id=6047):
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x1808704, &(0x7f0000000500), 0xfd, 0x49f, &(0x7f0000000a40)="$eJzs3M1rXFUbAPDnTj763eTt27evra1Gqxj8SJq0ahcuVBRcKAi6qMuYpLV22kgToS1Bo0hdSsG9uBT8C9y5EXUhglsFl1IoGoSmriL3zr3NZDIzzVczTeb3g8mcc++ZOee5956Zc+/JnQDaVl/6J4nYHRG/RkRPJbu4QF/laW52evTW7PRoEvPzb/yZZOVuzk6PFkWL1+3KM/2liNInSTyfLK138vKVcyPl8vjFPD84df69wcnLV546e37kzPiZ8QvDJ0+eOD707DPDT69LnGlcNw99MHH44CtvXXtt9NS1t3/4Om3WgSOV9dVx3NGtOgHV0Zdutb/mM7XrHl1B2zeDPVXppLOFDWFFOiIi3V1dWf/viY5Y2Hk98fLHLW0ccFel303bGq+emQe2sCRa3QKgNYov+vT8t3hs0NDjnnDjhYjuPD03Oz06dzv+zijly7vuYv19EXFq5p8v0kes9DoEAMAqZGObJ+uN/0pxIHtOsvTefA6lNyL+ExH7IuK/EbE/Iv4XkZX9f0TcV3nxfM8y6++ryS8d/5Su123zOknHf89Vjf3mquLPn3o78tyeLP6u5PTZ8vixiGyb9EfXtjQ/1KSOb1/65bNG66rHf+kjrb8YC+YNuN5Zc4FubGRqZL02wo2PIg511os/uT0TkB4BByPi0Mreem+ROPv4V4cbFbpz/E2swzzT/JcRj1X2/0zUxF9Ims9PDm6P8vixweKoWOrHn6++3qj+NcW/DtL9v3Px8V9ToufvpDJf2xXl8vjFyZXXcfW3Txue06z2+O9O3szmrH96p7Ls0sjU1MWhiO7k1SxfnNNdGplfNPualRteKJ/G33+0fv/fl78mjf/+iEgP4iMR8UBEPJi3/aGIeDgijjaJ//sXH3m3SfxJJNFs/880ees1S+Mfq/v5d/v4702q5+tXkeg49903jWbMl7f/T2QboT9fkn3+3cFyG7jGzQcAAACbQikidkdSGqik+3ZHqTQwUPkf/v2xs1SemJx64vTE+xfGKvcI9EZXqbjS1VN1PXQoKS5TVPLD+bXiYv3x/Lrx5x07svzA6ER5rMWxQ7vbtbj/R9H/U390tLp1wF3nfi1oX7X9v9SidgAbbznf/84FYGuq0/93tKIdwMZz/g/tq17//7Amb/wPW9PS/v97nZ+sA7Yi439oX/o/tC/9H9rSWu7rX32iuFlg9e+zfdl3+G/KxPZ89zQscy4vsLCke8mS9U/siIUlUboXNlS7JNIes7GVLvyGCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwGb2bwAAAP//D6vjXA==")
open(&(0x7f0000000180)='./bus\x00', 0x4a37e, 0x4)
mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./bus\x00', 0x0, 0x1000, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x400, 0x0, 0x0, 0x1b, 0x0, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000000000000c00002000", "036c47c67808200400000000000000335263bdbcef549ba197fce47ddfdd753abd950100002a00ffffffffffffffff00000000e8f20000000200", "b7326736181c208220000000b9000000000000000000f0fffffffff2ff00", [0x4]})
r1 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0)

1m16.052036693s ago: executing program 6 (id=6045):
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
syz_mount_image$bcachefs(&(0x7f0000000140), &(0x7f0000000100)='./file0\x00', 0x2800000, &(0x7f0000000000)=ANY=[], 0xfd, 0x5a7a, &(0x7f0000006680)="$eJzs3WuQXNV9IPBzu3s0Lz1GAgcZzGiQ0Ybg2BrxKj9SsZJN7BQQSi5SDmJlw4BGRLYkVHoEECSILHhRAS6cIpXg5ANxYXYxiosq2BiFMuGxEmtjq9h4qS1MrZ3F/uAtwqIKoKVcXs/W9NzT032779yenh4hid+vYG7fM6f/99xzT9++/9NX0wEAAID3hEN37Dx62em/+90/G3/71t/7h623hcFytbwvVhhKlze+Wy3kWOqtLK8us+PiV2/+xk9Hrv3t7zw68PV3Dm48a9MPf+eUa5/8wsUH7v/rZ95a9PgvXy2KG8fTudPryetJCH3fPvIXXzr4wmmTZcniyZ+lvSEsTZY9szQJ4fb6EKM/DyFsTFeWZ+I/9vb5myaXt93V21C+JFPPeH9vmzzOSQhhz9EbPhR+9Fvrb//+im/+Xc/+1/ZOV0n66sZTCIuvrn9+TwihP/1/UhxtcTwm6XJdCGGg7nkfLWjXB9to96TVmfK4fka6XJAuBwvixd+vzKyXMvWy61FPZjlQsL25ymtHp/WKLMysJ12KG+W1M5YvTZffSpfnzjJ+Od2HchJKSajUmr8lmR4joe64JSGpHsu+2nqpdmxDuv+Z9SSzXsqsl3sy+1XdbjrQyknSWB7rZcrj6biSlp9Vf65u4fK6x/X13h/L0hfqO9k6maCDTQ9q+1UV23VkhrYcC6W6c1Cr8tqBTw/GYFo2mCxres5EC/F3B9ffvaq84dlDQzntSB5N0vhJR/H3fG/pws8/sm939n29Fv/qUhq/1FH8H19y+I0r933tq7nx743xyx3FP++pgdcvee6Olbn9cyT2T6Wj+GOvPn/PilOv2Z/b/gdi/L6O4q89cLh30dGnns5t/2jsn/6O4r/yiU/95OGXnngtN36I8Qc6ir/hwPYv9w4fPSc3/tOxfwY7Gz9v7r/o5eHhn43kxX8xxl/UUfyH9vZ+/MEld12ce3zXxf4Z6ij+pWc/efvCo0+cmXfuTB7o1jsnwHvTKek11p3peqd55lzV5Qt/NVKZuuZbmP6/qJsbylx8ZvMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiG933ov376f3126PVKut6bPnilNLWM5QtCSPpDCDt3je3YtXnbdSNfuH73jm1jW0bGdo2Mb9u146aRC359ZMf49i1jN03+dvTD5089b1lIppbJmU3b7p2YmCgNNZbF7f3bs/f/aNVH//e/hDD6vh8MV3Lbv/r+rQ+e2uJnRrJ24pNbd1/2gwv/Nt2vobRdQy3aNTExMRFy2vV/rvjFg39+5KfnhDD6KzO16/lXfvMfGxpULZiOkyr1hqkG9SYDLdtRa3XanthflU2bt4yPzty/k88v5+zHv7v5tZ9vuvErv5jq377c/Wizf/vXTmwp/eX6S//fX94yVVDUrnfruE/2dzkn5mS74l7E9sX+60v7e3G6X4tz9quSs193fP/pl759+r639obRypsrmo910X71pAOgJ3l/W9uNWxhIljaU96X14xGPz1u9a+v21Ttv2vPhzVvHrhu/bnzbx9ZcsOai0QsvunB1dc9Xd3n/4/b/TZv7f2zG05I/3vut+LO98dTYrgWz7o/JdhX3R32L8l5/A5d/6b6P3f/cZVMFReeVWLt2PkmXA5PHeU2oG2/NfdVqv4qOTwhhpFU/vPHWxeG0/7H59qLzUP2Rqf+ZkaydeGHlv/7tR/9m+W9MFRyT83x9gzo8z9daPd2ean/1pcdj4jjt3970bNqbDLZs15oXnuu5+9C//EmtfQsWhBvHdu3asWbq58K0pQuTM1q2K1sa92tF9Wc5pN0SasO0xXid1BOm2pc9f8bq2V4dTH83mCxruV9Z8XcH19+9qrzh2UN5PZ08OrXF/rBoapl8IKfmlswTy7UGt9r+8fr6Kxofw5/+m8c/+/jfX9A0Ps6b+lm0X0nOfn3zpYfu+/pX/sPfd2+/Pv2bh4f+9X/+0aqpgmNwXglzOq+UpxpSa3XanqT+vHJeCEWvvxWh9X7kvv5Krfen6PWX3c50/dbxRjLrg6Hc0ev1vKcGXr/kuTtW5r5ej8z0eq3f2VsanlcueL0eL+9L2ddXUmlsx/y9vhoGSrJ24jt3nrL3mVvXnT5VUPR+Wavdalyf30b+kbNf/3jly8PXj/z7/96988Y3fv2xq344tvZPpwo6P+6xLd057n1p//bl9G+t1THvrO/fj1x7/ZaNU+VF/fzuXf+my4L8J55Kdt6054tjW7aM79jZ3n61+34at5Pt5U7fT+PZbVnBfpWa9mv+HrTTX+2+3mL7N3bcX42vt8GQdPS+sOd7Sxd+/pF9u4eanpVu6OpSGr/UUfwfX3L4jSv3fe2rufHvjfErHcUfe/X5e1aces3+3PgPJGn8vuL4i0NT/LUHDvcuOvrU07nxR2P7+ztq/yuf+NRPHn7piddy44cYf7Cz/n9z/0UvDw//LDf+i0m6nclrpBAee/v8TVPrSehJX2+xHT0N7QrZ9SSzXsqsl+vXS3EWId1AOUkay2O9tPysura08oc55fEqrG/51PKduB6yD2YuP96U6s79rcqLrlMBAE528fP/eA0aP/8fTy+U8mcaYNpc87DlOXFjHjY9n9P4GevyNH58fpwHHP5IGJ1c3jYydaE/288R4ushO88Zt3POBxtjtJyfOFC/ker2m+Y5i+bfV2bWY7um5ssrdXloqjmvqYQ25t+btzPz/Htm94s/zxq5s6lZI3XzVtnj15POmLW63yHT3spkhLzxkZ0Xi/dzDC8O66rba3N8ZO+jicchex9N3M7pmRNnp/fR5I2PoeZ+aGhXHB+x3gzjo9rk4s8jm49fmKF/p49f62jZ4zeL4903WX++P5/twrxhy1PasZs3nN/Pw46LeckW8Y/xvOTCpvjpC+x4nzeM5bGfKm3OJ342p7xb84nxdBHbdWSGthwL5hOBk1XM/+N7xGT+P3kB/n8z9YrylOxVY4yXe59Qzk3YRXlH8316Ax29j284sP3LvcNHz8m9znm63fv0tjesDRTc91PUj6sy64X9mDNBU5TvZbdT1O/Z+zIGw6KO+v2hvfd//MEld12c2+/rpt5Ii/v9voa1RQX9fgLkC63jyxdOpnyhOX6X7mMomj/Lz0fKtXbMSz6S3vg0X/nIH+SUzzYfGWh6UNuvquM3H5l+I23IR3qObbsAgBNHzP9rn5+l+f8/xwuL9DqiKG89N7Me4+XmrTnXJ3l56++nyxsz9QfTf1Ex2+vmS89+8vaFR584MzdveaDdPPQ/NawNFeahc8ubc/OIdd25Xzw3j6jlWXPLE3PbX8sT55an53xMW5enzy2Pzu2fWh7dOA9w3+HpTGOm+HEeIDd+bR6gi3nuL6crHbs8t2C+LrOxuNrufN2xzqMnS3oWN+5nY1480J08Ov3ns/OVR1+eUz7bPHqw6UFtv6qO3zy6sVweDQCcrGL+Hy/jqvl/bwjPxQr98cHcPmfPzQu6dN2e/XsgtfgvzkteOR2/S5//Fud98523zndeP9/zEif657/zPS80VP0DnvM1T/au3e86L3nxP9cetZ0XpxuVFwMAcDyL+X9M8+Pn/89l6s01P2nK33qmLiGn85MTLz+vr3cC5+dXhGOVn/eeyPn5iT7/Nb/3yZxc+f+0Dj8Xf2fiJM7/q22W/wMAnJBi/h//2WP8+3//JV3P/t36NvP0B7K38/oc3efoQZ7eRp7e5Xm2GL/+PoATeB6gPPd5gP5jfn98/3T9k2keoKonmAwAADgB9FQzpeZ/Z/+5dJn9d/Z5/y7/ypz67aqkl8fX7NoxPn7V7u0bx3aNX7Xt+o3jO6+6YcfmXbvGa9fOc8sbc/OWNG/sCZW0P1rXy+ZtS9K/h7Ak5+8hZOvHsGdUHzT/PYTsZvsL/o7A9PFrr715x680Q/1W4yPveOfF/8Oc+lHt+F/7R+ddtWnnVZu3bd61eWzL5j3jjfWGqv+Suv3vzYyfU87q+1IzP5qUZv/9nfHwzK0dpaZ29KT9kff97EmmHUvTlizN+/6DnHZ/97/9+R+fPfGLh0MYfV/5A3Pqv2TtxH++Yvz3dx36wfbJ9pdmbH+tZtquou8rzdaP+1PZcv3OXR/adP3ubdlvlOxMnM8o1dbn6b6G9OVfbnN+YkNO+Wz//X656cHxqe35CQAAGsTP/+P1bPz88CvpBVQsL8zTt03Vm+vnx7l5+mh7eXr2e8mK8vRs/bi/7ebpfXPM07PbL8rTW9Vvlafn5d158f8gp/5stT9OOrjPo5L2wyP7dueOk6vbGyfZ7zMoGifZ+rMdJ8kcx0l2+0XjpFX9VuMk77jnxf9MTv08ReOhUhsPc7svJ3c83NveePi1zHrReMjWn+14KM1xPGS3XzQeWtVvNR7yjm9z/MYJgu7M/04OjOq4GL/qhut3fLGu3nx//0VoviWjnfYtmH7u/H7/R6fa79/5ve9r7u0PYW21JK/98fOBBbNqf7v3lc29/UX9P4v7yhaHpvvKctv/4txmwtpv/6zuS7wt/q7d73fJyKve/PxjNV+bDrui+8+K5nHX55TPdh53QdOD45N5XHj3xPw/Xs3F/P+udNntj4FO/O9J6+D++3gO9j1m+f3f5nXMe+79PPuRu/dzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJNCb2V5dXnojp1HLzv9d7/7Z+Nv3/p7/7D1tl+9+Rs/Hbn2t7/z6MDX3zm48axNP/ydU6598gsXH7j/r595a9Hjv3y1MPBQ9Wfl3HS1L4Tk9SSEvm8f+YsvHXzhtMmyJIRQTob2hrA0WfbM0iQTYfTnIYSNtXY2/vKxt8/fNLm87a7ehvIlmSDZ/QqD5die+naGcGPhHnEC6kvH2Z6jN3wo/Oi31t/+/RXf/Lue/a/tna6S9NWNpxAWX13//J4QQn/6/6Q42pbHJ6fLdSGEgbrnfbSgXR9ss/2rc9bPSJcL0uVgQZz4+5WZ9VKmXnY96sks6/a1v2DTHclrR6f1iizMrGdPRnOV185YvjRdfitdnjvL+OX4fxJKSajUmr8lmR4joe64JSGpHsu+2nqpdmxDuv+Z9SSzXsqsl3sy+1XdbjrQyknSWB7rZcrj6biSlp9Vf65u4fKc8veny770hfpOXA/ZB1MGmx7U9qsqtuvIDG1J/cfWxZXiZ7ahVHcOalVeO/DpwRhMywaTZU3PmWgh/u7g+rtXlTc8e2gopx3Jo0kaP+ko/p7vLV34+Uf27V6eF//qUhq/1FH8H19y+I0r933tq7nx743xyx3FP++pgdcvee6Olbn9cyT2T6Wj+GOvPn/PilOv2Z/b/gdi/L6O4q89cLh30dGnns5t/2jsn/6O4r/yiU/95OGXnngtN36I8Qc6ir/hwPYv9w4fPSc3/tOxfwY7Gz9v7r/o5eHhn43kxX8xxl/UUfyH9t7/8QeX3HVx7vFdF/tnqKP4l5795O0Ljz5xZt65M3mgW++cAO9Np6TXWHem653mmXNVly/81Uhl6ppvYfr/om5uKGNyO4vnMT4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACenf7rlgs9d8cnPrK8kISQ5dSZaiL8rL1i7dqSD7Y69+vw9K069Zn992fIO4gAAAADFYh5eqpX0heXhhqQ/nNGyfpwjOCOuJY3l2TmEGCc7R9BpnFKLOKUO4pS71J5Kl+L0dCnOgi7F6e1SnL6COH2hvTj9M8SpTI6ANtszMGN72o8z2KU4C7sUZ1EmRKdxFnepPUu6FGdoxjjtj8OlXYqzrEtxTulSnFO7FOd9XYrzK12Kc1qX4mTnlGc7DhelNU/Pi1N9UC6MU0nKtV+0mk8/Ld3OmXPczmDBdhYVvR+3uZ3+NrfzwczzSrPcTl+b27lgjttJ2tzOr81xO6WC7cRxe2O2fXE7ca3N8X9Tl+Ls6VKcm7sU55YuxfmTLsX50y7FuTU0XpzONg5Au2L+P53vDYXeym+EgfSMk50FiPnuiurP5ve7vBNSjPeBTPmConjZRD0Tb8Vs25edQMjEW5kp72mIV6nlIzPE66uPtyrzy5n29xNrW7etPt65mfLeGeI17AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAP/dMsFn7vik59ZH5Iw+V9LEy3E35UXrF070sF2D66/e1V5w7OH6st6Kx0EAgAAAArFPLynVtIXeitrQm+yoKFeXzoP0Jeul4emlsOLw7rJZTJSqq4PJEtnfF4lfd7qXVu3r955054Pb946dt34dePbPrbmgjUXjV540YWrN23eMj469TOE3oJ4IYTq9MPOm/Z8cWzLlvEdO6cKs+1fnj5vebqepM8b/kgYnVzelrZ/WcH2Sk3bm78HxUcPAAAAAAAAAAAAAAAAAAAAAAD+P7v2GyJpXQcA/PvMzM6Mq5cb/hsP7xzOU6ys9FpDS9wHggT/HC5CzFqbHHmStHqH3onZpAepKUWgHBwXvujCJE1645+UyD8cGGYJ7XWESvmiXhRahoovQpnY3Xnm38442yS35/X5vJjnme/v+/t9f7+H4+D7zAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABxa8/XJ2drU9Mx4EpEMyGn0kY3li2laHaHuV57c/oPS+nfO7IyVCiMsBAAAAAyV9eFjrUg5SoV85OPkxW8bomMg2n0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/2e+Pjlbm5qeOTqJSAbkNPrIxvLFNK2OUPfVtx7+7Evr1/+tM1YZYR0AAABguKwPz7Ui5ajEaTGWnLzQ+bei2buBtT3zl/LasnXWrTCv993BoLzTVph3xgrzPjYkb3PzenMAAADAh1/W/xdakYkoFdYs64ez/n9YX5/lndqTl29eq51J76u4kiQAAABgBbL+v9SKVKJUqLT69ZX2+xvaocWfzrP5w363z+af3pOXzR/2e/5lzavf6QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgw2O+Pjlbm5qeyScRyYCcRh/ZWL6YptUR6m56avwfl+y/Y0NnrFQYYSEAAABgqKwPb7fe5SgVxmMsjl7s+9dfdN+jX3r08cmIWGrzi8W4ecuOHTdsWviMTVneOS/sH/v+c69/e1neOUufq3ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgAzNfn5ytTU3PHJVEJANyGn1kY/limlZHqPvK57/4lwcPPvFaZ6wywjoAAADAcFkf3u79y1GJYhTjxMVvnb3+glzP/EHvDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAjx43fvOUbW+bmtt7gZnVuGvmIw2Ab/+NN9s/pcNnPh/+mvNrbWN3/lwAAgA/eqZFE47900uWrvWsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBwMF+fnK1NTc+Uk4hkQE4jU2oHsrF8MU2rI9RNn3yxtOadp57pjFVGWAcAAAAYLuvD271/OSoxFmNxwuK3fu8EGgv9/8Qh3CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwWJmvT87WpqZn1iQRyYCcRh/ZWL6YptUR6j6wa+/n7j/2exd3xkqFERYCAAAAhsr68GIrUo5S4eNRilOa3+e6JyT55rX/e4H2vO1d08ZXPK/eNS//fvOSQkRr3l09Jys0T7M0r5ytN7F0bdWrtuflmvOqHfMq0Spfbc1bfFi7u6qtGXK+5U8eAAAADp2s/y+1IhNRKpQ6+v+fNq9HNa+D+tzcod04AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDYma9PztampmeSJCIZkNPoIxvLF9O0OkLdW3770WO++rO7d3bGKiOsAwAAAAyX9eHt3r8clVgXH4l1i31/THTnZ3n/rL17/73/+uuZEWefeGB9oXfZH2U3v37lwqd7PyJy3dm5iGOb9ZIB9X7z+3tv2th498GIs0/In7KsXrx/ve4l08Zjta2X7XjuwPYhDwcAAACOEFn/P9aKTESpcP3A/j/rvIf0/y2LDfixN+36xfHNz2ZH3jMjN9GslxtQ7wsbH/7z6ef9/fWF/n95vU+27j6997r7j+8quBTpkaSNqet2bj5w7r5cduql+vme+tlz+fK3Xvv3NTff8+5S/XKUm/G1PVtZqrb8s6d8pI253J6ZS9/bU++uXxhw/jt+98zBX629++2F+m+dOt6qf0b0q7908sLA+nFU2hi/4s7d5+/dv7m7fkRU+9V/4+2L46Q/Xnt77/nH42DXwp1PvvOz9wGkjRc2vLnvvPsqF3TXT3rqZ8//5wcf2P2Te777eFY/+1uRM0+LFdbP9dR//q7jdj172+Vru+vnBpz/6StfWr+t+p0/9J7/6q5VCwN3sfz8D531yFUvb0lv7R0CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4sszXJ2drU9MzuSQiGZDT6CMbyxfTtDpC3VcvefGNK+/+8Q87Y5UR1gEAAACGy/rwdu9fjkoUoxjji33/Y7Wtl+147sD2mFgaTZrXwty2G3d84pptO6+/epV2DgAAAKzUq5cki/1/oRWZiFJhY4w1+/+p63ZuPnDuvlzW/+cWrklEXHPt3Nazo5X3/F3H7Xr2tsvXtt4TRCz+WUB5Ie8z7byLLnxx4s0/ff30vnmb2nkvbHhz33n3VS7I8qIz75xovZ946KxHrnp5S3pra3+deZ/62ra55uuJbN3xK+7cff7e/Ztz2XuM5nW8uW6WN5fbM3Ppe3vquYkoLYznm3nl5rkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgOXm65OztanpmchHJANyGp2agWwsX0zT6gh1L934y9uPeeeJdZ2xUmGEhQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+wAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhf36CY2j7OMA/jy7yZtNNmmT9gWjYppWRamHFgURvaioSCtS8FQpUm3tQRQEEaUeTKUVS1W8CFYvRVRQoxQq2FgsrZKK/4oXDyooVA9CKQY0S/Ggks0zm81kpxs3KiifDyxPnmdmvvObmWefzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwL9KT9dwvT2x56Ha7Rfc/MkT904/fut7D+y67LE3fhjdduPHB/tePTu5ffWOr29aue3IfRsm9r90/JeBd3471Tb40dlmbepWQohnYgiV96eef3Ly0/NmxmIIoRwHx0IYiiuOD8VcwvpfQwjbG3XO33ho+qodM+2ufT3zxpfnQvLXFarlrJ5Zg/Pr5b+lkubZztojV4Rvb9i8+/NVb7/VPX56bG6XOLNPOc2nEJZtbT6+O4TQmz4zstk2nB2c2k0hhL6m465pU9fFi6x/XQi1XL/uwtT+L7XVNjnZ9jW5fim3X76f6c61fW3Ot1RFdbTdr7ez8/Xn+vnFaKkada5rPT6U2ndTu/ZP5pezTwylGLoa5d8f5+ZIaHpuMcT6s6w0+qXGsw3p+nP9mOuXcv1yd+666udNE60c4/zxbL/ceLYcd6Xx1c1rdQt3FIyfn9pK+qKezfoh/8es6oI/GtdVl9U1dY5a/gmlpjWo1XjjwaeHUU1j1bhiwTG/t5Btm9z89KXlLR+cGCyoIx6MKT92lL/zs6H+u97c+/BwUf7WUsovdZT/3caTP9259+UXC/Ofy/LLHeVfebTvzMYP96wpvD9TcyvIYvJj6mfb7j710TOr/n/PeKtnXc88kN3/Skf1Xz9xsmegdvRYYf3rs/vT21H+N9fd8v3rXx4+XZgfsvy+jvK3TDz4bM9I7fLC/GOzX4VqfYZ2MH9+Hr/6q5GRH0eL8r/I7v9Ai/zYNv+1sf3XvrJ834bC+bkpuz+DKX/hD9u58m+75Mju/trhi4rWznhgsb+wALSyMv2P9VTqt3vPPDRdavmeuVRN7wsvjHbN/gL1p8/AX3minJnzLPsb8wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD/YgQMSAAAAAEH/X7cjUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgqAAD//0wFDK4=")
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x4020bc10, &(0x7f0000000280)=0x1)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r4, &(0x7f0000000000)={0xa, 0xfffe, 0x23000000, @ipv4={'\x00', '\xff\xff', @remote}, 0x4005}, 0x1c)
r5 = syz_open_dev$radio(&(0x7f0000000000), 0x2, 0x2)
mkdirat(0xffffffffffffff9c, 0x0, 0x1c0)
r6 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
fanotify_mark(0xffffffffffffffff, 0x105, 0x5000003a, r6, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0)
ioctl$SNDRV_PCM_IOCTL_HWSYNC(r7, 0x4122, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2)
r8 = epoll_create(0x6)
r9 = dup3(r5, r8, 0x0)
read$FUSE(r9, &(0x7f0000000040)={0x2020}, 0x2020)

1m15.660603041s ago: executing program 6 (id=6049):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0800034000000004640000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000380003803400008028000180230001"], 0xf0}, 0x1, 0x0, 0x0, 0x80}, 0x0)

1m15.594277247s ago: executing program 36 (id=6049):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0800034000000004640000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000380003803400008028000180230001"], 0xf0}, 0x1, 0x0, 0x0, 0x80}, 0x0)

1.244806527s ago: executing program 0 (id=7235):
capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000140))
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000640)='ns/pid_for_children\x00')
setns(r0, 0x0)

1.184349949s ago: executing program 0 (id=7237):
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='attr\x00')
fchdir(r0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)

1.114937272s ago: executing program 0 (id=7239):
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0x1000000, {0x0, 0x0, 0x12, r1, {0x0, 0x300}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x6], [0x0, 0x0, 0x0, 0x3, 0xd645, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0xffff]}}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x9}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0xd}]}}]}, 0xac}, 0x1, 0x7a00}, 0x0)

1.02496697s ago: executing program 0 (id=7241):
syz_mount_image$udf(&(0x7f0000000f00), &(0x7f00000000c0)='./file1\x00', 0x800, &(0x7f0000001040)=ANY=[@ANYBLOB='uid=', @ANYRESDEC=0x0, @ANYBLOB="2c756e64656c6574652c6e6f7672732c6164696e6963622c766f6c756d653d30303030303030303030303030303030303030322c7569643d666f726765742c6769643d666f726765742c6e6f7374726963742c6e6f7672732c0085f95733019d784ca386da1fd41ffabd4b47acca2b8d488be702157dd8711c31732d"], 0xff, 0xc2d, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwoThoXm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8AVSakLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUmRNi2KEmV9Pjb13Z19b+a9eesZWdCbFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAxB+8cun0mfSwWwEAPEhXRr96+qz7PwA8Vq76/38AAAAAAAAAAAAAADjoUhTxZKSYu7KWxqv3HfXL7b5bt8eGhrevdiRVNQ9V5cuf+pmz585/6YXBC9283J75gPr322fjtdGrlxovz96cm59aWJiabIzNtCdmJ6d2vYe91t/qZHUCGjdfvzV5/fpC4+zz5zZ9fHvg/f4njg9cHHz21DPdsmNDw8OjG0XqveVr99yQjp1meByOIk5Fiue+99PUiogi9n4u6g927Lc6UnXiZNWJsaHhqiPT7dbMYvnhSPdEFBGNnkrN7jnafiyi1vdA+7CzZsRS2fyywSfL7o3OteZb16anGiOt+cX2Ynt2ZiR1Wlv2pxFFXEgRyxGx2n/37vqiiFqk+M6xtXQtIg51z8MXq4nBO7ej2Mc+7kLZzkZfxHLxCIzZAdYfRbwaKX72zomYyNeZ6lrzhYhXy/xBxFtlvhSRyi/G+Yj3tvke8WiqRRF/WY7/xbU0WV0PuteVy19rfGXm+mxP2e515SPeH+66Ujyk+8ORLflgHPBrUz2KaFVX/LV077/ZAQAAAAAAAAAAAAAAAOB+OxJFfCZSvPIff1LNK45qXvqxi4N/OPCrvXPGn/6Q/ZRln4+IpWJ3c3IP54mBI2kkpYc8l/hxVo8i/jTP//vWw24MAAAAAAAAAAAAAAAAAADAY62In0SKF989kZajd03x9syNxtXWtenOqrDdtX+7a6avr6+vN1InmznHcy7lXM65knM1ZxS5fs5mzvGcSzmXc67kXM0Zh3L9nM2c4zmXci7nXMm5mjNquX7OZs7xnEs5l3Ou5FzNGQdk7V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+TIor4RaT49jfWUqSIaEaMRydX+h926wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAUn8q4vuRovFHzTvbahGRqn87TpS/nI/m4TI/Gc3BMl+K5qWcrSprzW89hPazN32piB9Hiv7623cGPI9/X+fdna9BvPXNjXefrXXyUPfDgff7nzh+7OLg8G88vdPrtF0DTl5uz9y63RgbGh4e7dlcy0f/ZM+2gXzc4v50nYhYeOPN11vT01Pz9/6i/Arsofoj9CLVHpeeelG9iNqBaMbD6TuPgfL+/16k+N13/7N7w+/c/+vxK513d+7w8fM/27j/v7h1R7u8/9e21sv3//Kevt39/8mebS/m34301SLqizfn+o5H1BfeePNU+2brxtSNqZnzp09/eXDwy+dO9x2OqF9vT0/1vLovpwsAAAAAAAAAAAAAAADgwUlF/H6kaP14LTUi4nY1X2vg4uCzp545FIeq+Vab5m2/Nnr1UuPl2Ztz81MLC1OTjbGZ9sTs5NRuD1evpnuNDQ3vS2c+1JF9bv+R+suzc2/Mt2/88eK2nx+tX7q2sDjfmtj+4zgSRUSzd8vJqsFjQ8NVo6fbrZmq6si2k+k/ur5UxH9FionzjfT5vC3P/986w3/T/P+lrTvap/n/n+jZVh4zpSJ+Hil+56+ejs9X7Twad52zXO7vIsXJC5/L5eJwWa7bhs5zBTozA8uy/xcp/ukXm8t250M+uVH2zK5P7COiHP9jkeL7f/Hd+M28bfPzH7Yf/6Nbd7RP4/9Uz7ajm55XsOeuk8f/VKR46cm347fytg96/kf32RsncuE7z+fYp/H/VM+2gXzc374/XQcAAAAAAAAAAHik9aUi/j5S/HC4ll7I23bz9/8mt+5on/7+16d7tk3en/WKPvTFnk8qAAAAABwQfamIn0SKG4tv35lDvXn+d8/8z9/bmP85lLZ8Wv05369Vzw24n3/+12sgH3d8790GAAAAAAAAAAAAAAAAAACAAyWlIl7I66mPV/P5J3dcT30lUrzyP8/lcul4Wa67DvxA9Wv9yuzMqUvT07MTrcXWtempxuhca2KqrPtUpFj728/lukW1vnp3vfnOGu8ba7HPR4rhf+iW7azF3l2b/KmNsmfKsp+IFP/9j5vLdtex/tRG2bNl2b+JFF//l+3LHt8oe64s+91I8aOvN7plj5Zlu89H/fRG2ecnZot9GBUAAAAAAAAAAAAAAAAAAAAeN32piD+PFP97c/nOXP68/n9fz9vKW9/sWe9/i9vVOv8D1fr/O72+l/X/q+cKLO10VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HhKUcSbkWLuylpa6S/fd9Qvt2du3R4bGt6+2pFU1TxUlS9/6mfOnjv/pRcGL3Tzg+vfb5+J10avXmq8PHtzbn5qYWFqsjE2056YnZza9R72Wn+rk9UJaNx8/dbk9esLjbPPn9v08e2B9/ufOD5wcfDZU890y44NDQ+P9pSp9d3z0e+Sdth+OIr460jx3Pd+mn7YH1HE3s/Fh3x39tuRqhMnq06MDQ1XHZlut2YWyw9HuieiiGj0VGp2z9EDGIs9aUYslc0vG3yy7N7oXGu+dW16qjHSml9sL7ZnZ0ZSp7VlfxpRxIUUsRwRq/13764ving9Unzn2Fr61/6IQ93z8MUro189fXbndhT72MddKNvZ6ItYLh6BMTvA+qOIf44UP3vnRPxbf0QtOj/xhYhXy/xBxFvRGe9UfjHOR7y3zfeIR1Mtivj/cvwvrqV3+svrQfe6cvlrja/MXJ/tKdu9rjzy94cH6YBfm+pRxI+qK/5a+nf/XQMAAAAAAAAAAAAAAAAcIEX8eqR48d0TqZoffGdOcXvmRuNq69p0Z1pfd+5fd870+vr6eiN1splzPOdSzuWcKzlXc0aR6+dslllfXx/P75dyLudcybmaMw7l+jmbOcdzLuVczrmSczVn1HL9nM2c4zmXci7nXMm5mjMOyNw9AAAAAAAAAAAAAAAAAADg46Wo/knx7W+spfX+zvrS49HJFeuBfuz9MgAA//8hX/ir")
unlink(&(0x7f0000000000)='./file0/file0\x00')
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, 0x0, 0xd8)
timer_create(0x3, 0x0, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa)
r2 = syz_open_dev$MSR(&(0x7f0000000580), 0xa, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, 0x0, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0)
epoll_create(0x3)

665.196852ms ago: executing program 7 (id=7245):
r0 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000140)={0x5, 0x1, 0xc, 0x2, @vifc_lcl_addr=@rand_addr=0x64010102, @broadcast}, 0x10)
setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x4, 0x9b, 0x0, @vifc_lcl_ifindex, @empty}, 0x10)

595.026631ms ago: executing program 7 (id=7247):
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x1, 0x0, 'queue0\x00'})
write$sndseq(r0, &(0x7f0000000300)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1, {0xfd, 0xfb}, {0x7, 0x3d}, @raw32={[0x2, 0x7c, 0x8000000]}}, {0x2, 0x0, 0x5, 0x83, @tick=0x40000, {0xa}, {}, @note={0x81, 0x0, 0x0, 0x8}}, {0x6, 0x3, 0x9, 0x3, @tick=0x2001, {0x10, 0x5}, {0xd, 0x2}, @addr={0x40, 0x1}}], 0x54)
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01)
write$sndseq(r1, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @time={0x6, 0x9}, {}, {}, @result}], 0x1c)

542.578072ms ago: executing program 7 (id=7249):
r0 = socket$caif_stream(0x25, 0x1, 0x0)
sendmmsg$inet(r0, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)="b2", 0x1}], 0x1}, 0x1000000}], 0x2, 0x4004040)

542.291519ms ago: executing program 1 (id=7250):
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x80201, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x10c4, 0x0, 0x0, 0x180000}, &(0x7f0000000340)=<r2=>0x0, &(0x7f0000000280)=<r3=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4)
syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}})
io_uring_enter(r1, 0x3516, 0x0, 0x0, 0x0, 0x0)
syz_io_uring_setup(0x234, 0x0, 0x0, 0x0)
write$rfkill(r0, &(0x7f0000000000)={0x0, 0x8, 0x2, 0x1}, 0x8)

495.041247ms ago: executing program 7 (id=7251):
syz_mount_image$cramfs(&(0x7f00000002c0), &(0x7f0000000180)='./file0\x00', 0x300004c, &(0x7f00000013c0)=ANY=[], 0x0, 0x148, &(0x7f00000007c0)="$eJzs0TFLAmEcx/Hf45VGZRoZ2JAFDR2JeZ7YFqGRIGQHRbugFwRZkYs01dDmS5CohCZxiMYGsxbDA7E30XIQFDRePPdcWNTS/v9sz/d5nv9xd2vLhgw/IEFYPSgeHumlkl6Y3dSy6a2b27sx3j0Ahn7sr9jnm0ngRQKaA4B5ChQAPHiBnd09fTHvss+YSUAGkBoRXYE4O8xbQLSY0+Q5oDUpmvpHizvNze/6+vOsS2Cet/H+vHcA5Wq4UX/a6LQzkYXraQlnmfDMBMN55VsP6RU1PVUbDUrY1h+vkGL83nO0HelGG/We0cmua1nNiKvqUlyJKUqix98qYdkfhWPiOcxZuhEMefB2LFYnqNv75j3zAmhdfGhFnycA4HXfD3Txe8ey/wYrV/O54GAtF/C7IMn4Gk8IIYQQQgghhPzbZwAAAP//qXZmBw==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0, 0x0)
getdents(r0, 0x0, 0x22)

399.884023ms ago: executing program 1 (id=7252):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r3=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x28, r2, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0x9}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000d1}, 0x4000814)

398.671787ms ago: executing program 7 (id=7253):
r0 = socket$kcm(0xa, 0x5, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, 0x0)

314.726583ms ago: executing program 7 (id=7254):
syz_mount_image$ocfs2(&(0x7f00000001c0), &(0x7f0000000040)='./bus\x00', 0x2804440, &(0x7f0000004680)=ANY=[@ANYBLOB="61636c2c6e6f696e74722c6174696d655f7175616e74756d3d30303030303030303030303030303030303030372c6c6f63616c666c6f636b732c6c6f63616c616c6c6f633d30303030303030303030303030303030303030332c6c6f63616c666c6f636b732c696e74722c6865617274626561743d6e6f6e652c0024855616ead4c7dc9e9da093713b0e6a6e67e1af8e4f5d7cbff1185218b41bcefa2f4f41b8212051258a0a6168526c8eef9d759bbb36a4b49ff8042320899ca9b6e9fa68a0abe364e0e2d46408f18da37d557aa1ebb8aa29451a584f1980dc477bd97f6a0446b8957872e51c2adf98e1acff806babdc9d58bc06d6d0b19476862cebe64cafa5a069852602786f40bf6a1bf7594e171d16ced9409b168ef591c2f5b676a2eb18e8a3b91275fd4467aea2037bd9790e240137bc7c80cc99e9dd662a5f"], 0x5, 0x4430, &(0x7f0000004840)="$eJzs3c9PHNcdAPA3A67BtV1wfXClSl2pllq1FQKf2mKpGGNjsKkrt7aqXNYLrG2ShbVgiXLwgdws5RQphygHK5Fy42RxyNX5E3LJ0TlbSg65RIpkhWh3Z2FndldsEAux8/kcGOb9Zr8zb98chhcnKg+W1nJLa7nCSq68cG/tQu7tcml9uRjiQ9K2/2OH1z/d6cV1ctTX3i/ZzctX/3vnQgifL375Ynt7eztU9Ye2xpp+/+7bRwvNx4Y4U6fabvvWDsobIYSzLeOq6gsh/P+zEKIQwqUkbTI5DoYQToV63p1H793NHdBonj4vXsy/nHu8NX5+dvPJVue/PQrho9Lv/nZ/+es/9o1/9ZcD6h4AAAAAAAAAAAAAAAAAgFfc9K2bt/8zOhaeRaF/M2p9X3c6OXZ6P3b7wPyh938sAAAAAAAAAAAAAAAAAAAA/Eztvv+fi860ef9/KjlOdKi//a/ej5Hemfn3zakro2PJ/u9RS/7fk6RvLvWF4Tb7vmf3f7+Uqd9+//fWfvarMb5Gv0MhikdS53E8MhLCJ8nG7+eiE3GpvFb5673y+srigQ3jlZWOf333/lR0kg39u43/ZKb93u///9uWq6l6fvfgLrHXWjr+fR3Lffpu1FX8L2fqHUb82b90/PtraYPNBSbqE0A1/u/37x3/qUz7vYr/6RBCLqqONZeaAaprmGp6p/UKaen4H6ulpabO5IPsdP9/n4n/lUz7RzX/b2S/iGgrHf9f1dIGUiV27//heO/7/2qm/aOIf3X8G77/u5KO//F6Yn+qSO2T7Hb+n86036v4346TcZ6OUlfAZlRP7/T/6khLx3+gJX/3+S/uav13LVP/sJ7/Gv02nv8a0/+fo/rzH+2l4z/YsVy39/9Mpl6v5/+J2vqP/UrH/0QtLb12Hqr97Db+s5n2exX/2qpkoBH/3fnkh+P19I+t/7qSjv+v64lxc4mN2s/a+i/ae/1/PdP+Uaz/quPfiHvb6+siHf+THctV4/9FF9//NzL1muLfurg4IKPW+vuWjv+pjuVq9//A3vGfy9Tr9f3/p142DgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAKmEyOQyEaSp/H8chICJeT83PhRDRfWMzPl8oLb62FMJWk58KZ6H6pPF8o5ZdWyovFfKFUKi+EcCXJPxsGorVSuZJfLjy8utPWYPSgWFitzBcLlRDCdJL++3Cq0db8UmW58DCEcG0n7zdxefXhg8JKfnFp9Z+jo6OjYWZnDMNR8Z1KcaVS772eG8LsTt2hqGlwtezrO2M5Gb1ZXl9dKZRq6Tea6pTKC4VSU525JO+DMBxVVtdXFgqVYr5Uvt/o7yhNJMepmVv/u3VjrCX/blQ/Th7usAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4iZ6N/+PDEEJ//SwOIUw0fonalX/6vHgx/3Lu8db4+dnNJ1svOpUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Ed24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsEvHKA0EURiA34yF2nkMq2W3s11RRAtXBE+gx/AwehQv4R1SpEibIgSSWQibXdgmqb6veTA/M+/BPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHme3ruPt7qJSHG1uYz4+/pfHOYvpf7cj9+/OMOMnM7za/fwWDfl39NRfleOlm3epevV92eM1N7vYE+G+7TX97menGtq36bm6/veRMpVRLQlv005V9W8twAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACALTtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgWMBAAAAAGH+1lH0bQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPArAAD//9kGHvg=")
symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
creat(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x143042, 0x4)
mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0)

314.330152ms ago: executing program 1 (id=7255):
clock_gettime(0xfffffffffffffffd, &(0x7f0000000480))

255.347401ms ago: executing program 1 (id=7256):
syz_emit_ethernet(0x7a, &(0x7f0000000280)=ANY=[@ANYBLOB="856b934629faaaaaaaaaaa0180aa86dd60381f3400032f00fc000000000000000000000000000000ff020000000000000000000000000001042081000000896f00000800000086dd88a888be00000000100000000100000000000000080022eb000000002009000002000000000000000000000008"], 0x0)
rt_sigqueueinfo(0x0, 0x21, &(0x7f00000002c0)={0x0, 0x0, 0x19})

255.092714ms ago: executing program 1 (id=7257):
syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x759, &(0x7f00000004c0)={[{@noload}, {@noblock_validity}, {@discard}, {@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2}, 0x0}, {@nouid32}, {@noload}, {@journal_checksum}, {@mblk_io_submit}, {@minixdf}, {@usrjquota}, {@nolazytime}, {@journal_dev={'journal_dev', 0x3d, 0x765}}, {@norecovery}, {@nobarrier}, {@data_writeback}, {@resgid}], [{@audit}, {@uid_lt={'uid<', 0xee01}}], 0x2c}, 0xa, 0x516, &(0x7f0000000f80)="$eJzs3M9vG1UeAPDvOE7TbJtNtvuzP3br3e5qo11t06Q/D3toK5B6ASGBUDmGJK1K0xY1QWqriKYItRIHUP+CAjckThw5wQUB4gDqlYorQqpQLg09oEFjj10njvOrdkKaz0dy/Gbmjd/7zsyL35tnO4BNq5T9SSK2R8S3EdFbWZyboVR5mp2ZGvlpZmokiTR9/seknO/BzNRINWt1v235Qn8hovBmErsbi+2auHrt/PD4+NjlfMXAZCFPXRg+O3Z27OLQsWOHDnYfPTJ0uCVxZnV6sOv1S3t2nnrp9jMjp2+//MWHWX3TfHt9HBV95b9bll1Cx6PkR8XyUylKc49lnX+tsP6/dj116aQcfmH9KsOyZVdtdro6y+2/NzqiWNvWG0+/sa6VA9oqTdO0q2Ft7b1sOq2XJJUd0vRGCjwBklgqx7z/AsATovpG/2AmG6lOjTSOg59s909EeQSUxT2bPypbiuURbKmvMjbqbFP5f4iI09MP71T7YJvt+AMAa++TExG3Tlb6HdVHZUsh/lSX77f53FBfRPwuInZExO/z/ssfI8p5/xwRf6nbp2cZswClecuN/Z9vuvNEfXe1ZbL+3//zua25/b9azfs68qWecvydyZlz42MH8mPSH51d2fJg40vXbqt9+tTdd5qVX8r7f9VHVn72/ChH4YfivBt0o8OTw48bd9X9G+UDe70x/iSKSTUVsTMidq3i9bNjdu4/H+xptn1O/FmcDfG/3fzFi6uo0DzpexH/rpz/6ZgXf+Tzf0l5fvLCqwMTV6/971z9/OTg0SNDhwe2xvjYgYHqVdHoy69vPpcnG4YRi5z/atNo60Radv5/s+D1X5u57MtStfnaiZWXcfPeraZjmtVe/1uSF8rp6vzsleHJycuDEVuS6cb1Q4/2vTLcPSd/Fn//voXb/46In9/N99sdEdlF/NeI+FtE7M3r/veI+EdE7Fsk/s9P/vOVZkPIpeNvryz+0RWd/2aJ419FLLyp4/xnHzcU/FapIf7OeHhntmHCPDv/h8qp/nzN6PDk1qXiWqym9YnHOHQAAACwYeyNiO2RFPbnN5q2R6Gwf3/EttodlInJ/5659NrF0cp3BPqis1C909Vbdz90ML83nC1new3VLWfbD5bvG6dpmnZny9n4fbxnfUOHTW9bk/af+b5jvWsHtN2K5tGafaMN2JDmt/97y96z9R/IANZWCz5HA2xQ2j9sXstu/+36FhywbhZq/9cjZtehKsAaW6j9v9iw5via1AVYW8b/sHmtvv37MABsdN7/YVNa1pfkV5HYcWqRPEmxPYU2TxRi8V8B6Iuorqn2aRZ/we8KEa2pYUdLI+2ec04LC+bZGq0oKwpL5imu4IcYmia6W3Sc5yQKK9rr2bttvUS7ImKJq7d2sV2vJq61u8mUG8H76/vfCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PH9EgAA//8ANMvz")
r0 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0)

184.14879ms ago: executing program 1 (id=7258):
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
madvise(&(0x7f0000519000/0x1000)=nil, 0x1000, 0x66)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/snmp\x00')
pread64(r3, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000)

87.531976ms ago: executing program 0 (id=7259):
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e000006a001c000000000000000000000008000000", @ANYBLOB="af"], 0x38}, 0x0)

0s ago: executing program 0 (id=7260):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3)
syz_mount_image$btrfs(&(0x7f0000000200), &(0x7f0000000340)='./file0\x00', 0x800, &(0x7f00000004c0), 0x0, 0x559e, &(0x7f000000ac40)="$eJzs3X9sVeX9B/BzWwoN+C39jhUYfxAgBoMkyJYtjqB4MQa24eKlgsKcCEQlBivYRDcYqUWSZcaghU4EF5GQaDJjscM/FMywy7CMZfzY5hZjs4JSaZZsAzVrHDG69N77XO49l9tembNOXy/SnvPcz3me+9yT88d9X/qcGwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAURUcSc9+d0f3i0ZE1X77/Hz+e+OjGn4zfvX/roVvu23T/gjMjbto5a1nf+mlN8zdsbDjS/PS+ObdGUSLdL5Htf9u136q/88bbvlsdBly+MLOtrS31lJmuJzON4QUP9vcr/FkRRVFVbIDK7PbV7E5FwQC53cbiAQf0Tuui6O7J8ya1dT01bklyYU/xS6df9VBPYKhkr6ue89dSMv27InZErp136SUKLtFM//gF96m8CADgY5mZSm9yb0ezb3Fz7eZ4PdZOxtotsXZ4h9CS37gYmXGHl5rnpHh9iOaZzESFESXnGatnz3+unYr3j7VjUeNjzLPw0GykqS41z7Wx+lDNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCzZOzxo2tWtD2y575fdtQceff9OVc+8KWOw22LT4y8eunKHWum/HTWsr7105rmb9jYcKT56X1zbo2i2nS/RKZ74kTL5b9NjZ3fvXfcG427n6vpq8yOG7bD8g6OXg87s0ZH0cq8Sk8Y9q81UZQqLKSb0Y7iwl3pnW+HAgAAAJ8nX0n/rsi1M3GwqqCdSKfJRPpfkAmL77Quiu6ePG9SW9dT45YkF/Zc/HipEuMlLzherl17/ieRF4xD/I2Pd74eDm0sGmdg8RHjef7SMWPefmty/eSvT5v7xA3PjOru+r8nZ2xJ/bGu5oUrru+tf/a6ovxfO3D+D2dO/gcAAOA/If/HxxnYYPn/jqVTt7z+i2Grft3a8MTB+h1/bv3OMzsXneq54Ud9L09N3v7o1UX5f1LBUxbl/zDjkP8roovL/wAAAPBZ9t/O/8micQY2WP5vONM3+wcHX6vr+PucxXt+9dAVi8+e/tv8U7t3DV9zR8v6uoeuLMr/M8vL/8Pypx0e/F2Y8OrRUTSz/JMKAAAAFAj/737+o4WQ1zOfHMTz+rX/vKp5380ffPMbD97zpzff/s2xA7MnrdteN/PgyzfVf1j5ve3dRfk/WV7+r/p0Xi4AAABQhuePrpw773jPucfPvtB18vDu3pMznjyzrqnvdOslLatXbTr2WlH+T5WX/0cMzcsBAAAALuDeO59bsfnVl/oe2H/X2Ck9FVc1XpK4ZduOqU0TPuq8tPfy7VuL8v/y8vL/yOw2u/Ih06kz/BVC6+goqu7fWZspHIparskVAAAAgE9IyOlbP1ixbOzOsb3jj59+rObQG4dn/2Vt55yN13RXdW/uXNZ4WdH9AkJiL3X//3Cng7D+v+D+f0Xr//MKmbv+zXZjAAAAAL6Iitfzh9vjZ765oNT375e7/n9J3cQTiba33lv11XMHzo1ZsP/7129aV9/be8+El37/wz9M/6i6KP83l5f/K/O3n+T3/wEAAMBF+F/7/r+lReMMbLD7/zdV9DWsWrd3+uota7csTCw7UH3qwdV731+w5l9Tb36+qea6A0X5v6W8/B+2o/JfXkc4P5tGR9H4/p3s3QR/Hqa7OlZor8orZE58rMeNoUe20D4ir5C2Ntbja6OjaHL/TnOs8P+h0BIrnK3JFnbFCsdCIXs95Ap7YoWOcKVtq8lON154MRSyCyzawwqKUbklEbEe75Xq0V+4YI+u3JMDAAB8oYTwnM2yVYXNKB5l2xODHTBysAMqBjugcrADhsUOiB9Y6vFoeWEhPH575yMbNjVMSb7y8NzHfvbms40T9j1+WV3v5g9f2XbvxJ3TW6YW5f9d5eX/cCqGZzal1v9HYf1/9nsNc+v/l4dCbazQHgqp+B0DUuE5MmH34fActalsj7PjcwUAAAD4XAufC1QO8TwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/s3evcdJVd0JAj/d9INumqaNE9GMk3TUgGakaWwNw+AoaoxGRZpZddxkNBBoEGmE8FgFURtQZxziZ3ztrJnoCAoiu+qHGFeDwUhcxIw6iWLiA/Cxjq7r+h6VGM2E/XTfOkXVrS67EFDa+X7/6DpVv/O89eg69946FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/xjuPfjlk4YunP0PHzace8nqqqmL/kfH6Mv+cNW3vvjUPy5b9G9h/i9GnLll3kEXHjd/wbR/6Vi++ogzQmjtKleWFC977oqvPtS613HP3jFw48wbb63fUpWpNxMP/Tr/lGfuXBxbfbF/CHeXhVCRDgypSwKVmft1sb5960LYI2wLZEu01SYl0g2HB2pCWBK2BbJVra4JoS4ncMqG+++7vDNxTU0IXwkhVKfbeKY6aaMmHRhUlQRq04HpFUngt1sT2cBPypMA7LD4Zsi+6Fe15mdo6L5ckddf5U7r2KcrPbw+MdFQPN/rR+3iTuWoSj/QukNPW0F17BIFb4+13m294N1WsJ2v8LTlfpHKfEPZui1UHcontk0aP6d9dnykPDQ19SlW0y56np9+e/6E7Un3mtdh7EDDTnkdXvrYiun9lo2+9OrNvxqz4ayaA3a0m0/lbNLc9K5WHTKvuV7zPEajfJ70grdfwbekRl+6Qghbzz17xtfnTDz7iD63PLnu1QcfrNty9pwFvzhz4nmLLj55w7/Pf6lg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MvFmfzM0BAACg1+gNe01Xnv/6X73+/bWtMxed/u23Dj73w71afz3i/gFVB7yxrqn1/I2ff6Vg/t9Y2vH/eMi/Lne0a0MY1ZVYNCCEvbseTwIrY3e+OyCEL3elWvMDR6UCa0PYpytxULaqVIm+sURjKvByfSYwKhVYHwOtqcDyGLgiFbg4BlalAhNiYG0qcHQMhCn54/hqfWYcJQdqYmBcshFXxbMQ3qmPraW21aZsVQAAADtJZnZYmX8351yHHc0Qp5eranrKEM/ALpqhOlVDegabnVYVraGipxrKe6ohO+6Ojx5+Qc1lPdVccBpGWX6GG9f85X2LXjzsC2P3mvj5xUMvmPKz8eGst++uerx5yYtv7XvEzesK5v/NHz3/r+6mI2UFx/9DGNv1N+Yuz0Tas/FxrXkZAAAAgB1w0R//xR61Lw85oGHT+2X3zl/7xKMrfrl5j1NOf3/c8a//8PCaxnsL5v+jSjv/P+4T6ZOTOTwSd0NMHRBCc34gqXZkYSA56t0vEwAAAIDeIHs8PnssfErmNjlFOz2fLszfup3544H/Ud3m//09/7P2jq3/+mLZBd89d0TNgKX/9GrHhBNOPvqW47/1zj4VB/yyvGD+31ra+f+1+bdJJ9bHXlw9IIS+OYEHYy87A10aY+D5I/MDmfGvjxtgcawqc2JCtqrFscS4GGhOBZYUK/FotsTe+YHMk5VtfFF2HFMyJXICAAAA8ImLuwPicfl4/n/LGSNO++vvzfrbha88eN7qCy75q+Ed80eedP/THzbMvXJp2PTmEQXz/3Hbd/5/1zy44PT+9n4hDK0IoU/6hwGP1CYLA8ZAXVkmcW9tUlefdFULa0MY2TmwdFUvZNb/r0ivMfh4TVJVDOy93y1vD+pMLKsJYWhu4IlvLz2sMzEnFcg2flpNCF/qHG268bv6Jo1Xphu/tm8IX8wJZKua0DeEzsaq0lX9r+rMdQzSVa2qDmHPnEC2quHVIcwNAPRW8X/pxNwHZ82dN3V8e3vbzF2YiDvxa8KkKe1tTROmt0+sLtKniak+561jtKBwTKVe+mZTZo2ixSsnV5aSzv5QsDm3rcyO/IIzBzP345ehyq5xHlKZd7clPeQD9y9sIuR8lSo25PJdPOTa3Eq2PYkF9cf8VaFf6DtnVtvMpvPGz549c1jyt9TshyR/43GmZFsNS2+r2u76VsLLo+hyWSkfd1sNyq1k6OxpM4bOmjtvyJRp4ye3TW47p+XQP2sZMXz410YM7RxUc/K3h5EO6q7m1Ei3Li1xWDtxpF+oyKnkk/jQkJCQ6G2J/f7L5odH77n+nOt/9tqPz+/3zdPu3fvImT889KqpD1Xve/ji24ccWDD/n/HR8//4qRM/+DPrMxQ7/t8QD/Mnj287zD8uBpaUevy/odjR/OyJAY2pQEcMdDjMDwAAwGdD3B0Z92bGndKbb1m/buOSlrk/aHin5dY17Utvuum+U39y58ATvjQ47LXhuhM+VzD/7yjt9/87af3/7NL1JxRb5v+gWKK52Pr/6WX+s+v/dxRb/z+9zH92/f8ln8L6/3OygdQmecf6/wAAwGfBJ7f+f4/L+6cvEFCQocfl/dMXCCjI0OMy/qVeIGC71/9f8+Bff6Wq35g7/qTlN/WXvPZ39xzWeuS6zTP/5Etb10+877qxt6wpmP9fUdr838L9AAAAsPv4z5ddU3H02Xff0bJu6sZxbw5+98m3lgzq80HF0Q+3j3xh4Bu3nlcw/19S2vz/k1//LxQ7/7+xWKC12MKA1v8DAACglyq2/t89Q1sa/zCm/x+eHvab5Q/ePPqnj/z898v3+/mJPyvfZ8Gxz8+8bFLB/H9VafP/eNpFeV7u2JsP65M17UJ6Tbs367M/GQAAAIDeoTw0NVWWmDdvYdSjPn6bT2eWAv2odK7vvXLt2ZtfmH7c46ev+7uaEwbvOWHaBasa/2b4gXd+ftQley7ddGrB/H9tafP/vN9lXPrYiun9lo2+9MOrN/9qzIazag7YdvwfAAAA2HVK3S8BAAAAAAAAAAAAAAB8+s7tWHzhI8uOfe+bt//F/kcseXXwbXcd+Lsh/V664qoHJq1648zJXy/4/X8Y21Wu2O//43X/4u8L/igvd2y15/X/MvdPOfH2uV1LFj5SH8L+uYGpC6fuETLX5h+cG7jvjIMGdiYWpkusefbolzoT30kHjh/yuS2dicNTgXFxkcR90oF4VcUt/VOBuLzi4+lA3B6r0oGqTOCy/sk4ytLb6pW6ZFuVpbfVxroQBuQEstvq7rqkjbL0AK9JBbID/F46EAd4ciZQnu7V7f2SXsVAXSx6Q7+kVwAA7Lbit8DKMGlKe1tz/Aofb79QkX8b5S1ZtqCw2rISm9+UWZps8crJlaWk+6S/i2671nhlqO4cwrCCr6u5Wcq6Rrlzaulh0/1RkSH3tNpbeZFyadu76aqKj6gmGVHThOntEyt7HHhLz1kOqegxy7CCyU5ulvKuTVpCLSX0pYQRlbhtSuhyvF8empr6pHL9eQw2hDw9vSJK/b1+7jp/xV4FuXluO/TKt758zE+f++CfP/9E/2+cVnP7rO+/e+KvX7//wEOOuG5C05otBfP/htLm/9W549qSuRhAR7yy3sgBIYwrcUQAAADw2XfbRbfecfr09a9MWlvx5GOPTS0fc3rl1vl3zp93ycZ7Fx9/2cErdjR+2Fm//f5vBu//b89e9dJPR+7zwA03/58nD3v8z3//8I8eeqduZZ+x7xXM/xtLm//HPViZQ8HJ3o618fr/iwaE0HVp/YYksDIO97sDQvhyV6o1lkguqH9CLNGcBFbGHSYHxRLjWvOr6hsDq1KBl+szgbWpwPoYyOyluCVkduVcWR/CYV2psfklZsQSDanAmBhoTAWaYqA5FegfA6NSgdf6ZwKtqcDDMRCm5G+rH/fPbCsAAIDtkZlnVebfDel53qqKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xAyVqZNXynIyVaZrrUnVUpAhXgx/u/tVkCE8mp8zXbCg6Xj+QfZ8g7L8DFf+4NlT1w+e/tDqzcd8beBt/zhkz4Obp9e9t+CGp3475pzrnv/TQQXz/+bS5v+1+bdJ6+vj/H/b9f+SwIOxe1fHU8cbY+D5I/MDmR0D6+Nkd3G2qtZMicykfXEsMSoGGlOBGTEwKhUYNzYTWDIwP5CZaWcbX5RtfEqmRE4AAAAAPnFxB0HcTRPn/zce9YOr3x8wccuyeTPvH9vyxMmjv3H1XT+6d/9ld767YvCAce99p2D+P6q0+X9sr19uYxfH3rzYP4S7y7b1JhsYUpcE4n6Muvjz+H3rQtgjZwdHtkRbbVKiKtVweKAm+YV6Vbqq1TXJGgPx/ikb7r/v8s7ENTUhfCVn70u2jWeqkzZq0oFBVUmgNh2YXpEE4p6fbOAn5UkAdlh2r2B8QWVOdclq6L5ckdffZ+WaoOnhFewD7SZfd7+52lWq0w9k9qlmbd/TVlAdu0TB22Otd1tvfLc1eLflfpHKfEPZui1UHcontk0aP6d9dnwk95esBXbR85z7K9VS0jvhddjx8Xvbs+p0B5pTHx/N3Zfr/nVYFqu79LEV0/stG33p1Zt/NWbDWTUHlNyNIuIPhX+05X9XPpWzeXe16pB5zfW6z5NWnye98d9Ao6cthHDZ9cfsu+TdX+/33A3Pnbqu7Maxr/7lrHs2Lf+bysNHrXv/yaGjLy+Y/7eWNv+vSN12+V3cmLMGhHBgzsZ9JG7+YwYkn4M5geRTcs/CQHLI/V/ri35yAgAAwM6W3d2R3V8wJXObnBCenicX5m/dzvxxf8WobvOX2u9j121cedLQN6474G8vOPGNv7/28Kceuv6ysnXL//vYD1avuXzxe08UzP/HffT8v2+qm47/O/7PLuL4f7d2913RfdMPdOzQruiC6tglHP/v1u7+bnP8v1uO/zv+3x3H/3vg+H+3dvenreBb0gxfujonwdff+fPfTbzpg7mN+x180lPPHDrxun+6quXuu0555b+de9601761uWD+P6O0+b/1/7pftC+7/t+4Yuv/zSi2/l+H9f8AAIBdqshCc+l5XsHqfQUZ0qv3FWTocYHAHpcYtP7fdq//t3Dkv1904Q+fb7n2nTvHXb5m07Fnvvr0utXPzFpx3Lnnv9V6112tBfP/jtLm//Hl0C+39d6y/l/j2CJVXREDMywMCAAAwO6o2A4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPl2HnvbO+5d8/R/aBv1ixc1/f+v/+7/P1q594JvfuGn4L6f86RllazZcM+LMLfMOuvC4+Qum/UvH8tVHnBHClK5yZUnxsueu+OpDrXsd9+wdAzfOvPHW+i3VmXorM7d/nJc7tvphfQhLch6pi4k36zvvbAuccuLtcys6E4/Uh7B/bmDqwql7dCaW14cwODdw3xkHDexMLEyXWPPs0S91Jr6TDhw/5HNbOhOHZwJl6e5e1z/pblm6u5f3D2FATiDb3bP751eVbeO4TKA83caKuqSNGKiLRa+tS9qIgfZYYkrfEIZWhNAnXdU/VydV9UlXdU91UlWfdFUXVYcwMoRQka7quaqkqor0yB+tSqqKgb33u+XtQZ2JpVUhDM0NPPHtpYd1JmamAtnG/1NVCF/qfMmkG/9xZdJ4Zbrx/1oZwhdDCFXpEu9VJCWq0iVeqAhhz5zAto1YEcLcwGdD/PSZmPvgrLnzpo5vb2+buQsTVZm2asKkKe1tTROmt0+sTvWpmLKc9NYFH3/sm96eP6HzdvHKyZWlpCsy5Sq7unxIZd7dlt2997FftbmVbHs+CuqP+atCv9B3zqy2mU3njZ89e+aw5G+p2Q9J/vbJRJNtNay3bKtBuZUMnT1txtBZc+cNmTJt/OS2yW3ntBz6Zy0jhg//2oihnYNqTv7ujJEu/eRH+oWKnEo+ife/hIREb0uU5326Ne/un+MFX/S3dbQyVHd9QBdMK3KzlHWNcmcM+qiPOeKP8zWlxxENK5g4FGQ5pOcsLQWTiW1ZapIsXV/rCiaHuTWVd23SeL88NDX1KbYdGvLv5m7e13dg8z6d2XSlpgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAA//8fSxmR")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20)
fdatasync(r0)

kernel console output (not intermixed with test programs):

devices/platform/dummy_hcd.6/usb7/7-1/input/input18
[  375.788857][ T5314] usb 7-1: USB disconnect, device number 10
[  376.624513][T16440] loop6: detected capacity change from 0 to 256
[  376.628520][T16440] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  376.634325][T16440] exFAT-fs (loop6): Medium has reported failures. Some data may be lost.
[  376.646953][T16440] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe5674ec2, utbl_chksum : 0xe619d30d)
[  377.749208][    T9] usb 7-1: new high-speed USB device number 11 using dummy_hcd
[  377.909425][    T9] usb 7-1: Using ep0 maxpacket: 16
[  378.191521][    T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  378.195718][    T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  378.209588][    T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  378.213743][    T9] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  378.217835][    T9] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  378.228948][    T9] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  378.233232][    T9] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  378.236654][    T9] usb 7-1: Manufacturer: syz
[  378.249856][    T9] usb 7-1: config 0 descriptor??
[  378.323867][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  378.326713][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  378.511112][    T9] rc_core: IR keymap rc-hauppauge not found
[  378.513572][    T9] Registered IR keymap rc-empty
[  378.516431][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.539486][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.644830][    T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0
[  378.651664][    T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input19
[  378.668101][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.690056][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.709659][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.729302][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.759391][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.779906][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.800312][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.819209][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.840304][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.859598][    T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  378.883587][    T9] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  378.887451][    T9] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  378.942545][   T24] usb 7-1: USB disconnect, device number 11
[  379.368988][T16519] openvswitch: netlink: Unknown key attributes 2
[  380.226611][T16552] loop6: detected capacity change from 0 to 1024
[  380.234618][T16552] EXT4-fs warning (device loop6): read_mmp_block:115: Error -117 while reading MMP block 64
[  380.442749][T16563] netlink: 'syz.6.4515': attribute type 29 has an invalid length.
[  380.446078][T16563] netlink: 'syz.6.4515': attribute type 29 has an invalid length.
[  380.452576][T16563] netlink: 500 bytes leftover after parsing attributes in process `syz.6.4515'.
[  380.698450][T16580] tmpfs: Bad value for 'nr_blocks'
[  381.516616][T16595] loop6: detected capacity change from 0 to 32768
[  381.524909][T16595] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.4529 (16595)
[  381.549563][T16595] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  381.557853][T16595] BTRFS info (device loop6): using sha256 (sha256-lib) checksum algorithm
[  381.561644][T16595] BTRFS info (device loop6): using free-space-tree
[  381.914248][T14535] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  382.437225][T16635] loop6: detected capacity change from 0 to 32768
[  382.467596][T16635] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  382.496166][T16635] XFS (loop6): Ending clean mount
[  382.591799][T16635] XFS (loop6): Metadata CRC error detected at xfs_refcountbt_read_verify+0x42/0xe0, xfs_refcountbt block 0x28 
[  382.596006][T16635] XFS (loop6): Unmount and run xfs_repair
[  382.597899][T16635] XFS (loop6): First 128 bytes of corrupted metadata buffer:
[  382.601207][T16635] 00000000: 52 ff ff ff 7f 00 00 00 ff ff ff ff ff ff ff ff  R...............
[  382.604887][T16635] 00000010: 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00  .......(........
[  382.611695][T16635] 00000020: c4 96 e0 5e 54 0d 4c 72 b5 91 04 d7 9d 8b 4e eb  ...^T.Lr......N.
[  382.615475][T16635] 00000030: 00 00 00 00 bd e7 de 5d 00 00 00 00 00 00 00 00  .......]........
[  382.621032][T16635] 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  382.638360][T16635] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  382.642682][T16635] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  382.646448][T16635] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  382.650600][T16635] XFS (loop6): metadata I/O error in "xfs_btree_read_buf_block+0x290/0x470" at daddr 0x28 len 8 error 74
[  382.666822][T16635] XFS (loop6): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x517/0x8e0 (fs/xfs/xfs_trans_buf.c:311).  Shutting down filesystem.
[  382.674129][T16635] XFS (loop6): Please unmount the filesystem and rectify the problem(s)
[  382.724843][T14535] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  383.439309][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  384.153977][T16698] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4565'.
[  384.234722][T16701] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4566'.
[  384.277020][T16703] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4567'.
[  384.306679][T16706] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4569'.
[  384.721100][T16737] loop6: detected capacity change from 0 to 256
[  384.734613][T16737] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  384.738509][T16737] exFAT-fs (loop6): Medium has reported failures. Some data may be lost.
[  384.754732][T16737] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  384.785235][   T33] kauditd_printk_skb: 5 callbacks suppressed
[  384.785250][   T33] audit: type=1800 audit(2000000129.170:252): pid=16737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.4583" name="file1" dev="loop6" ino=1048661 res=0 errno=0
[  385.144910][T16754] loop6: detected capacity change from 0 to 4096
[  385.264841][T16758] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4592'.
[  385.451551][   T33] audit: type=1400 audit(2000000129.840:253): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=":(%#{//(@\)//&@},['%%&\#*" pid=16766 comm="syz.6.4595"
[  387.011057][T16832] loop6: detected capacity change from 0 to 40427
[  387.014040][T16832] F2FS-fs: heap/no_heap options were deprecated
[  387.042020][T16832] F2FS-fs (loop6): invalid crc value
[  387.090901][T16832] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  387.095585][T16832] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  387.794831][T16848] netlink: 277 bytes leftover after parsing attributes in process `syz.6.4631'.
[  387.822798][T16841] overlayfs: failed to clone upperpath
[  388.238671][T16858] loop6: detected capacity change from 0 to 32768
[  388.246347][T16858] bcachefs (/dev/loop6): error validating superblock: Invalid superblock section disk_groups: label 1 empty
[  388.246347][T16858] disk_groups (size 152):
[  388.246347][T16858] [parent 0 name ] [parent 0 name ] [parent 0 name ]
[  388.269306][T16858] bcachefs: bch2_fs_get_tree() error: invalid_sb_disk_groups
[  388.702180][T16894] overlayfs: missing 'lowerdir'
[  389.756509][T16921] loop6: detected capacity change from 0 to 512
[  389.776429][T16921] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended
[  389.789160][T16921] EXT4-fs (loop6): mounting ext2 file system using the ext4 subsystem
[  389.800366][T16921] EXT4-fs (loop6): warning: mounting unchecked fs, running e2fsck is recommended
[  389.804176][T16921] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006]
[  389.807012][T16921] System zones: 0-2, 18-18, 34-35
[  389.816150][T16921] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  389.846220][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  390.442574][T16958] tmpfs: Bad value for 'mpol'
[  390.857880][T16965] loop6: detected capacity change from 0 to 1024
[  391.168763][T16975] loop6: detected capacity change from 0 to 40427
[  391.208600][T16975] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  391.213102][T16975] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  391.468734][T16982] syz.6.4692: attempt to access beyond end of device
[  391.468734][T16982] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  391.904220][T14535] syz-executor: attempt to access beyond end of device
[  391.904220][T14535] loop6: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  391.908920][T14535] CPU: 1 UID: 0 PID: 14535 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  391.908940][T14535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  391.908946][T14535] Call Trace:
[  391.908950][T14535]  <TASK>
[  391.908955][T14535]  dump_stack_lvl+0x189/0x250
[  391.908981][T14535]  ? __pfx_dump_stack_lvl+0x10/0x10
[  391.909000][T14535]  ? __pfx_queue_work_on+0x10/0x10
[  391.909014][T14535]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  391.909031][T14535]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  391.909071][T14535]  f2fs_handle_critical_error+0x37c/0x540
[  391.909097][T14535]  f2fs_write_end_io+0x886/0xb60
[  391.909137][T14535]  __submit_merged_bio+0x27a/0x6a0
[  391.909159][T14535]  __submit_merged_write_cond+0x255/0x530
[  391.909183][T14535]  f2fs_write_data_pages+0x261d/0x3000
[  391.909239][T14535]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  391.909313][T14535]  ? __mod_zone_page_state+0xd7/0x140
[  391.909365][T14535]  ? folios_put_refs+0x560/0x640
[  391.909392][T14535]  ? __pfx_folios_put_refs+0x10/0x10
[  391.909406][T14535]  ? rcu_is_watching+0x15/0xb0
[  391.909429][T14535]  ? __lock_acquire+0xab9/0xd20
[  391.909461][T14535]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  391.909482][T14535]  do_writepages+0x32e/0x550
[  391.909514][T14535]  ? do_raw_spin_unlock+0x4d/0x240
[  391.909535][T14535]  filemap_fdatawrite+0x199/0x240
[  391.909552][T14535]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  391.909620][T14535]  ? do_raw_spin_unlock+0x4d/0x240
[  391.909637][T14535]  f2fs_sync_dirty_inodes+0x31f/0x830
[  391.909658][T14535]  f2fs_write_checkpoint+0x95a/0x1df0
[  391.909684][T14535]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  391.909722][T14535]  ? kill_f2fs_super+0x298/0x6c0
[  391.909737][T14535]  kill_f2fs_super+0x2c3/0x6c0
[  391.909751][T14535]  ? __pfx_kill_f2fs_super+0x10/0x10
[  391.909761][T14535]  ? radix_tree_delete_item+0x2b6/0x400
[  391.909776][T14535]  ? shrinker_free+0x2ce/0x3e0
[  391.909788][T14535]  deactivate_locked_super+0xbc/0x130
[  391.909799][T14535]  cleanup_mnt+0x425/0x4c0
[  391.909810][T14535]  ? lockdep_hardirqs_on+0x9c/0x150
[  391.909821][T14535]  task_work_run+0x1d4/0x260
[  391.909834][T14535]  ? __pfx_task_work_run+0x10/0x10
[  391.909844][T14535]  ? __x64_sys_umount+0x122/0x160
[  391.909858][T14535]  ? exit_to_user_mode_loop+0x40/0x110
[  391.909874][T14535]  exit_to_user_mode_loop+0xec/0x110
[  391.909885][T14535]  do_syscall_64+0x2bd/0x3b0
[  391.909895][T14535]  ? lockdep_hardirqs_on+0x9c/0x150
[  391.909904][T14535]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  391.909912][T14535]  ? exc_page_fault+0x9f/0xf0
[  391.909923][T14535]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  391.909931][T14535] RIP: 0033:0x7fd603d8ff17
[  391.909941][T14535] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  391.909949][T14535] RSP: 002b:00007ffc1482ae38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  391.909960][T14535] RAX: 0000000000000000 RBX: 00007fd603e11c05 RCX: 00007fd603d8ff17
[  391.909965][T14535] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc1482aef0
[  391.909970][T14535] RBP: 00007ffc1482aef0 R08: 0000000000000000 R09: 0000000000000000
[  391.909980][T14535] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc1482bf80
[  391.909986][T14535] R13: 00007fd603e11c05 R14: 000000000005fa4c R15: 00007ffc1482bfc0
[  391.910001][T14535]  </TASK>
[  392.071433][T14535] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  392.925516][T17015] loop6: detected capacity change from 0 to 32768
[  392.976726][T17015] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  393.055207][T17015] XFS (loop6): Ending clean mount
[  393.074345][T17015] XFS (loop6): Quotacheck needed: Please wait.
[  393.166953][T17015] XFS (loop6): Quotacheck: Done.
[  393.217004][T14535] XFS (loop6): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  393.237997][T17043] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4717'.
[  394.037992][T17070] loop6: detected capacity change from 0 to 32768
[  394.059681][T17070] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.4731 (17070)
[  394.084959][T17070] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  394.088372][T17070] BTRFS info (device loop6): using crc32c (crc32c-lib) checksum algorithm
[  394.095327][T17070] BTRFS info (device loop6): using free-space-tree
[  394.201753][   T33] audit: type=1800 audit(2000000138.590:254): pid=17070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.4731" name="file0" dev="loop6" ino=258 res=0 errno=0
[  394.246250][T17070] BTRFS info (device loop6): setting compat-ro feature flag for VERITY (0x4)
[  394.258519][   T33] audit: type=1800 audit(2000000138.640:255): pid=17070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.4731" name="file0" dev="loop6" ino=258 res=0 errno=0
[  394.370424][T14535] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  394.614737][T17109] loop6: detected capacity change from 0 to 128
[  394.618555][T17109] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  394.691101][T17109] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[  394.903958][T17119] loop6: detected capacity change from 0 to 4096
[  394.917355][T17119] ntfs3(loop6): Different NTFS sector size (4096) and media sector size (512).
[  394.985000][T17119] ntfs3(loop6): This driver is compiled without CONFIG_NTFS3_64BIT_CLUSTER (like windows driver).
[  394.985000][T17119] Volume contains 64 bits run: vcn 0, lcn ffffe00000009000, len 13.
[  394.985000][T17119] Activate CONFIG_NTFS3_64BIT_CLUSTER to process this case
[  395.014152][T17119] ntfs3(loop6): Mark volume as dirty due to NTFS errors
[  395.017633][T17119] ntfs3(loop6): Failed to load $Secure (-95).
[  395.021211][T17119] ntfs3(loop6): Failed to initialize $Secure (-95).
[  395.306485][   T33] audit: type=1800 audit(2000000139.690:256): pid=17141 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4757" name="nullb0" dev="tmpfs" ino=8874 res=0 errno=0
[  395.411151][ T5314] usb 7-1: new full-speed USB device number 12 using dummy_hcd
[  395.561208][ T5314] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  395.573449][ T5314] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10
[  395.578359][ T5314] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  395.582786][T17162] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[  395.586771][ T5314] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  395.609334][ T5314] usb 7-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9
[  395.617349][ T5314] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  395.630905][ T5314] usb 7-1: config 0 descriptor??
[  395.637877][ T5314] gspca_main: spca561-2.14.0 probing abcd:cdee
[  396.229753][ T5314] spca561 7-1:0.0: probe with driver spca561 failed with error -22
[  396.235943][ T5314] usb 7-1: Quirk or no altset; falling back to MIDI 1.0
[  396.239560][ T5314] usb 7-1: MIDIStreaming interface descriptor not found
[  396.301302][ T5314] usb 7-1: USB disconnect, device number 12
[  396.822027][T17187] Bluetooth: MGMT ver 1.23
[  397.195752][T17212] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4788'.
[  398.056042][T17252] netlink: 'syz.1.4807': attribute type 2 has an invalid length.
[  398.058696][T17252] netlink: 1192 bytes leftover after parsing attributes in process `syz.1.4807'.
[  398.610824][T17267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4813'.
[  399.039423][T17285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4819'.
[  399.042439][T17285] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4819'.
[  399.416448][T17292] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  399.776874][T17300] No source specified
[  400.264347][T17322] openvswitch: netlink: Duplicate or invalid key (type 0).
[  400.266737][T17322] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  400.344583][T17326] loop6: detected capacity change from 0 to 1024
[  400.774938][T17346] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4848'.
[  401.066043][T17365] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  401.068774][T17365] IPv6: NLM_F_CREATE should be set when creating new route
[  401.071335][T17365] IPv6: NLM_F_CREATE should be set when creating new route
[  401.073895][T17365] IPv6: NLM_F_CREATE should be set when creating new route
[  401.103167][T17365] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  401.212930][T17361] loop6: detected capacity change from 0 to 40427
[  401.216415][T17361] F2FS-fs: heap/no_heap options were deprecated
[  401.222897][T17361] F2FS-fs (loop6): build fault injection rate: 19
[  401.225411][T17361] F2FS-fs (loop6): build fault injection type: 0x3bfe8c
[  401.230098][T17361] F2FS-fs (loop6): invalid crc value
[  401.241536][T17361] F2FS-fs (loop6): inject page alloc in f2fs_grab_cache_folio of f2fs_ra_meta_pages+0x615/0x970
[  401.259968][T17373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4861'.
[  401.262879][T17373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4861'.
[  401.265748][T17373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4861'.
[  401.286614][T17361] F2FS-fs (loop6): inject slab alloc in f2fs_kmem_cache_alloc of read_node_folio+0x20a/0x3f0
[  401.294519][T17361] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  401.299010][T17361] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  401.308231][T17361] F2FS-fs (loop6): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  401.316386][T17361] F2FS-fs (loop6): inject lock_op in f2fs_trylock_op of f2fs_write_single_data_page+0x9f1/0x16a0
[  401.321119][T17361] F2FS-fs (loop6): inject checkpoint error in f2fs_balance_fs of f2fs_write_single_data_page+0xfaf/0x16a0
[  401.325389][T17361] syz.6.4854: attempt to access beyond end of device
[  401.325389][T17361] loop6: rw=2049, sector=45096, nr_sectors = 48 limit=40427
[  401.331519][T17361] CPU: 0 UID: 0 PID: 17361 Comm: syz.6.4854 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  401.331543][T17361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  401.331553][T17361] Call Trace:
[  401.331560][T17361]  <TASK>
[  401.331567][T17361]  dump_stack_lvl+0x189/0x250
[  401.331593][T17361]  ? __pfx_dump_stack_lvl+0x10/0x10
[  401.331614][T17361]  ? __pfx_queue_work_on+0x10/0x10
[  401.331660][T17361]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  401.331680][T17361]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  401.331702][T17361]  ? f2fs_hw_is_readonly+0x39b/0x470
[  401.331727][T17361]  f2fs_handle_critical_error+0x37c/0x540
[  401.331751][T17361]  f2fs_balance_fs+0x32d/0x7f0
[  401.331773][T17361]  ? f2fs_write_single_data_page+0xfaf/0x16a0
[  401.331793][T17361]  ? __pfx_f2fs_balance_fs+0x10/0x10
[  401.331825][T17361]  ? folio_unlock+0x101/0x160
[  401.331849][T17361]  f2fs_write_single_data_page+0xfaf/0x16a0
[  401.331883][T17361]  ? __pfx_f2fs_write_single_data_page+0x10/0x10
[  401.331917][T17361]  ? mlock_drain_local+0x79/0x490
[  401.331932][T17361]  ? mlock_drain_local+0x28e/0x490
[  401.331952][T17361]  f2fs_write_data_pages+0x195b/0x3000
[  401.332003][T17361]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  401.332108][T17361]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  401.332128][T17361]  do_writepages+0x32e/0x550
[  401.332157][T17361]  ? do_raw_spin_unlock+0x4d/0x240
[  401.332180][T17361]  file_write_and_wait_range+0x23e/0x340
[  401.332206][T17361]  ? __pfx_file_write_and_wait_range+0x10/0x10
[  401.332261][T17361]  ? do_raw_spin_lock+0x121/0x290
[  401.332290][T17361]  f2fs_do_sync_file+0x5e0/0x1860
[  401.332322][T17361]  ? __pfx_f2fs_do_sync_file+0x10/0x10
[  401.332381][T17361]  ? f2fs_file_write_iter+0x4ac/0x2410
[  401.332400][T17361]  ? vfs_fsync_range+0x12c/0x1c0
[  401.332413][T17361]  ? f2fs_sync_file+0xe9/0x160
[  401.332437][T17361]  f2fs_file_write_iter+0x753/0x2410
[  401.332473][T17361]  ? __pfx_f2fs_file_write_iter+0x10/0x10
[  401.332487][T17361]  ? rcu_read_lock_any_held+0xb3/0x120
[  401.332523][T17361]  vfs_write+0x54b/0xa90
[  401.332549][T17361]  ? __pfx_f2fs_file_write_iter+0x10/0x10
[  401.332567][T17361]  ? __pfx_vfs_write+0x10/0x10
[  401.332597][T17361]  ? __fget_files+0x2a/0x420
[  401.332628][T17361]  ksys_write+0x145/0x250
[  401.332680][T17361]  ? __pfx_ksys_write+0x10/0x10
[  401.332698][T17361]  ? rcu_is_watching+0x15/0xb0
[  401.332718][T17361]  ? do_syscall_64+0xbe/0x3b0
[  401.332741][T17361]  do_syscall_64+0xfa/0x3b0
[  401.332757][T17361]  ? lockdep_hardirqs_on+0x9c/0x150
[  401.332774][T17361]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  401.332790][T17361]  ? exc_page_fault+0x9f/0xf0
[  401.332809][T17361]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  401.332824][T17361] RIP: 0033:0x7fd603d8ebe9
[  401.332839][T17361] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  401.332852][T17361] RSP: 002b:00007fd604ce2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  401.332868][T17361] RAX: ffffffffffffffda RBX: 00007fd603fb5fa0 RCX: 00007fd603d8ebe9
[  401.332880][T17361] RDX: 0000000000007bc6 RSI: 00002000000001c0 RDI: 0000000000000004
[  401.332891][T17361] RBP: 00007fd603e11e19 R08: 0000000000000000 R09: 0000000000000000
[  401.332900][T17361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  401.332909][T17361] R13: 00007fd603fb6038 R14: 00007fd603fb5fa0 R15: 00007ffc1482bba8
[  401.332935][T17361]  </TASK>
[  401.332942][T17361] F2FS-fs (loop6): Stopped filesystem due to reason: 1
[  402.055962][T17403] loop6: detected capacity change from 0 to 512
[  402.061880][T17403] EXT4-fs (loop6): external journal device major/minor numbers have changed
[  402.069867][T17403] EXT4-fs (loop6): failed to open journal device unknown-block(8,0) -16
[  402.355735][T17411] loop6: detected capacity change from 0 to 8192
[  403.495553][T17442] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4891'.
[  404.584637][T17462] overlayfs: failed to clone upperpath
[  404.965502][T17463] loop6: detected capacity change from 0 to 32768
[  404.998300][T17463] XFS (loop6): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  405.024963][T17463] XFS (loop6): Ending clean mount
[  405.574233][T14535] XFS (loop6): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  405.897659][T17495] netlink: 'syz.0.4910': attribute type 83 has an invalid length.
[  405.987055][T17497] loop6: detected capacity change from 0 to 2048
[  406.002446][T17497] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  406.022588][T17497] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4907'.
[  406.036005][T17497] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4907'.
[  406.532002][T17524] Bluetooth: (null): Invalid header checksum
[  407.208716][T17537] CIFS mount error: No usable UNC path provided in device string!
[  407.208716][T17537] 
[  407.213925][T17537] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string!
[  407.913496][T17590] sp0: Synchronizing with TNC
[  410.843520][T17641] loop6: detected capacity change from 0 to 256
[  410.885265][T17641] FAT-fs (loop6): Directory bread(block 64) failed
[  410.888005][T17641] FAT-fs (loop6): Directory bread(block 65) failed
[  410.907220][T17641] FAT-fs (loop6): Directory bread(block 66) failed
[  410.910591][T17641] FAT-fs (loop6): Directory bread(block 67) failed
[  410.913343][T17641] FAT-fs (loop6): Directory bread(block 68) failed
[  410.915908][T17641] FAT-fs (loop6): Directory bread(block 69) failed
[  410.929405][T17641] FAT-fs (loop6): Directory bread(block 70) failed
[  410.932073][T17641] FAT-fs (loop6): Directory bread(block 71) failed
[  410.935008][T17641] FAT-fs (loop6): Directory bread(block 72) failed
[  410.937852][T17641] FAT-fs (loop6): Directory bread(block 73) failed
[  411.319507][ T5924] usb 7-1: new high-speed USB device number 13 using dummy_hcd
[  411.471222][ T5924] usb 7-1: Using ep0 maxpacket: 8
[  411.478035][ T5924] usb 7-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2
[  411.484782][ T5924] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  411.498363][ T5924] usb 7-1: Product: syz
[  411.500464][ T5924] usb 7-1: Manufacturer: syz
[  411.505069][ T5924] usb 7-1: SerialNumber: syz
[  411.510106][ T5924] usb 7-1: config 0 descriptor??
[  411.730525][ T5924] gspca_main: sunplus-2.14.0 probing 04a5:3003
[  412.537511][ T5924] gspca_sunplus: reg_w_riv err -71
[  412.542940][ T5924] sunplus 7-1:0.0: probe with driver sunplus failed with error -71
[  412.559497][ T5924] usb 7-1: USB disconnect, device number 13
[  412.743892][T17685] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4993'.
[  413.284407][T17705] overlayfs: conflicting options: userxattr,metacopy=on
[  413.420177][ T5924] usb 7-1: new full-speed USB device number 14 using dummy_hcd
[  413.523366][T17716] 9pnet_fd: Insufficient options for proto=fd
[  413.573724][ T5924] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  413.581841][ T5924] usb 7-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=74.72
[  413.585559][ T5924] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  413.592226][ T5924] usb 7-1: Product: syz
[  413.594228][ T5924] usb 7-1: Manufacturer: syz
[  413.599282][ T5924] usb 7-1: SerialNumber: syz
[  413.606454][ T5924] usb 7-1: config 0 descriptor??
[  413.614945][ T5924] dvb-usb: found a 'Hanftek UMT-010 DVB-T USB2.0' in warm state.
[  413.618164][ T5924] dvb-usb: bulk message failed: -22 (3/0)
[  413.643386][ T5924] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter)
[  413.655259][ T5924] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 error while loading driver (-19)
[  413.659561][ T5924] dvb_usb_umt_010 7-1:0.0: probe with driver dvb_usb_umt_010 failed with error -22
[  413.827055][ T5906] usb 7-1: USB disconnect, device number 14
[  415.071579][T17774] loop6: detected capacity change from 0 to 1024
[  415.119424][   T52] hfsplus: b-tree write err: -5, ino 4
[  415.185843][T17780] loop6: detected capacity change from 0 to 8
[  415.199415][T17780] SQUASHFS error: zlib decompression failed, data probably corrupt
[  415.205750][T17780] SQUASHFS error: Failed to read block 0x9b: -5
[  415.207839][T17780] SQUASHFS error: Unable to read metadata cache entry [99]
[  415.217930][T17780] SQUASHFS error: Unable to read inode 0x127
[  416.745141][T17808] 9pnet_fd: Insufficient options for proto=fd
[  416.985511][T17827] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.5060'.
[  417.180915][T17841] loop6: detected capacity change from 0 to 2048
[  417.186578][T17841] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024)
[  417.198781][T17843] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  417.223875][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.228007][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.241800][T17841] Remounting filesystem read-only
[  417.246242][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.250308][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.254041][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.260456][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.267664][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.273951][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.277985][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.282512][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.287596][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.292305][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.300811][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.305145][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.311930][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.316376][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.325802][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.331233][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.339447][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.344069][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.347855][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.359008][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.364119][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.369364][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.375462][T17848] netlink: 'syz.0.5070': attribute type 3 has an invalid length.
[  417.378045][T17848] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5070'.
[  417.387251][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.390642][T17848] netlink: 'syz.0.5070': attribute type 1 has an invalid length.
[  417.393841][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.404277][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.414470][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.422196][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.429394][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.436722][T17841] NILFS (loop6): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157
[  417.442851][T17841] NILFS error (device loop6): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
[  417.454652][   T33] audit: type=1800 audit(2000000161.840:257): pid=17841 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.5067" name="file2" dev="loop6" ino=16 res=0 errno=0
[  417.576286][T17854] hugetlbfs: syz.1.5069 (17854): Using mlock ulimits for SHM_HUGETLB is obsolete
[  417.904185][T17857] netlink: 312 bytes leftover after parsing attributes in process `syz.6.5073'.
[  418.370670][    T9] usb 7-1: new high-speed USB device number 15 using dummy_hcd
[  418.732199][    T9] usb 7-1: config 160 has an invalid interface number: 200 but max is 0
[  418.734883][    T9] usb 7-1: config 160 has no interface number 0
[  418.736900][    T9] usb 7-1: config 160 interface 200 has no altsetting 0
[  418.741837][    T9] usb 7-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b
[  418.744852][    T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  418.747320][    T9] usb 7-1: Product: syz
[  418.748656][    T9] usb 7-1: Manufacturer: syz
[  418.750762][    T9] usb 7-1: SerialNumber: syz
[  418.965738][    T9] usb 7-1: Quirk or no altset; falling back to MIDI 1.0
[  418.968289][    T9] usb 7-1: MIDIStreaming interface descriptor not found
[  418.988779][    T9] usb 7-1: USB disconnect, device number 15
[  419.017881][T12255] udevd[12255]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  419.303775][T17886] sctp: [Deprecated]: syz.1.5086 (pid 17886) Use of int in maxseg socket option.
[  419.303775][T17886] Use struct sctp_assoc_value instead
[  419.739708][ T5314] usb 7-1: new high-speed USB device number 16 using dummy_hcd
[  419.891887][ T5314] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  419.895351][ T5314] usb 7-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00
[  419.898066][ T5314] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  419.918866][ T5314] usb 7-1: config 0 descriptor??
[  420.172600][T17941] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5111'.
[  420.175522][T17941] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  420.340545][ T5314] dragonrise 0003:0079:0006.000D: item fetching failed at offset 5/7
[  420.346248][ T5314] dragonrise 0003:0079:0006.000D: parse failed
[  420.348484][ T5314] dragonrise 0003:0079:0006.000D: probe with driver dragonrise failed with error -22
[  420.546181][ T5314] usb 7-1: USB disconnect, device number 16
[  421.419564][T17979] loop6: detected capacity change from 0 to 32768
[  421.422718][T17979] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.5129 (17979)
[  421.436549][T17979] BTRFS info (device loop6): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  421.446985][T17979] BTRFS info (device loop6): using blake2b (blake2b-256-generic) checksum algorithm
[  421.452580][T17979] BTRFS info (device loop6): using free-space-tree
[  421.501491][   T33] audit: type=1800 audit(2000000165.890:258): pid=17979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.5129" name="file1" dev="loop6" ino=260 res=0 errno=0
[  421.608047][T14535] BTRFS info (device loop6): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  421.958230][T18010] loop6: detected capacity change from 0 to 4096
[  422.188228][T18010] ntfs3(loop6): Mark volume as dirty due to NTFS errors
[  422.198356][T18010] ntfs3(loop6): Failed to load $Extend (-22).
[  422.202681][T18010] ntfs3(loop6): Failed to initialize $Extend.
[  422.351364][T18017] syzkaller1: entered promiscuous mode
[  422.359330][T18017] syzkaller1: entered allmulticast mode
[  423.063705][T18048] loop6: detected capacity change from 0 to 256
[  423.073811][T18048] exfat: Deprecated parameter 'namecase'
[  423.076999][T18048] exfat: Deprecated parameter 'namecase'
[  423.093109][T18048] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d)
[  423.320325][T18050] loop6: detected capacity change from 0 to 32768
[  423.338791][T18050] ocfs2: Slot 0 on device (7,6) was already allocated to this node!
[  423.356164][T18050] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode.
[  423.416192][T14535] ocfs2: Unmounting device (7,6) on (node local)
[  423.842772][T18075] all: renamed from bridge_slave_0 (while UP)
[  424.145428][T18095] geneve2: entered promiscuous mode
[  424.254722][T18103] loop6: detected capacity change from 0 to 512
[  424.272652][T18103] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349)
[  424.283048][T18103] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002]
[  424.285972][T18103] System zones: 1-12
[  424.287537][T18103] EXT4-fs (loop6): orphan cleanup on readonly fs
[  424.295526][T18103] EXT4-fs error (device loop6): ext4_free_branches:1023: inode #11: comm syz.6.5177: invalid indirect mapped block 12 (level 1)
[  424.300836][T18103] EXT4-fs error (device loop6): ext4_free_branches:1023: inode #11: comm syz.6.5177: invalid indirect mapped block 2 (level 2)
[  424.307712][T18103] EXT4-fs (loop6): 1 truncate cleaned up
[  424.312670][T18103] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback.
[  424.331010][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000007.
[  425.306775][ T5924] libceph: connect (1)[c::]:6789 error -101
[  425.311478][ T5924] libceph: mon0 (1)[c::]:6789 connect error
[  425.325894][ T5924] libceph: connect (1)[c::]:6789 error -101
[  425.328657][ T5924] libceph: mon0 (1)[c::]:6789 connect error
[  425.583505][ T5924] libceph: connect (1)[c::]:6789 error -101
[  425.586116][ T5924] libceph: mon0 (1)[c::]:6789 connect error
[  425.599766][ T5924] libceph: connect (1)[c::]:6789 error -101
[  425.602448][ T5924] libceph: mon0 (1)[c::]:6789 connect error
[  425.915948][T18152] netlink: 65051 bytes leftover after parsing attributes in process `syz.1.5196'.
[  426.066094][T18130] ceph: No mds server is up or the cluster is laggy
[  426.069254][T18133] ceph: No mds server is up or the cluster is laggy
[  426.107434][ T5924] libceph: connect (1)[c::]:6789 error -101
[  426.114889][ T5924] libceph: mon0 (1)[c::]:6789 connect error
[  426.273535][T18165] loop6: detected capacity change from 0 to 4096
[  427.285096][T18204] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048)
[  427.944924][T18217] netlink: 212408 bytes leftover after parsing attributes in process `syz.6.5223'.
[  428.712787][T18264] loop6: detected capacity change from 0 to 256
[  429.226599][T18290] 8021q: adding VLAN 0 to HW filter on device bond1
[  429.266600][T18290] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  429.273452][T18290] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[  429.349578][ T5884] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  429.407077][T18296] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  429.467204][T18299] overlayfs: failed to clone upperpath
[  429.485205][   T13] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  429.684967][T18316] netlink: 'syz.1.5271': attribute type 13 has an invalid length.
[  429.701275][ T5314] usb 7-1: new high-speed USB device number 17 using dummy_hcd
[  429.736273][T18316] bridge0: port 3(batadv0) entered blocking state
[  429.738382][T18316] bridge0: port 3(batadv0) entered forwarding state
[  429.743025][T18316] tipc: Resetting bearer <eth:bridge0>
[  429.751853][ T5884] bond0: (slave bond_slave_0): interface is now down
[  429.755375][ T5884] bond0: (slave bond_slave_1): interface is now down
[  429.762292][ T5884] bond0: (slave macvlan2): interface is now down
[  429.765550][T18316] 8021q: adding VLAN 0 to HW filter on device bond0
[  429.789243][ T5884] bond0: (slave bond_slave_0): interface is now down
[  429.791403][ T5884] bond0: (slave bond_slave_1): interface is now down
[  429.793427][ T5884] bond0: (slave macvlan2): interface is now down
[  429.809333][ T5885] bond0: (slave bond_slave_0): interface is now down
[  429.811698][ T5885] bond0: (slave bond_slave_1): interface is now down
[  429.812391][T18316] 8021q: adding VLAN 0 to HW filter on device team0
[  429.813938][ T5885] bond0: (slave macvlan2): interface is now down
[  429.825026][T18316] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  429.829813][ T5885] bond0: (slave bond_slave_0): interface is now down
[  429.833545][ T5885] bond0: (slave bond_slave_1): interface is now down
[  429.836035][ T5885] bond0: (slave macvlan2): interface is now down
[  429.849549][   T13] bond0: (slave bond_slave_0): interface is now down
[  429.854245][   T13] bond0: (slave bond_slave_1): interface is now down
[  429.874087][   T13] bond0: (slave macvlan2): interface is now down
[  429.940938][   T13] bond0: now running without any active interface!
[  430.229337][ T5314] usb 7-1: Using ep0 maxpacket: 8
[  430.234144][ T5314] usb 7-1: config 179 has an invalid interface number: 65 but max is 0
[  430.237445][ T5314] usb 7-1: config 179 has no interface number 0
[  430.240318][ T5314] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7
[  430.245024][ T5314] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024
[  430.250155][ T5314] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  430.254759][ T5314] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024
[  430.259686][ T5314] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  430.265025][ T5314] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb
[  430.268715][ T5314] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  430.278006][T18300] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  430.500958][ T5861] Bluetooth: hci2: connection err: -111
[  430.507749][ T5906] usb 7-1: USB disconnect, device number 17
[  430.507749][    C1] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
[  430.514051][    C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
[  430.777117][T18328] netlink: 'syz.1.5276': attribute type 21 has an invalid length.
[  430.781863][T18328] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5276'.
[  430.786468][T18328] netlink: 'syz.1.5276': attribute type 21 has an invalid length.
[  430.792770][T18328] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5276'.
[  431.279477][ T5861] Bluetooth: hci0: command tx timeout
[  431.283268][T18342] loop6: detected capacity change from 0 to 4096
[  431.286320][T18342] ntfs3(loop6): Different NTFS sector size (4096) and media sector size (512).
[  431.298986][T18342] ntfs3(loop6): ino=1a, mi_enum_attr
[  431.301034][T18342] ntfs3(loop6): Mark volume as dirty due to NTFS errors
[  431.304789][T18342] ntfs3(loop6): ino=1a, mi_enum_attr
[  431.306447][T18342] ntfs3(loop6): Failed to initialize $Extend/$Reparse.
[  431.333316][   T33] audit: type=1800 audit(2000000175.720:259): pid=18342 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.5282" name="file1" dev="loop6" ino=24 res=0 errno=0
[  432.192672][T18380] loop6: detected capacity change from 0 to 32768
[  432.199587][T18380] bcachefs: bch2_fs_parse_param() Error parsing option move_bytes_in_flight: option_value
[  432.377755][T18394] loop6: detected capacity change from 0 to 2048
[  432.450881][T18394] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  433.205412][T18394] EXT4-fs error (device loop6): ext4_validate_block_bitmap:441: comm syz.6.5308: bg 0: block 234: padding at end of block bitmap is not set
[  433.220998][T18394] EXT4-fs (loop6): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 548 with error 28
[  433.225200][T18394] EXT4-fs (loop6): This should not happen!! Data will be lost
[  433.225200][T18394] 
[  433.228508][T18394] EXT4-fs (loop6): Total free blocks count 0
[  433.231818][T18394] EXT4-fs (loop6): Free/Dirty block details
[  433.234239][T18394] EXT4-fs (loop6): free_blocks=0
[  433.236357][T18394] EXT4-fs (loop6): dirty_blocks=560
[  433.238263][T18394] EXT4-fs (loop6): Block reservation details
[  433.242658][T18394] EXT4-fs (loop6): i_reserved_data_blocks=35
[  433.306864][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  434.461862][T18464] loop6: detected capacity change from 0 to 1764
[  435.199513][   T51] usb 7-1: new high-speed USB device number 18 using dummy_hcd
[  435.359643][   T51] usb 7-1: Using ep0 maxpacket: 8
[  435.366300][   T51] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 7
[  435.373092][   T51] usb 7-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b
[  435.376671][   T51] usb 7-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3
[  435.383263][   T51] usb 7-1: Product: syz
[  435.384943][   T51] usb 7-1: Manufacturer: syz
[  435.386786][   T51] usb 7-1: SerialNumber: syz
[  435.597319][   T51] usb 7-1: palm_os_3_probe - error -71 getting connection information
[  435.607889][   T51] visor 7-1:1.0: probe with driver visor failed with error -71
[  435.618196][   T51] usb 7-1: USB disconnect, device number 18
[  436.153219][T18510] tipc: Started in network mode
[  436.155042][T18510] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711
[  436.165375][T18510] tipc: Enabled bearer <udp:syz0>, priority 0
[  436.543253][T18531] binder: 18529:18531 ioctl c0286405 2000000010c0 returned -22
[  436.551527][T18531] binder_alloc: 18529: binder_alloc_buf, no vma
[  437.161976][ T5924] tipc: Node number set to 4269801488
[  437.197332][T18539] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5372'.
[  438.565153][T18588] loop6: detected capacity change from 0 to 128
[  438.575491][T18588] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  438.580162][T18588] ext4 filesystem being mounted at /415/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  438.613879][T14535] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  438.656473][T18592] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5396'.
[  438.687845][T18594] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5397'.
[  438.957724][ T5190] Bluetooth: hci3: Frame reassembly failed (-84)
[  439.624736][T18607] veth1_to_bridge: entered promiscuous mode
[  439.660542][T18607] veth1_to_bridge: left promiscuous mode
[  439.678269][T18609] netlink: 'syz.0.5404': attribute type 15 has an invalid length.
[  439.767933][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  439.775888][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  440.065931][T18618] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5408'.
[  440.430933][T18625] netlink: 'syz.1.5411': attribute type 12 has an invalid length.
[  440.890845][T18639] overlayfs: failed to clone upperpath
[  440.959572][ T5863] Bluetooth: hci3: command 0x1003 tx timeout
[  440.959595][ T5861] Bluetooth: hci3: Opcode 0x1003 failed: -110
[  440.982340][T18643] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5419'.
[  441.079754][T18647] loop6: detected capacity change from 0 to 512
[  441.090037][T18647] EXT4-fs: Ignoring removed oldalloc option
[  441.102116][T18647] EXT4-fs (loop6): 1 truncate cleaned up
[  441.106176][T18647] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  441.128740][T18647] EXT4-fs error (device loop6): ext4_free_branches:1023: inode #13: comm syz.6.5421: invalid indirect mapped block 234881024 (level 0)
[  441.144481][T18647] EXT4-fs (loop6): Remounting filesystem read-only
[  441.184122][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  441.528418][T18657] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  441.646143][T18657] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  441.680478][T18663] netlink: 'syz.6.5428': attribute type 3 has an invalid length.
[  441.693180][T18664] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  441.737535][T18657] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  441.771071][T18667] loop6: detected capacity change from 0 to 512
[  441.776244][T18667] EXT4-fs: Ignoring removed bh option
[  441.803945][T18657] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  441.809847][T18667] EXT4-fs (loop6): mounting ext3 file system using the ext4 subsystem
[  441.827605][T18667] EXT4-fs (loop6): 1 truncate cleaned up
[  441.832386][T18667] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  441.978115][ T5748] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  441.987157][ T5748] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  441.996658][ T5748] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  442.006527][ T5748] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  442.718963][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  442.834105][T18701] virt_wifi0 speed is unknown, defaulting to 1000
[  442.844708][T18701] lo speed is unknown, defaulting to 1000
[  442.853644][T18703] loop6: detected capacity change from 0 to 1024
[  442.972085][   T83] hfsplus: b-tree write err: -5, ino 3
[  442.985834][T14535] hfsplus: node 4:3 still has 3 user(s)!
[  443.811293][T18720] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5452'.
[  444.062768][T18742] tap0: tun_chr_ioctl cmd 2147767506
[  444.065260][T18742] tap0: tun_chr_ioctl cmd 1074025677
[  444.074494][T18742] tap0: linktype set to 6
[  444.233961][T18758] loop6: detected capacity change from 0 to 256
[  445.829719][T18819] loop6: detected capacity change from 0 to 2048
[  445.850363][T18819] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  445.910283][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  446.078085][T18839] netlink: 2036 bytes leftover after parsing attributes in process `syz.6.5504'.
[  446.082101][T18839] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5504'.
[  446.216391][T18847] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  446.492999][T18867] netlink: 'syz.0.5519': attribute type 29 has an invalid length.
[  446.497721][T18867] netlink: 'syz.0.5519': attribute type 29 has an invalid length.
[  446.539503][T18869] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5520'.
[  446.969291][ T5863] Bluetooth: hci2: command 0x0406 tx timeout
[  448.601114][T18938] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5553'.
[  449.010457][    T9] usb 7-1: new high-speed USB device number 19 using dummy_hcd
[  449.408817][    T9] usb 7-1: Using ep0 maxpacket: 16
[  449.428939][    T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  449.432464][    T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  449.435519][    T9] usb 7-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00
[  449.438349][    T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  449.442643][    T9] usb 7-1: config 0 descriptor??
[  450.256901][    T9] letsketch 0003:6161:4D15.000E: Device info: ࠇ
[  450.462936][    T9] letsketch 0003:6161:4D15.000E: Device info: ఁ
[  450.666254][    T9] letsketch 0003:6161:4D15.000E: Device info: 擃
[  450.733563][T19004] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5583'.
[  451.097666][    T9] usb 7-1: Max retries (5) exceeded reading string descriptor 2
[  451.101265][    T9] letsketch 0003:6161:4D15.000E: probe with driver letsketch failed with error -71
[  451.108902][    T9] usb 7-1: USB disconnect, device number 19
[  451.929186][ T5924] usb 7-1: new high-speed USB device number 20 using dummy_hcd
[  452.080901][ T5924] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  452.084015][ T5924] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  452.087573][ T5924] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  452.091184][ T5924] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  452.093626][ T5924] usb 7-1: SerialNumber: syz
[  452.302153][ T5924] usb 7-1: 0:2 : does not exist
[  452.331879][ T5924] usb 7-1: USB disconnect, device number 20
[  452.445954][T17174] udevd[17174]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  453.230684][T19057] netem: unknown loss type 0
[  453.233078][T19057] netem: change failed
[  453.249349][T19060] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge0
[  453.388728][T19074] netlink: 'syz.0.5614': attribute type 1 has an invalid length.
[  453.433353][T19075] trusted_key: encrypted_key: insufficient parameters specified
[  454.493339][T19093] ieee802154 phy0 wpan0: encryption failed: -22
[  454.741256][T19095] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5622'.
[  454.745119][T19095] netlink: 43 bytes leftover after parsing attributes in process `syz.0.5622'.
[  454.748129][T19095] netlink: 'syz.0.5622': attribute type 6 has an invalid length.
[  454.760017][T19095] netlink: 'syz.0.5622': attribute type 5 has an invalid length.
[  454.763061][T19095] netlink: 43 bytes leftover after parsing attributes in process `syz.0.5622'.
[  454.837467][T19100] fuse: Bad value for 'fd'
[  454.917144][T19105] loop6: detected capacity change from 0 to 4096
[  454.933419][T19105] ntfs3(loop6): Different NTFS sector size (2048) and media sector size (512).
[  454.944861][T19105] ntfs3(loop6): ino=5, mi_enum_attr
[  454.946618][T19105] ntfs3(loop6): Mark volume as dirty due to NTFS errors
[  455.177284][T19123] 9pnet: p9_errstr2errno: server reported unknown error 184467440
[  455.215743][T19127] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5638'.
[  455.218920][T19127] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5638'.
[  455.465051][T19132] loop6: detected capacity change from 0 to 32768
[  455.493788][T19132] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode.
[  455.553558][T14535] ocfs2: Unmounting device (7,6) on (node local)
[  455.940181][ T5906] usb 7-1: new high-speed USB device number 21 using dummy_hcd
[  456.099145][ T5906] usb 7-1: Using ep0 maxpacket: 32
[  456.102584][ T5906] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  456.105950][ T5906] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  456.109231][ T5906] usb 7-1: New USB device found, idVendor=258a, idProduct=0033, bcdDevice= 0.00
[  456.112164][ T5906] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  456.116378][ T5906] usb 7-1: config 0 descriptor??
[  456.530236][ T5906] glorious 0003:258A:0033.000F: unknown main item tag 0x2
[  456.540108][ T5906] glorious 0003:258A:0033.000F: hidraw0: USB HID v0.00 Device [Glorious Model D] on usb-dummy_hcd.6-1/input0
[  456.732310][   T51] usb 7-1: USB disconnect, device number 21
[  457.173216][T19210] /dev/nullb0: Can't lookup blockdev
[  458.052844][T19279] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5710'.
[  458.706618][T19306] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5724'.
[  458.729410][T19294] loop6: detected capacity change from 0 to 131072
[  458.746254][T19294] F2FS-fs (loop6): invalid crc value
[  458.782783][T19294] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  458.786686][T19294] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5
[  459.788942][T19362] netlink: 44 bytes leftover after parsing attributes in process `syz.6.5750'.
[  459.797397][T19362] netem: unknown loss type 12
[  459.803506][T19362] netem: change failed
[  460.261538][T19366] overlayfs: failed to resolve './file0': -2
[  460.844449][T19396] overlayfs: failed to clone lowerpath
[  460.893260][T19396] overlayfs: missing 'lowerdir'
[  462.158928][T19419] loop6: detected capacity change from 0 to 512
[  462.166013][T19419] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode
[  462.178605][T19419] EXT4-fs (loop6): 1 truncate cleaned up
[  462.187181][T19419] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  462.230952][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  462.463651][T19439] loop6: detected capacity change from 0 to 8
[  462.486675][T19439] SQUASHFS error: xz decompression failed, data probably corrupt
[  462.491710][T19439] SQUASHFS error: Failed to read block 0x108: -5
[  462.494741][T19439] SQUASHFS error: Unable to read metadata cache entry [106]
[  462.497990][T19439] SQUASHFS error: Unable to read inode 0x11f
[  462.939532][T19461] overlayfs: failed to resolve './file0': -2
[  463.099788][   T51] usb 7-1: new high-speed USB device number 22 using dummy_hcd
[  463.290811][   T51] usb 7-1: Using ep0 maxpacket: 16
[  463.296532][   T51] usb 7-1: config 7 has an invalid interface number: 247 but max is 0
[  463.300136][   T51] usb 7-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  463.304296][   T51] usb 7-1: config 7 has no interface number 0
[  463.309789][   T51] usb 7-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=6c.22
[  463.313492][   T51] usb 7-1: New USB device strings: Mfr=1, Product=74, SerialNumber=147
[  463.316865][   T51] usb 7-1: Product: syz
[  463.318688][   T51] usb 7-1: Manufacturer: syz
[  463.320815][   T51] usb 7-1: SerialNumber: syz
[  463.340302][   T51] comedi comedi5: Wrong number of endpoints
[  463.342831][   T51] ni6501 7-1:7.247: driver 'ni6501' failed to auto-configure device.
[  463.554519][    T9] usb 7-1: USB disconnect, device number 22
[  463.905808][T19488] netlink: 'syz.1.5807': attribute type 2 has an invalid length.
[  464.165443][T19500] loop6: detected capacity change from 0 to 256
[  464.178109][T19500] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d)
[  464.198078][T19500] netlink: 56 bytes leftover after parsing attributes in process `syz.6.5814'.
[  464.663576][T19536] overlay: filesystem on ./bus is read-only
[  466.398506][T19578] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5848'.
[  466.447219][T19572] loop6: detected capacity change from 0 to 40427
[  466.454431][T19572] F2FS-fs (loop6): invalid crc value
[  466.542411][T19572] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  466.550185][T19572] F2FS-fs (loop6): Start checkpoint disabled!
[  466.555899][T19572] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6
[  466.685888][   T33] audit: type=1800 audit(2000000211.060:260): pid=19588 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.5845" name="bus" dev="loop6" ino=10 res=0 errno=0
[  466.737771][T19588] syz.6.5845: attempt to access beyond end of device
[  466.737771][T19588] loop6: rw=10241, sector=45096, nr_sectors = 8 limit=40427
[  466.808496][T19588] syz.6.5845: attempt to access beyond end of device
[  466.808496][T19588] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  466.893065][T19588] syz.6.5845: attempt to access beyond end of device
[  466.893065][T19588] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  466.953752][T19588] syz.6.5845: attempt to access beyond end of device
[  466.953752][T19588] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  467.020064][T19588] syz.6.5845: attempt to access beyond end of device
[  467.020064][T19588] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  467.037528][T19588] syz.6.5845: attempt to access beyond end of device
[  467.037528][T19588] loop6: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  467.056455][T19588] syz.6.5845: attempt to access beyond end of device
[  467.056455][T19588] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  467.091487][T19588] syz.6.5845: attempt to access beyond end of device
[  467.091487][T19588] loop6: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  467.104482][T19588] syz.6.5845: attempt to access beyond end of device
[  467.104482][T19588] loop6: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  467.128510][T19588] syz.6.5845: attempt to access beyond end of device
[  467.128510][T19588] loop6: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  468.735604][   T64] CPU: 1 UID: 0 PID: 64 Comm: kworker/u10:3 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  468.735632][   T64] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  468.735638][   T64] Workqueue: writeback wb_workfn (flush-7:6)
[  468.735659][   T64] Call Trace:
[  468.735664][   T64]  <TASK>
[  468.735668][   T64]  dump_stack_lvl+0x189/0x250
[  468.735684][   T64]  ? __pfx_dump_stack_lvl+0x10/0x10
[  468.735694][   T64]  ? __pfx_queue_work_on+0x10/0x10
[  468.735703][   T64]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  468.735714][   T64]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  468.735729][   T64]  f2fs_handle_critical_error+0x37c/0x540
[  468.735746][   T64]  f2fs_write_end_io+0x886/0xb60
[  468.735768][   T64]  __submit_merged_bio+0x27a/0x6a0
[  468.735781][   T64]  __submit_merged_write_cond+0x255/0x530
[  468.735823][   T64]  f2fs_write_data_pages+0x261d/0x3000
[  468.735854][   T64]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  468.735873][   T64]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  468.735904][   T64]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  468.735921][   T64]  ? trace_f2fs_writepages+0x7f/0x200
[  468.735932][   T64]  ? f2fs_write_node_pages+0x478/0x6e0
[  468.735945][   T64]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  468.735962][   T64]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  468.735973][   T64]  do_writepages+0x32e/0x550
[  468.735992][   T64]  ? reacquire_held_locks+0x127/0x1d0
[  468.736001][   T64]  ? writeback_sb_inodes+0x384/0x1010
[  468.736018][   T64]  __writeback_single_inode+0x145/0xff0
[  468.736030][   T64]  ? do_raw_spin_unlock+0x4d/0x240
[  468.736048][   T64]  writeback_sb_inodes+0x6c7/0x1010
[  468.736069][   T64]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  468.736093][   T64]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  468.736130][   T64]  ? rcu_is_watching+0x15/0xb0
[  468.736155][   T64]  wb_writeback+0x43b/0xaf0
[  468.736174][   T64]  ? queue_io+0x391/0x590
[  468.736186][   T64]  ? __pfx_wb_writeback+0x10/0x10
[  468.736203][   T64]  ? _raw_spin_unlock_irq+0x23/0x50
[  468.736220][   T64]  wb_workfn+0x409/0xef0
[  468.736243][   T64]  ? __pfx_wb_workfn+0x10/0x10
[  468.736263][   T64]  ? __lock_acquire+0xab9/0xd20
[  468.736291][   T64]  ? process_scheduled_works+0x9ef/0x17b0
[  468.736303][   T64]  ? _raw_spin_unlock_irq+0x23/0x50
[  468.736311][   T64]  ? process_scheduled_works+0x9ef/0x17b0
[  468.736318][   T64]  ? process_scheduled_works+0x9ef/0x17b0
[  468.736327][   T64]  process_scheduled_works+0xae1/0x17b0
[  468.736352][   T64]  ? __pfx_process_scheduled_works+0x10/0x10
[  468.736392][   T64]  worker_thread+0x8a0/0xda0
[  468.736405][   T64]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  468.736419][   T64]  ? __kthread_parkme+0x7b/0x200
[  468.736435][   T64]  kthread+0x711/0x8a0
[  468.736446][   T64]  ? __pfx_worker_thread+0x10/0x10
[  468.736454][   T64]  ? __pfx_kthread+0x10/0x10
[  468.736465][   T64]  ? _raw_spin_unlock_irq+0x23/0x50
[  468.736473][   T64]  ? lockdep_hardirqs_on+0x9c/0x150
[  468.736484][   T64]  ? __pfx_kthread+0x10/0x10
[  468.736494][   T64]  ret_from_fork+0x3fc/0x770
[  468.736506][   T64]  ? __pfx_ret_from_fork+0x10/0x10
[  468.736517][   T64]  ? __switch_to_asm+0x39/0x70
[  468.736527][   T64]  ? __switch_to_asm+0x33/0x70
[  468.736536][   T64]  ? __pfx_kthread+0x10/0x10
[  468.736546][   T64]  ret_from_fork_asm+0x1a/0x30
[  468.736570][   T64]  </TASK>
[  468.736837][   T64] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  468.856076][   T64] CPU: 1 UID: 0 PID: 64 Comm: kworker/u10:3 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  468.856101][   T64] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  468.856112][   T64] Workqueue: writeback wb_workfn (flush-7:6)
[  468.856137][   T64] Call Trace:
[  468.856144][   T64]  <TASK>
[  468.856151][   T64]  dump_stack_lvl+0x189/0x250
[  468.856172][   T64]  ? __pfx_dump_stack_lvl+0x10/0x10
[  468.856185][   T64]  ? __pfx_queue_work_on+0x10/0x10
[  468.856200][   T64]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  468.856217][   T64]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  468.856245][   T64]  f2fs_handle_critical_error+0x37c/0x540
[  468.856272][   T64]  f2fs_write_end_io+0x886/0xb60
[  468.856301][   T64]  __submit_merged_bio+0x27a/0x6a0
[  468.856324][   T64]  __submit_merged_write_cond+0x255/0x530
[  468.856349][   T64]  f2fs_write_data_pages+0x261d/0x3000
[  468.856397][   T64]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  468.856425][   T64]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  468.856478][   T64]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  468.856508][   T64]  ? trace_f2fs_writepages+0x7f/0x200
[  468.856520][   T64]  ? f2fs_write_node_pages+0x478/0x6e0
[  468.856540][   T64]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  468.856578][   T64]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  468.856598][   T64]  do_writepages+0x32e/0x550
[  468.856617][   T64]  ? reacquire_held_locks+0x127/0x1d0
[  468.856630][   T64]  ? writeback_sb_inodes+0x384/0x1010
[  468.856658][   T64]  __writeback_single_inode+0x145/0xff0
[  468.856676][   T64]  ? do_raw_spin_unlock+0x4d/0x240
[  468.856698][   T64]  writeback_sb_inodes+0x6c7/0x1010
[  468.856723][   T64]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  468.856747][   T64]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  468.856830][   T64]  ? rcu_is_watching+0x15/0xb0
[  468.856858][   T64]  wb_writeback+0x43b/0xaf0
[  468.856884][   T64]  ? queue_io+0x391/0x590
[  468.856902][   T64]  ? __pfx_wb_writeback+0x10/0x10
[  468.856922][   T64]  ? _raw_spin_unlock_irq+0x23/0x50
[  468.856937][   T64]  wb_workfn+0x409/0xef0
[  468.856965][   T64]  ? __pfx_wb_workfn+0x10/0x10
[  468.856986][   T64]  ? __lock_acquire+0xab9/0xd20
[  468.857018][   T64]  ? process_scheduled_works+0x9ef/0x17b0
[  468.857037][   T64]  ? _raw_spin_unlock_irq+0x23/0x50
[  468.857050][   T64]  ? process_scheduled_works+0x9ef/0x17b0
[  468.857063][   T64]  ? process_scheduled_works+0x9ef/0x17b0
[  468.857079][   T64]  process_scheduled_works+0xae1/0x17b0
[  468.857119][   T64]  ? __pfx_process_scheduled_works+0x10/0x10
[  468.857143][   T64]  worker_thread+0x8a0/0xda0
[  468.857153][   T64]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  468.857167][   T64]  ? __kthread_parkme+0x7b/0x200
[  468.857182][   T64]  kthread+0x711/0x8a0
[  468.857194][   T64]  ? __pfx_worker_thread+0x10/0x10
[  468.857201][   T64]  ? __pfx_kthread+0x10/0x10
[  468.857212][   T64]  ? _raw_spin_unlock_irq+0x23/0x50
[  468.857220][   T64]  ? lockdep_hardirqs_on+0x9c/0x150
[  468.857230][   T64]  ? __pfx_kthread+0x10/0x10
[  468.857240][   T64]  ret_from_fork+0x3fc/0x770
[  468.857251][   T64]  ? __pfx_ret_from_fork+0x10/0x10
[  468.857263][   T64]  ? __switch_to_asm+0x39/0x70
[  468.857273][   T64]  ? __switch_to_asm+0x33/0x70
[  468.857282][   T64]  ? __pfx_kthread+0x10/0x10
[  468.857292][   T64]  ret_from_fork_asm+0x1a/0x30
[  468.857312][   T64]  </TASK>
[  468.857316][   T64] F2FS-fs (loop6): Stopped filesystem due to reason: 3
[  468.868016][T19626] trusted_key: encrypted_key: master key parameter 'trusted:' is invalid
[  469.991513][ T5982] usb 7-1: new full-speed USB device number 23 using dummy_hcd
[  470.024104][T19648] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[  470.150921][ T5982] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  470.160336][ T5982] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64
[  470.163743][ T5982] usb 7-1: New USB device found, idVendor=0461, idProduct=4e72, bcdDevice= 0.00
[  470.166559][ T5982] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  470.185083][ T5982] usb 7-1: config 0 descriptor??
[  470.187641][T19646] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  471.509784][ T5982] hid-rmi 0003:0461:4E72.0010: item fetching failed at offset 2/5
[  471.512877][ T5982] hid-rmi 0003:0461:4E72.0010: parse failed
[  471.514839][ T5982] hid-rmi 0003:0461:4E72.0010: probe with driver hid-rmi failed with error -22
[  471.716082][ T5982] usb 7-1: USB disconnect, device number 23
[  471.720070][    C0] vxcan1: j1939_tp_rxtimer: 0xffff88810a473800: rx timeout, send abort
[  472.220093][    C0] vxcan1: j1939_tp_rxtimer: 0xffff88810a473c00: rx timeout, send abort
[  472.225621][    C0] vxcan1: j1939_tp_rxtimer: 0xffff88810a473800: abort rx timeout. Force session deactivation
[  472.619241][    T9] usb 7-1: new high-speed USB device number 24 using dummy_hcd
[  472.723533][    C0] vxcan1: j1939_tp_rxtimer: 0xffff88810a473c00: abort rx timeout. Force session deactivation
[  472.772325][    T9] usb 7-1: Using ep0 maxpacket: 16
[  472.777426][    T9] usb 7-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[  472.781363][    T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  472.785299][    T9] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  472.795538][    T9] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  472.800189][    T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  472.803270][    T9] usb 7-1: Product: syz
[  472.804933][    T9] usb 7-1: Manufacturer: syz
[  472.806793][    T9] usb 7-1: SerialNumber: syz
[  473.231733][    T9] usb 7-1: 0:2 : does not exist
[  474.622813][    T9] usb 7-1: 1:0: failed to get current value for ch 0 (-22)
[  474.625874][T19762] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5930'.
[  474.640632][    T9] usb 7-1: USB disconnect, device number 24
[  474.668105][T17174] udevd[17174]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  475.186812][T19772] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode balance-tlb(5)
[  475.556619][T19777] netlink: 88 bytes leftover after parsing attributes in process `syz.1.5936'.
[  475.561538][T19777] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5936'.
[  476.693643][T19822] Non-string source
[  477.179594][ T5314] usb 7-1: new high-speed USB device number 25 using dummy_hcd
[  477.353561][ T5314] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  477.358229][ T5314] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  477.364358][ T5314] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  477.367142][ T5314] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  477.369667][ T5314] usb 7-1: SerialNumber: syz
[  477.580751][ T5314] usb 7-1: 0:2 : does not exist
[  477.582407][ T5314] usb 7-1: unit 9 not found!
[  477.590581][ T5314] usb 7-1: USB disconnect, device number 25
[  477.614367][T17174] udevd[17174]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  478.038895][T19884] netlink: 'syz.1.5988': attribute type 1 has an invalid length.
[  478.539291][ T5982] usb 7-1: new high-speed USB device number 26 using dummy_hcd
[  478.790563][T19924] overlayfs: failed to clone upperpath
[  478.932971][ T5982] usb 7-1: unable to get BOS descriptor or descriptor too short
[  478.937794][ T5982] usb 7-1: config 1 contains an unexpected descriptor of type 0x1, skipping
[  478.942110][ T5982] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  478.946010][ T5982] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  478.951087][ T5982] usb 7-1: language id specifier not provided by device, defaulting to English
[  478.956878][ T5982] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  478.967013][ T5982] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  478.971893][ T5982] usb 7-1: Product: syz
[  478.974245][ T5982] usb 7-1: Manufacturer: ᨕ昉ﺴꖂ쯍넊꿊퐃ﯻ뵫ਖ਼汢鏎餗␫芯ﰤ齐ജၥ仵챹苵弨鞆찠꛷异ⵡ✩빏󔏪
[  478.982585][ T5982] usb 7-1: SerialNumber: syz
[  479.213477][ T5982] usb 7-1: 0:2 : does not exist
[  479.236967][ T5982] usb 7-1: USB disconnect, device number 26
[  479.297204][T17174] udevd[17174]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  479.352618][T19942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6016'.
[  479.528932][T19952] netlink: 'syz.1.6021': attribute type 17 has an invalid length.
[  479.545811][T19952] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6021'.
[  479.593918][T19954] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6022'.
[  479.607636][T19954] tipc: Enabled bearer <udp:syz0>, priority 0
[  479.848249][T19972] loop6: detected capacity change from 0 to 8
[  480.002692][T19982] loop6: detected capacity change from 0 to 256
[  480.018758][T19982] exFAT-fs (loop6): failed to load upcase table (idx : 0x000106cd, chksum : 0x3aeaf2c0, utbl_chksum : 0xe619d30d)
[  480.046870][T19982] exFAT-fs (loop6): error, in sector 160, dentry 11 should be unused, but 0xc1
[  480.051665][T19982] exFAT-fs (loop6): Filesystem has been set read-only
[  480.139514][T19986] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  480.388889][T19990] netlink: 104 bytes leftover after parsing attributes in process `syz.6.6038'.
[  480.520938][T19996] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6042'.
[  480.524419][T19996] netlink: 660 bytes leftover after parsing attributes in process `syz.6.6042'.
[  480.574472][T20000] loop6: detected capacity change from 0 to 512
[  480.587566][T20000] EXT4-fs error (device loop6): ext4_orphan_get:1392: inode #15: comm syz.6.6047: casefold flag without casefold feature
[  480.598142][T20000] EXT4-fs error (device loop6): ext4_orphan_get:1397: comm syz.6.6047: couldn't read orphan inode 15 (err -117)
[  480.603229][T20000] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  480.662194][T20000] loop6: detected capacity change from 512 to 0
[  480.676892][T20000] bio_check_eod: 182 callbacks suppressed
[  480.676905][T20000] syz.6.6047: attempt to access beyond end of device
[  480.676905][T20000] loop6: rw=14337, sector=2, nr_sectors = 2 limit=0
[  480.683556][T20000] Buffer I/O error on dev loop6, logical block 1, lost sync page write
[  480.686049][T20000] EXT4-fs (loop6): I/O error while writing superblock
[  480.717794][T14535] syz-executor: attempt to access beyond end of device
[  480.717794][T14535] loop6: rw=12288, sector=72, nr_sectors = 2 limit=0
[  480.723437][T14535] EXT4-fs warning (device loop6): htree_dirblock_to_tree:1051: inode #2: lblock 0: comm syz-executor: error -5 reading directory block
[  480.737922][T14535] syz-executor: attempt to access beyond end of device
[  480.737922][T14535] loop6: rw=524288, sector=12, nr_sectors = 2 limit=0
[  480.742651][T14535] syz-executor: attempt to access beyond end of device
[  480.742651][T14535] loop6: rw=524288, sector=14, nr_sectors = 2 limit=0
[  480.746656][T14535] syz-executor: attempt to access beyond end of device
[  480.746656][T14535] loop6: rw=524288, sector=16, nr_sectors = 2 limit=0
[  480.753893][T14535] syz-executor: attempt to access beyond end of device
[  480.753893][T14535] loop6: rw=524288, sector=18, nr_sectors = 2 limit=0
[  480.758075][T14535] syz-executor: attempt to access beyond end of device
[  480.758075][T14535] loop6: rw=524288, sector=20, nr_sectors = 2 limit=0
[  480.762809][T14535] syz-executor: attempt to access beyond end of device
[  480.762809][T14535] loop6: rw=524288, sector=22, nr_sectors = 2 limit=0
[  480.766955][T14535] syz-executor: attempt to access beyond end of device
[  480.766955][T14535] loop6: rw=524288, sector=24, nr_sectors = 2 limit=0
[  480.771384][T14535] syz-executor: attempt to access beyond end of device
[  480.771384][T14535] loop6: rw=524288, sector=26, nr_sectors = 2 limit=0
[  480.778329][T14535] EXT4-fs error (device loop6): ext4_get_inode_loc:4999: inode #2: block 5: comm syz-executor: unable to read itable block
[  480.782812][T14535] Buffer I/O error on dev loop6, logical block 1, lost sync page write
[  480.785315][T14535] EXT4-fs (loop6): I/O error while writing superblock
[  480.787360][T14535] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6334: IO failure
[  480.792235][T14535] Buffer I/O error on dev loop6, logical block 1, lost sync page write
[  480.794921][T14535] EXT4-fs (loop6): I/O error while writing superblock
[  480.797032][T14535] EXT4-fs error (device loop6): ext4_dirty_inode:6538: inode #2: comm syz-executor: mark_inode_dirty error
[  480.801908][T14535] Buffer I/O error on dev loop6, logical block 1, lost sync page write
[  480.804658][T14535] EXT4-fs (loop6): I/O error while writing superblock
[  480.832106][   T83] EXT4-fs error (device loop6): __ext4_get_inode_loc_noinmem:4984: inode #2: block 5: comm kworker/u9:2: unable to read itable block
[  480.837496][   T83] Buffer I/O error on dev loop6, logical block 1, lost sync page write
[  480.841716][   T83] EXT4-fs (loop6): I/O error while writing superblock
[  480.845968][T14535] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  480.853679][T14535] Buffer I/O error on dev loop6, logical block 1, lost sync page write
[  480.856290][T14535] EXT4-fs (loop6): I/O error while writing superblock
[  481.231341][ T3914] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  481.233717][ T3914] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  481.254610][T20015] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  481.370506][ T5863] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  481.376948][ T5863] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  481.383317][ T5863] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  481.387108][ T5863] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  481.390194][ T5863] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  481.420868][T20016] virt_wifi0 speed is unknown, defaulting to 1000
[  481.423709][T20016] lo speed is unknown, defaulting to 1000
[  481.532049][T20016] chnl_net:caif_netlink_parms(): no params data found
[  481.593184][T20016] bridge0: port 1(bridge_slave_0) entered blocking state
[  481.596189][T20016] bridge0: port 1(bridge_slave_0) entered disabled state
[  481.606003][T20016] bridge_slave_0: entered allmulticast mode
[  481.611337][T20016] bridge_slave_0: entered promiscuous mode
[  481.616286][T20016] bridge0: port 2(bridge_slave_1) entered blocking state
[  481.619843][T20016] bridge0: port 2(bridge_slave_1) entered disabled state
[  481.623059][T20016] bridge_slave_1: entered allmulticast mode
[  481.626999][T20016] bridge_slave_1: entered promiscuous mode
[  481.650273][T20016] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  481.655598][T20016] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  481.679631][T20016] team0: Port device team_slave_0 added
[  481.683063][T20016] team0: Port device team_slave_1 added
[  481.705599][T20016] batman_adv: batadv0: Adding interface: batadv_slave_0
[  481.707811][T20016] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  481.716413][T20016] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  481.724388][T20016] batman_adv: batadv0: Adding interface: batadv_slave_1
[  481.726445][T20016] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  481.734567][T20016] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  481.770102][T20016] hsr_slave_0: entered promiscuous mode
[  481.773123][T20016] hsr_slave_1: entered promiscuous mode
[  481.775825][T20016] debugfs: 'hsr0' already exists in 'hsr'
[  481.777987][T20016] Cannot create hsr debugfs directory
[  481.989221][T20016] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  481.994062][T20016] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  481.998438][T20016] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  482.004704][T20016] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  482.134764][T20016] 8021q: adding VLAN 0 to HW filter on device bond0
[  482.170265][T20016] 8021q: adding VLAN 0 to HW filter on device team0
[  482.176394][   T64] bridge0: port 1(bridge_slave_0) entered blocking state
[  482.178609][   T64] bridge0: port 1(bridge_slave_0) entered forwarding state
[  482.188053][   T64] bridge0: port 2(bridge_slave_1) entered blocking state
[  482.190347][   T64] bridge0: port 2(bridge_slave_1) entered forwarding state
[  482.266805][T20058] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6065'.
[  482.384301][T20016] 8021q: adding VLAN 0 to HW filter on device batadv0
[  482.582330][T20093] netlink: 27 bytes leftover after parsing attributes in process `syz.1.6078'.
[  482.600153][T20016] veth0_vlan: entered promiscuous mode
[  482.615135][T20016] veth1_vlan: entered promiscuous mode
[  482.645937][T20016] veth0_macvtap: entered promiscuous mode
[  482.650621][T20099] netlink: 'syz.0.6080': attribute type 8 has an invalid length.
[  482.654612][T20016] veth1_macvtap: entered promiscuous mode
[  482.672482][T20016] batman_adv: batadv0: Interface activated: batadv_slave_0
[  482.681431][T20016] batman_adv: batadv0: Interface activated: batadv_slave_1
[  482.690856][ T5884] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  482.694392][ T5884] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  482.701811][ T5884] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  482.704940][ T5884] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  482.788061][ T3914] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  482.794022][ T3914] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  482.815116][ T3914] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  482.818100][ T3914] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  483.035502][T20121] netlink: 'syz.7.6091': attribute type 1 has an invalid length.
[  483.450391][ T5863] Bluetooth: hci2: command tx timeout
[  483.624372][T20147] loop7: detected capacity change from 0 to 40427
[  483.643283][T20147] F2FS-fs (loop7): build fault injection rate: 771
[  483.654663][T20147] F2FS-fs (loop7): invalid crc value
[  483.729329][T20147] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  483.734965][T20147] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5
[  483.760253][   T33] audit: type=1800 audit(2000000228.150:261): pid=20147 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.6104" name="file1" dev="loop7" ino=10 res=0 errno=0
[  483.795700][T20016] CPU: 0 UID: 0 PID: 20016 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  483.795748][T20016] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  483.795756][T20016] Call Trace:
[  483.795762][T20016]  <TASK>
[  483.795767][T20016]  dump_stack_lvl+0x189/0x250
[  483.795787][T20016]  ? __pfx_dump_stack_lvl+0x10/0x10
[  483.795796][T20016]  ? __pfx_queue_work_on+0x10/0x10
[  483.795806][T20016]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  483.795817][T20016]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  483.795830][T20016]  f2fs_handle_critical_error+0x37c/0x540
[  483.795846][T20016]  f2fs_write_end_io+0x886/0xb60
[  483.795867][T20016]  __submit_merged_bio+0x27a/0x6a0
[  483.795879][T20016]  __submit_merged_write_cond+0x255/0x530
[  483.795892][T20016]  f2fs_write_data_pages+0x261d/0x3000
[  483.795919][T20016]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  483.795955][T20016]  ? folios_put_refs+0x559/0x640
[  483.795972][T20016]  ? __lock_acquire+0xab9/0xd20
[  483.795988][T20016]  ? do_raw_spin_lock+0x121/0x290
[  483.796003][T20016]  ? do_raw_spin_unlock+0x4d/0x240
[  483.796013][T20016]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  483.796023][T20016]  do_writepages+0x32e/0x550
[  483.796040][T20016]  ? do_raw_spin_unlock+0x4d/0x240
[  483.796052][T20016]  filemap_fdatawrite+0x199/0x240
[  483.796064][T20016]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  483.796096][T20016]  ? do_raw_spin_unlock+0x4d/0x240
[  483.796107][T20016]  f2fs_sync_dirty_inodes+0x31f/0x830
[  483.796127][T20016]  f2fs_write_checkpoint+0x95a/0x1df0
[  483.796149][T20016]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  483.796178][T20016]  ? f2fs_stop_gc_thread+0x7f/0xb0
[  483.796189][T20016]  ? kfree+0x18e/0x440
[  483.796200][T20016]  ? kill_f2fs_super+0x298/0x6c0
[  483.796213][T20016]  kill_f2fs_super+0x2c3/0x6c0
[  483.796226][T20016]  ? __pfx_kill_f2fs_super+0x10/0x10
[  483.796236][T20016]  ? radix_tree_delete_item+0x2b6/0x400
[  483.796249][T20016]  ? shrinker_free+0x2ce/0x3e0
[  483.796259][T20016]  deactivate_locked_super+0xbc/0x130
[  483.796271][T20016]  cleanup_mnt+0x425/0x4c0
[  483.796281][T20016]  ? lockdep_hardirqs_on+0x9c/0x150
[  483.796292][T20016]  task_work_run+0x1d4/0x260
[  483.796305][T20016]  ? __pfx_task_work_run+0x10/0x10
[  483.796314][T20016]  ? __x64_sys_umount+0x122/0x160
[  483.796327][T20016]  ? exit_to_user_mode_loop+0x40/0x110
[  483.796341][T20016]  exit_to_user_mode_loop+0xec/0x110
[  483.796352][T20016]  do_syscall_64+0x2bd/0x3b0
[  483.796362][T20016]  ? lockdep_hardirqs_on+0x9c/0x150
[  483.796370][T20016]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  483.796379][T20016]  ? exc_page_fault+0x9f/0xf0
[  483.796390][T20016]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  483.796397][T20016] RIP: 0033:0x7fd514f8ff17
[  483.796407][T20016] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  483.796415][T20016] RSP: 002b:00007ffce4daec78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  483.796425][T20016] RAX: 0000000000000000 RBX: 00007fd515011c05 RCX: 00007fd514f8ff17
[  483.796431][T20016] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffce4daed30
[  483.796436][T20016] RBP: 00007ffce4daed30 R08: 0000000000000000 R09: 0000000000000000
[  483.796441][T20016] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffce4dafdc0
[  483.796446][T20016] R13: 00007fd515011c05 R14: 0000000000076161 R15: 00007ffce4dafe00
[  483.796460][T20016]  </TASK>
[  483.796464][T20016] F2FS-fs (loop7): Stopped filesystem due to reason: 3
[  483.996674][T20197] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6122'.
[  484.214443][T20205] netlink: 'syz.1.6125': attribute type 1 has an invalid length.
[  484.217304][T20205] netlink: 'syz.1.6125': attribute type 1 has an invalid length.
[  484.218048][T20207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6127'.
[  484.254119][T20207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6127'.
[  484.297393][T20211] fanotify: failed to encode fid (type=0, len=0, err=-2)
[  484.362116][T20217] netlink: 'syz.7.6131': attribute type 64 has an invalid length.
[  484.365232][T20217] netlink: 9 bytes leftover after parsing attributes in process `syz.7.6131'.
[  484.547195][   T33] audit: type=1326 audit(2000000228.930:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20234 comm="syz.7.6140" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd514f8ebe9 code=0x7ffc0000
[  484.576227][   T33] audit: type=1326 audit(2000000228.930:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20234 comm="syz.7.6140" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd514f8ebe9 code=0x7ffc0000
[  484.598819][   T33] audit: type=1326 audit(2000000228.940:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20234 comm="syz.7.6140" exe="/syz-executor" sig=0 arch=c000003e syscall=12 compat=0 ip=0x7fd514f8ebe9 code=0x7ffc0000
[  484.620974][   T33] audit: type=1326 audit(2000000228.940:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20234 comm="syz.7.6140" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd514f8ebe9 code=0x7ffc0000
[  484.638345][   T33] audit: type=1326 audit(2000000228.940:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20234 comm="syz.7.6140" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd514f8ebe9 code=0x7ffc0000
[  485.227676][T20240] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  485.519355][ T5863] Bluetooth: hci2: command tx timeout
[  486.154304][T20262] netlink: 'syz.1.6150': attribute type 2 has an invalid length.
[  486.158932][T20262] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6150'.
[  487.346499][T20308] loop7: detected capacity change from 0 to 1024
[  487.364522][T20308] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  487.404024][T20016] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  487.460430][ T5314] IPVS: starting estimator thread 0...
[  487.561317][T20314] IPVS: using max 61 ests per chain, 146400 per kthread
[  487.599795][ T5863] Bluetooth: hci2: command tx timeout
[  487.952935][T20322] syz.0.6174 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
[  488.338280][T20350] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6188'.
[  488.342342][T20350] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6188'.
[  488.346007][T20350] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6188'.
[  488.473203][T20358] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[  489.679600][ T5863] Bluetooth: hci2: command tx timeout
[  491.921922][T20446] loop7: detected capacity change from 0 to 32768
[  491.952833][T20446] XFS (loop7): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  491.992802][T20446] XFS (loop7): Ending clean mount
[  492.112990][T20446] XFS (loop7): Quotacheck needed: Please wait.
[  492.184672][T20446] XFS (loop7): Quotacheck: Done.
[  492.207703][T20016] XFS (loop7): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  492.434698][   T33] audit: type=1326 audit(2000000236.820:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20474 comm="syz.7.6239" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd514f8ebe9 code=0x0
[  492.751042][T20477] loop7: detected capacity change from 0 to 32768
[  492.778806][T20477] XFS (loop7): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  492.795936][T20477] XFS (loop7): Ending clean mount
[  492.843419][T20016] XFS (loop7): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  494.005758][T20513] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6256'.
[  494.451542][T20535] MPI: mpi too large (16392 bits)
[  495.445553][T20555] 9pnet_fd: Insufficient options for proto=fd
[  498.171901][T20622] loop7: detected capacity change from 0 to 32768
[  498.174555][T20622] XFS: ikeep mount option is deprecated.
[  498.188533][T20622] XFS (loop7): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  498.240298][T20622] XFS (loop7): Ending clean mount
[  498.250750][T20622] XFS (loop7): Quotacheck needed: Please wait.
[  498.303770][T20622] XFS (loop7): Quotacheck: Done.
[  498.375147][T20016] XFS (loop7): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  499.220844][T20657] loop7: detected capacity change from 0 to 8192
[  499.385098][T20659] 9pnet: p9_errstr2errno: server reported unknown error @0xffffffffffffffff
[  499.713207][T20684] loop7: detected capacity change from 0 to 512
[  499.729328][T20684] EXT4-fs error (device loop7): ext4_orphan_get:1392: inode #15: comm syz.7.6331: casefold flag without casefold feature
[  499.745830][T20684] EXT4-fs error (device loop7): ext4_orphan_get:1397: comm syz.7.6331: couldn't read orphan inode 15 (err -117)
[  499.757603][T20684] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  499.800660][T20016] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  501.221825][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  501.224446][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  501.644236][T20743] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6356'.
[  501.821514][T20753] netlink: 140 bytes leftover after parsing attributes in process `syz.1.6361'.
[  502.125262][T20775] sp0: Synchronizing with TNC
[  502.139572][T20774] [U] 
[  502.418504][T20795] trusted_key: encrypted_key: key user:syz not found
[  502.537183][T20805] loop7: detected capacity change from 0 to 1024
[  502.559034][T20805] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  502.566022][T20805] ext4 filesystem being mounted at /77/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  502.670466][T20016] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  502.882257][T20832] loop7: detected capacity change from 0 to 128
[  502.885537][T20832] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=256, location=256
[  502.966704][T20837] loop7: detected capacity change from 0 to 64
[  503.621273][T20843] loop7: detected capacity change from 0 to 40427
[  503.625985][T20843] F2FS-fs (loop7): Invalid log_blocksize (268), supports only 12
[  503.628945][T20843] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock
[  503.648942][T20843] F2FS-fs (loop7): invalid crc value
[  503.706793][T20853] team0: Port device syz_tun removed
[  503.738874][T20843] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  503.746561][T20843] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0
[  503.750024][T20843] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5
[  503.841990][T20860] netlink: 'syz.1.6405': attribute type 22 has an invalid length.
[  503.844429][T20860] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6405'.
[  504.783117][T20886] loop7: detected capacity change from 0 to 32768
[  504.855250][T20886] XFS (loop7): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  504.891325][T20886] XFS (loop7): Ending clean mount
[  504.956055][T20016] XFS (loop7): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  505.140515][T20902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  505.286722][T20906] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6421'.
[  505.295346][T20906] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6421'.
[  505.836886][T20921] loop7: detected capacity change from 0 to 256
[  505.866501][T20921] exFAT-fs (loop7): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x53fda505, utbl_chksum : 0xe619d30d)
[  505.881905][T20921] exFAT-fs (loop7): bogus allocation bitmap size(need : 2, cur : 17179869186)
[  506.118671][T20929] netlink: 'syz.7.6432': attribute type 30 has an invalid length.
[  510.629282][ T5314] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[  510.791389][ T5314] usb 8-1: config 0 has an invalid interface number: 194 but max is 0
[  510.794004][ T5314] usb 8-1: config 0 has no interface number 0
[  510.797796][ T5314] usb 8-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=7d.d2
[  510.802317][ T5314] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  510.804920][ T5314] usb 8-1: Product: syz
[  510.806226][ T5314] usb 8-1: Manufacturer: syz
[  510.807662][ T5314] usb 8-1: SerialNumber: syz
[  510.811817][ T5314] usb 8-1: config 0 descriptor??
[  511.027812][ T5314] f81534a_ctrl 8-1:0.194: failed to set register 0x116: -5
[  511.037317][ T5314] f81534a_ctrl 8-1:0.194: failed to enable ports: -5
[  511.049274][ T5314] f81534a_ctrl 8-1:0.194: probe with driver f81534a_ctrl failed with error -5
[  511.061140][ T5314] usb 8-1: USB disconnect, device number 2
[  511.224893][T21041] wireguard0: entered promiscuous mode
[  511.227334][T21041] wireguard0: entered allmulticast mode
[  511.628677][T21066] tmpfs: Bad value for 'mpol'
[  511.887919][T21083] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6500'.
[  512.674173][T21102] trusted_key: encrypted_key: keyword 'updat`fault' not recognized
[  513.132792][T21101] loop7: detected capacity change from 0 to 32768
[  513.136126][T21101] XFS (loop7): invalid log iosize: 1 [not 12-30]
[  513.648640][T21122] netlink: 36 bytes leftover after parsing attributes in process `syz.7.6515'.
[  513.725785][T21126] loop7: detected capacity change from 0 to 512
[  513.731623][T21126] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  514.068212][T21136] loop7: detected capacity change from 0 to 512
[  514.073880][T21136] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode
[  514.134256][T21136] EXT4-fs (loop7): 1 truncate cleaned up
[  514.143656][T21136] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  514.288322][T20016] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  514.380118][T21152] ipvlan1: entered promiscuous mode
[  514.381898][T21152] ipvlan1: entered allmulticast mode
[  514.383561][T21152] veth0_vlan: entered allmulticast mode
[  514.405756][T21151] loop7: detected capacity change from 0 to 2048
[  514.437488][T21155] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  514.470549][T21155] NILFS (loop7): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3)
[  514.474891][T21155] NILFS error (device loop7): nilfs_bmap_propagate: broken bmap (inode number=4)
[  514.486132][T21155] Remounting filesystem read-only
[  514.511312][T20016] NILFS (loop7): disposed unprocessed dirty file(s) when stopping log writer
[  514.584338][T21161] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6532'.
[  514.587454][T21161] netlink: 16 bytes leftover after parsing attributes in process `syz.7.6532'.
[  514.601797][T21161] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6532'.
[  514.604925][T21161] netlink: 16 bytes leftover after parsing attributes in process `syz.7.6532'.
[  514.607922][T21161] netlink: 5 bytes leftover after parsing attributes in process `syz.7.6532'.
[  515.125629][T21188] loop7: detected capacity change from 0 to 256
[  516.419355][ T5982] usb 8-1: new high-speed USB device number 3 using dummy_hcd
[  516.578651][ T5982] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  516.583200][ T5982] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 3
[  516.586554][ T5982] usb 8-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00
[  516.604462][ T5982] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  516.615733][ T5982] usb 8-1: config 0 descriptor??
[  516.937310][T21231] netlink: 'syz.0.6565': attribute type 2 has an invalid length.
[  516.941928][T21231] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6565'.
[  516.945555][T21231] nbd: must specify a device to reconfigure
[  517.045829][ T5982] Bluetooth: Can't get state to change to load configuration err
[  517.048958][ T5982] Bluetooth: Loading sysconfig file failed
[  517.061659][ T5982] ath3k 8-1:0.0: probe with driver ath3k failed with error -16
[  517.078053][ T5982] usb 8-1: USB disconnect, device number 3
[  517.108735][T21238] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6567'.
[  517.161616][T21238] netlink: 'syz.0.6567': attribute type 2 has an invalid length.
[  517.803454][T21257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6574'.
[  518.210656][T21267] loop7: detected capacity change from 0 to 2048
[  518.235744][T21267] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  518.248738][T21267] EXT4-fs error (device loop7): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters
[  518.257001][T21267] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 10 with max blocks 23 with error 28
[  518.261014][T21267] EXT4-fs (loop7): This should not happen!! Data will be lost
[  518.261014][T21267] 
[  518.266270][T21267] EXT4-fs (loop7): Total free blocks count 0
[  518.268232][T21267] EXT4-fs (loop7): Free/Dirty block details
[  518.271391][T21267] EXT4-fs (loop7): free_blocks=66060288
[  518.273134][T21267] EXT4-fs (loop7): dirty_blocks=48
[  518.274724][T21267] EXT4-fs (loop7): Block reservation details
[  518.276576][T21267] EXT4-fs (loop7): i_reserved_data_blocks=3
[  518.287208][T21267] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 34 with error 28
[  518.709388][ T5886] usb 8-1: new high-speed USB device number 4 using dummy_hcd
[  518.877517][ T5886] usb 8-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33
[  518.881797][ T5886] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  518.889707][ T5886] usb 8-1: config 0 descriptor??
[  518.899966][ T5886] gspca_main: sunplus-2.14.0 probing 055f:c420
[  519.307286][ T5886] gspca_sunplus: reg_w_riv err -71
[  519.315622][ T5886] sunplus 8-1:0.0: probe with driver sunplus failed with error -71
[  519.339622][ T5886] usb 8-1: USB disconnect, device number 4
[  520.118644][T21328] loop7: detected capacity change from 0 to 128
[  520.143423][T21328] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  520.157518][T21328] ext4 filesystem being mounted at /143/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  520.174012][T21328] __find_get_block_slow() failed. block=144115188075855873, b_blocknr=0, b_state=0x00000019, b_size=1024, device loop7 blocksize: 1024
[  520.192758][T21328] grow_buffers: requested out-of-range block 144115188075855873 for device loop7
[  520.196174][T21328] EXT4-fs warning (device loop7): ext4_resize_fs:2019: can't read last block, resize aborted
[  520.230751][T20016] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  520.442154][T21335] loop7: detected capacity change from 0 to 128
[  520.466675][T21335] befs: (loop7): invalid magic header
[  521.541228][T21383] delete_channel: no stack
[  521.544678][T21382] delete_channel: no stack
[  521.853614][ T5885] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  522.156594][ T5885] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  522.677080][ T5885] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  522.765098][ T5885] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  523.023875][T21420] loop7: detected capacity change from 0 to 8
[  523.069868][T21420] SQUASHFS error: lzo decompression failed, data probably corrupt
[  523.079593][T21420] SQUASHFS error: Failed to read block 0x144: -5
[  523.081633][T21420] SQUASHFS error: Unable to read metadata cache entry [142]
[  523.102962][T21420] SQUASHFS error: Unable to read inode 0x11f
[  523.129360][ T5885] bridge_slave_1: left allmulticast mode
[  523.131171][ T5885] bridge_slave_1: left promiscuous mode
[  523.133032][ T5885] bridge0: port 2(bridge_slave_1) entered disabled state
[  523.175491][ T5885] bridge_slave_0: left allmulticast mode
[  523.178869][ T5885] bridge_slave_0: left promiscuous mode
[  523.189257][ T5885] bridge0: port 1(bridge_slave_0) entered disabled state
[  523.332072][T21441] loop7: detected capacity change from 0 to 1024
[  523.480301][ T5885] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator
[  523.485597][ T5885] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface
[  523.896879][ T5885] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  523.901409][ T5885] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  523.905301][ T5885] bond0 (unregistering): Released all slaves
[  524.053222][ T5885] bond1 (unregistering): Released all slaves
[  524.176365][ T5885] tipc: Disabling bearer <udp:syz0>
[  524.180076][ T5885] tipc: Left network mode
[  524.189866][T21453] loop7: detected capacity change from 0 to 4096
[  524.226994][T21453] ntfs3(loop7): Different NTFS sector size (4096) and media sector size (512).
[  524.257958][T21453] ntfs3(loop7): ino=19, mi_enum_attr
[  524.260527][T21453] ntfs3(loop7): Mark volume as dirty due to NTFS errors
[  524.303380][T21453] ntfs3(loop7): failed to convert "c46c" to cp862
[  524.305719][T21453] ntfs3(loop7): ino=20, mi_enum_attr
[  524.385727][T21466] loop7: detected capacity change from 0 to 1024
[  524.537925][ T5885] hsr_slave_0: left promiscuous mode
[  524.553925][ T5885] hsr_slave_1: left promiscuous mode
[  524.556544][ T5885] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  524.562412][ T5885] batman_adv: batadv0: Removing interface: batadv_slave_0
[  524.576582][ T5885] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  524.581575][ T5885] batman_adv: batadv0: Removing interface: batadv_slave_1
[  524.604740][ T5885] veth1_macvtap: left promiscuous mode
[  524.606740][ T5885] veth0_macvtap: left promiscuous mode
[  524.610675][ T5885] veth1_vlan: left promiscuous mode
[  524.616077][ T5885] veth0_vlan: left promiscuous mode
[  525.776140][ T5885] team0 (unregistering): Port device team_slave_1 removed
[  525.828878][ T5885] team0 (unregistering): Port device team_slave_0 removed
[  526.697052][T21540] loop7: detected capacity change from 0 to 4096
[  526.704144][T21540] ntfs3(loop7): Different NTFS sector size (4096) and media sector size (512).
[  526.748188][T21540] ntfs3(loop7): Mark volume as dirty due to NTFS errors
[  526.751039][T21540] ntfs3(loop7): ino=1a, mi_enum_attr
[  526.752896][T21540] ntfs3(loop7): Failed to initialize $Extend/$ObjId.
[  526.764253][T21540] ntfs3(loop7): ino=5, "/" ntfs_readdir
[  528.168895][T21598] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6723'.
[  528.175594][T21598] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6723'.
[  528.311108][T21609] netlink: 'syz.1.6729': attribute type 1 has an invalid length.
[  528.334192][T21609] 8021q: adding VLAN 0 to HW filter on device bond2
[  528.360644][T21609] bond2: (slave ip6erspan0): making interface the new active one
[  528.371398][T21609] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link
[  528.529268][   T51] usb 8-1: new high-speed USB device number 5 using dummy_hcd
[  528.677202][T21637] netlink: 'syz.0.6742': attribute type 2 has an invalid length.
[  528.681566][   T51] usb 8-1: config 0 has an invalid interface number: 1 but max is 0
[  528.684413][   T51] usb 8-1: config 0 has no interface number 0
[  528.688367][   T51] usb 8-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b
[  528.699339][   T51] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  528.701901][   T51] usb 8-1: Product: syz
[  528.703700][   T51] usb 8-1: Manufacturer: syz
[  528.705190][   T51] usb 8-1: SerialNumber: syz
[  528.708712][   T51] usb 8-1: config 0 descriptor??
[  528.768658][T21641] netlink: 'syz.0.6744': attribute type 3 has an invalid length.
[  528.999827][   T51] dvb_usb_ec168 8-1:0.1: probe with driver dvb_usb_ec168 failed with error -71
[  529.006126][   T51] usb 8-1: USB disconnect, device number 5
[  529.575712][T21661] loop7: detected capacity change from 0 to 1024
[  529.581821][T21661] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869)
[  529.585759][T21661] EXT4-fs (loop7): stripe (65535) is not aligned with cluster size (16), stripe is disabled
[  529.592302][T21661] EXT4-fs error (device loop7): ext4_get_journal_inode:5796: inode #32: comm syz.7.6752: iget: special inode unallocated
[  529.597499][T21661] EXT4-fs (loop7): no journal found
[  529.603516][T21661] EXT4-fs (loop7): can't get journal size
[  529.608540][T21661] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none.
[  529.645624][T20016] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  530.229968][    T9] usb 8-1: new high-speed USB device number 6 using dummy_hcd
[  530.320512][T21684] 9pnet: p9_errstr2errno: server reported unknown error 184467440737095
[  530.399846][    T9] usb 8-1: Using ep0 maxpacket: 16
[  530.404427][    T9] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0
[  530.407380][    T9] usb 8-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0
[  530.410488][    T9] usb 8-1: config 0 interface 0 has no altsetting 0
[  530.414708][    T9] usb 8-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb
[  530.417511][    T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  530.420323][    T9] usb 8-1: Product: syz
[  530.421690][    T9] usb 8-1: Manufacturer: syz
[  530.423139][    T9] usb 8-1: SerialNumber: syz
[  530.426953][    T9] usb 8-1: config 0 descriptor??
[  530.835141][    T9] usb 8-1: USB disconnect, device number 6
[  530.934800][T21723] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  531.604017][T21769] 8021q: adding VLAN 0 to HW filter on device bond5
[  531.608099][T21769] bond0: (slave bond5): Enslaving as an active interface with a down link
[  531.699290][   T51] usb 8-1: new full-speed USB device number 7 using dummy_hcd
[  531.851388][   T51] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  531.860446][   T51] usb 8-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11
[  531.865479][   T51] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  531.870803][   T51] usb 8-1: Product: syz
[  531.872513][   T51] usb 8-1: Manufacturer: syz
[  531.874381][   T51] usb 8-1: SerialNumber: syz
[  531.878325][   T51] usb 8-1: config 0 descriptor??
[  532.058769][T21797] netlink: 'syz.1.6814': attribute type 2 has an invalid length.
[  532.113637][   T51] usb 8-1: USB disconnect, device number 7
[  532.136867][T21803] netlink: 'syz.1.6816': attribute type 11 has an invalid length.
[  533.905319][T21879] netlink: 24 bytes leftover after parsing attributes in process `syz.7.6854'.
[  534.286058][T21890] JFS: charset not found
[  534.585093][T21901] netlink: 220 bytes leftover after parsing attributes in process `syz.0.6864'.
[  535.115564][T21931] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6878'.
[  535.118850][T21931] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6878'.
[  535.407520][T21953] loop7: detected capacity change from 0 to 64
[  535.472829][T21953] bio_check_eod: 16 callbacks suppressed
[  535.472853][T21953] syz.7.6889: attempt to access beyond end of device
[  535.472853][T21953] loop7: rw=0, sector=130062, nr_sectors = 2 limit=64
[  535.481246][T21953] Buffer I/O error on dev loop7, logical block 65031, async page read
[  535.485290][T21953] syz.7.6889: attempt to access beyond end of device
[  535.485290][T21953] loop7: rw=0, sector=130062, nr_sectors = 2 limit=64
[  535.495113][T21953] Buffer I/O error on dev loop7, logical block 65031, async page read
[  535.650142][T21971] ieee802154 phy0 wpan0: encryption failed: -22
[  535.739914][T21977] loop7: detected capacity change from 0 to 4096
[  535.750967][T21977] ntfs3(loop7): ino=0, mi_enum_attr
[  535.757720][T21977] ntfs3(loop7): ino=0, mi_enum_attr
[  535.764584][T21977] ntfs3(loop7): Failed to load $MFT (-22).
[  535.820656][T21985] kernel read not supported for file /file1 (pid: 21985 comm: syz.1.6905)
[  535.836476][   T33] audit: type=1800 audit(2000000280.220:268): pid=21985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6905" name="file1" dev="mqueue" ino=54453 res=0 errno=0
[  536.726620][T22013] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6918'.
[  537.459263][ T5314] usb 8-1: new full-speed USB device number 8 using dummy_hcd
[  537.622295][ T5314] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  537.627682][ T5314] usb 8-1: New USB device found, idVendor=056a, idProduct=0059, bcdDevice= 0.00
[  537.637793][ T5314] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  537.642412][ T5314] usb 8-1: config 0 descriptor??
[  538.364078][ T5906] usb 8-1: USB disconnect, device number 8
[  538.984037][   T33] audit: type=1326 audit(2000000283.370:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22087 comm="syz.1.6953" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f89f358ebe9 code=0x0
[  539.045162][T22091] loop7: detected capacity change from 0 to 1024
[  539.059727][T22091] hfsplus: small dir entry
[  540.151097][T22144] loop7: detected capacity change from 0 to 2048
[  540.167174][T22145] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  540.261835][T22144] loop7: detected capacity change from 2048 to 64
[  540.264912][T22146] syz.7.6979: attempt to access beyond end of device
[  540.264912][T22146] loop7: rw=0, sector=136, nr_sectors = 4 limit=64
[  540.276622][T22146] NILFS (loop7): I/O error reading meta-data file (ino=3, block-offset=1)
[  540.375410][T20016] syz-executor: attempt to access beyond end of device
[  540.375410][T20016] loop7: rw=0, sector=148, nr_sectors = 4 limit=64
[  540.385686][T20016] NILFS (loop7): I/O error reading meta-data file (ino=3, block-offset=130)
[  540.389018][T20016] syz-executor: attempt to access beyond end of device
[  540.389018][T20016] loop7: rw=0, sector=148, nr_sectors = 4 limit=64
[  540.394898][T20016] NILFS (loop7): I/O error reading meta-data file (ino=3, block-offset=130)
[  540.398489][T20016] NILFS error (device loop7): nilfs_readdir: bad page in #12
[  540.407844][T20016] syz-executor: attempt to access beyond end of device
[  540.407844][T20016] loop7: rw=395265, sector=2040, nr_sectors = 4 limit=64
[  540.415589][T20016] Buffer I/O error on dev loop7, logical block 510, lost sync page write
[  540.422472][T20016] NILFS (loop7): unable to write superblock: err=-5
[  540.430397][T20016] Remounting filesystem read-only
[  540.437713][T20016] NILFS (loop7): disposed unprocessed dirty file(s) when detaching log writer
[  543.559284][ T5314] usb 8-1: new high-speed USB device number 9 using dummy_hcd
[  543.711304][ T5314] usb 8-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30
[  543.716063][ T5314] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  543.721221][ T5314] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  543.725344][ T5314] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253
[  543.733933][ T5314] usb 8-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40
[  543.737839][ T5314] usb 8-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0
[  543.741982][ T5314] usb 8-1: Manufacturer: syz
[  543.746401][ T5314] usb 8-1: config 0 descriptor??
[  544.166873][ T5314] appleir 0003:05AC:8243.0012: unknown main item tag 0x0
[  544.188066][ T5314] appleir 0003:05AC:8243.0012: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.7-1/input0
[  544.297900][T22269] netlink: 'syz.1.7033': attribute type 3 has an invalid length.
[  544.302116][T22269] netlink: 'syz.1.7033': attribute type 3 has an invalid length.
[  544.442742][ T5314] usb 8-1: USB disconnect, device number 9
[  544.785103][T22277] netlink: 'syz.0.7037': attribute type 83 has an invalid length.
[  545.760114][T22306] /dev/nullb0: Can't lookup blockdev
[  546.035079][T22319] IPv6: addrconf: prefix option has invalid lifetime
[  546.052975][T22319] IPv6: addrconf: prefix option has invalid lifetime
[  546.503557][T22343] loop7: detected capacity change from 0 to 2048
[  546.508345][T22343] NILFS (loop7): broken superblock, retrying with spare superblock (blocksize = 1024)
[  546.518298][T17174] udevd[17174]: incorrect nilfs2 checksum on /dev/loop7
[  546.527743][T17174] udevd[17174]: incorrect nilfs2 checksum on /dev/loop7
[  546.535875][T22346] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  546.674913][T22348] loop7: detected capacity change from 0 to 4096
[  546.693906][T22348] ntfs3(loop7): Different NTFS sector size (2048) and media sector size (512).
[  546.743682][T22348] ntfs3(loop7): Mark volume as dirty due to NTFS errors
[  546.748495][T22348] ntfs3(loop7): ino=3, ntfs_set_state failed, -22.
[  546.751819][T22348] ntfs3(loop7): Failed to load $Bitmap (-22).
[  546.754089][T22348] ntfs3(loop7): ino=3, ntfs3_write_inode failed, -22.
[  547.266459][T22359] loop7: detected capacity change from 0 to 32768
[  547.273217][T22359] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 (7:7) scanned by syz.7.7074 (22359)
[  547.298107][T22359] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  547.305544][T22359] BTRFS info (device loop7): using sha256 (sha256-lib) checksum algorithm
[  547.308464][T22359] BTRFS info (device loop7): using free-space-tree
[  547.418609][T20016] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  548.185313][T22410] netlink: 44 bytes leftover after parsing attributes in process `syz.7.7092'.
[  548.383369][T22421] openvswitch: netlink: IPv4 tun info is not correct
[  548.514773][T22428] input: syz1 as /devices/virtual/input/input20
[  548.849380][ T5924] usb 8-1: new high-speed USB device number 10 using dummy_hcd
[  549.019342][ T5924] usb 8-1: Using ep0 maxpacket: 32
[  549.026569][ T5924] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[  549.041893][ T5924] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[  549.049838][ T5924] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[  549.052881][ T5924] usb 8-1: Product: syz
[  549.056511][ T5924] usb 8-1: Manufacturer: syz
[  549.058317][ T5924] usb 8-1: SerialNumber: syz
[  549.063781][ T5924] usb 8-1: config 0 descriptor??
[  549.070232][T22434] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22
[  549.075141][ T5924] hub 8-1:0.0: bad descriptor, ignoring hub
[  549.077047][ T5924] hub 8-1:0.0: probe with driver hub failed with error -5
[  549.323069][   T33] audit: type=1326 audit(2000000293.710:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22452 comm="syz.1.7112" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f358ebe9 code=0x7ffc0000
[  549.332352][   T33] audit: type=1326 audit(2000000293.710:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22452 comm="syz.1.7112" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f358ebe9 code=0x7ffc0000
[  549.341558][   T33] audit: type=1326 audit(2000000293.710:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22452 comm="syz.1.7112" exe="/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f89f358d69f code=0x7ffc0000
[  549.351699][   T33] audit: type=1326 audit(2000000293.710:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22452 comm="syz.1.7112" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f358ebe9 code=0x7ffc0000
[  549.362161][   T33] audit: type=1326 audit(2000000293.710:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22452 comm="syz.1.7112" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f358ebe9 code=0x7ffc0000
[  550.128977][T22473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7119'.
[  550.256723][T22479] netlink: 536 bytes leftover after parsing attributes in process `syz.0.7122'.
[  550.336563][T22481] tipc: Enabled bearer <eth:xfrm0>, priority 10
[  550.422737][T22487] netlink: 91 bytes leftover after parsing attributes in process `syz.0.7126'.
[  550.427555][T22487] netlink: 91 bytes leftover after parsing attributes in process `syz.0.7126'.
[  551.414599][ T5314] lo speed is unknown, defaulting to 1000
[  552.179387][T22568] netlink: 'syz.1.7165': attribute type 27 has an invalid length.
[  552.854092][ T5924] usb 8-1: USB disconnect, device number 10
[  553.028705][T22598] loop7: detected capacity change from 0 to 2048
[  553.040850][T22598] UDF-fs: error (device loop7): udf_process_sequence: Primary Volume Descriptor not found!
[  553.046287][T22598] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  553.068940][T22598] UDF-fs: error (device loop7): udf_verify_fi: directory (ino 1376) has entry at pos 100 with incorrect tag 0
[  553.073145][T22598] UDF-fs: error (device loop7): udf_verify_fi: directory (ino 1376) has entry at pos 100 with incorrect tag 0
[  553.413668][T22606] netlink: 'syz.0.7182': attribute type 5 has an invalid length.
[  553.421159][T22606] ip6erspan0: entered promiscuous mode
[  553.727515][T22634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7196'.
[  553.732400][T22634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7196'.
[  553.872882][T22644] netlink: 17 bytes leftover after parsing attributes in process `syz.1.7201'.
[  553.878177][T22644] netlink: zone id is out of range
[  553.881285][T22644] netlink: zone id is out of range
[  553.883212][T22644] netlink: zone id is out of range
[  553.885136][T22644] netlink: zone id is out of range
[  553.887161][T22644] netlink: zone id is out of range
[  553.889543][T22644] netlink: zone id is out of range
[  553.891440][T22644] netlink: zone id is out of range
[  553.893286][T22644] netlink: zone id is out of range
[  553.895136][T22644] netlink: zone id is out of range
[  553.897665][T22644] netlink: zone id is out of range
[  554.269391][ T5906] usb 8-1: new high-speed USB device number 11 using dummy_hcd
[  554.422192][ T5906] usb 8-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0
[  554.425166][ T5906] usb 8-1: config 0 interface 0 has no altsetting 0
[  554.427508][ T5906] usb 8-1: New USB device found, idVendor=046d, idProduct=c52f, bcdDevice= 0.00
[  554.431074][ T5906] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  554.438554][ T5906] usb 8-1: config 0 descriptor??
[  554.859593][ T5906] logitech-djreceiver 0003:046D:C52F.0013: hidraw0: USB HID v8.00 Device [HID 046d:c52f] on usb-dummy_hcd.7-1/input0
[  555.052391][ T5906] usb 8-1: USB disconnect, device number 11
[  555.623948][T22733] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7238'.
[  555.628823][T22733] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7238'.
[  555.701081][T22737] loop7: detected capacity change from 0 to 1024
[  555.720412][T22737] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  555.742394][T22737] EXT4-fs error (device loop7): ext4_get_first_dir_block:3556: inode #11: comm syz.7.7240: directory missing '..'
[  555.789306][T20016] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  555.873651][T22745] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-61)
[  555.948277][T22747] loop7: detected capacity change from 0 to 2048
[  555.970024][T22747] UDF-fs: error (device loop7): udf_process_sequence: Primary Volume Descriptor not found!
[  555.977056][T22747] UDF-fs: warning (device loop7): udf_fill_super: No fileset found
[  556.098921][T22751] dvmrp5: entered allmulticast mode
[  556.108044][T22751] pimreg: entered allmulticast mode
[  556.258166][T22763] loop7: detected capacity change from 0 to 8
[  556.260843][T22763] MTD: Attempt to mount non-MTD device "/dev/loop7"
[  556.952891][T22769] loop7: detected capacity change from 0 to 32768
[  556.980709][T22769] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode.
[  557.053208][T22769] 
[  557.054316][T22769] ======================================================
[  557.057182][T22769] WARNING: possible circular locking dependency detected
[  557.060082][T22769] 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 Not tainted
[  557.063851][T22769] ------------------------------------------------------
[  557.067074][T22769] syz.7.7254/22769 is trying to acquire lock:
[  557.069509][T22769] ffff8881125f5df8 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2f9/0x720
[  557.073275][T22769] 
[  557.073275][T22769] but task is already holding lock:
[  557.076237][T22769] ffff8881276f8950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f87/0x21c0
[  557.079941][T22769] 
[  557.079941][T22769] which lock already depends on the new lock.
[  557.079941][T22769] 
[  557.084115][T22769] 
[  557.084115][T22769] the existing dependency chain (in reverse order) is:
[  557.087690][T22769] 
[  557.087690][T22769] -> #4 (jbd2_handle){++++}-{0:0}:
[  557.090662][T22769]        lock_acquire+0x120/0x360
[  557.092756][T22769]        start_this_handle+0x1fa7/0x21c0
[  557.095074][T22769]        jbd2__journal_start+0x2c1/0x5b0
[  557.097386][T22769]        jbd2_journal_start+0x2a/0x40
[  557.099624][T22769]        ocfs2_start_trans+0x376/0x6d0
[  557.101814][T22769]        ocfs2_shutdown_local_alloc+0x200/0xa10
[  557.104405][T22769]        ocfs2_dismount_volume+0x201/0x8d0
[  557.106712][T22769]        generic_shutdown_super+0x135/0x2c0
[  557.109131][T22769]        kill_block_super+0x44/0x90
[  557.111109][T22769]        deactivate_locked_super+0xbc/0x130
[  557.113418][T22769]        cleanup_mnt+0x425/0x4c0
[  557.115377][T22769]        task_work_run+0x1d4/0x260
[  557.117428][T22769]        exit_to_user_mode_loop+0xec/0x110
[  557.119753][T22769]        do_syscall_64+0x2bd/0x3b0
[  557.121784][T22769]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.124420][T22769] 
[  557.124420][T22769] -> #3 (&journal->j_trans_barrier){.+.+}-{4:4}:
[  557.127860][T22769]        lock_acquire+0x120/0x360
[  557.129832][T22769]        down_read+0x46/0x2e0
[  557.131741][T22769]        ocfs2_start_trans+0x36a/0x6d0
[  557.133858][T22769]        ocfs2_shutdown_local_alloc+0x200/0xa10
[  557.136406][T22769]        ocfs2_dismount_volume+0x201/0x8d0
[  557.138836][T22769]        generic_shutdown_super+0x135/0x2c0
[  557.141265][T22769]        kill_block_super+0x44/0x90
[  557.143401][T22769]        deactivate_locked_super+0xbc/0x130
[  557.146100][T22769]        cleanup_mnt+0x425/0x4c0
[  557.148308][T22769]        task_work_run+0x1d4/0x260
[  557.150558][T22769]        exit_to_user_mode_loop+0xec/0x110
[  557.153148][T22769]        do_syscall_64+0x2bd/0x3b0
[  557.155210][T22769]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.157831][T22769] 
[  557.157831][T22769] -> #2 (sb_internal#3){.+.+}-{0:0}:
[  557.160827][T22769]        lock_acquire+0x120/0x360
[  557.162819][T22769]        ocfs2_start_trans+0x26b/0x6d0
[  557.165026][T22769]        ocfs2_xattr_set+0xd69/0x11f0
[  557.167173][T22769]        __vfs_setxattr+0x43c/0x480
[  557.169252][T22769]        __vfs_setxattr_noperm+0x12d/0x660
[  557.171587][T22769]        vfs_setxattr+0x16b/0x2f0
[  557.173561][T22769]        filename_setxattr+0x274/0x600
[  557.175726][T22769]        path_setxattrat+0x364/0x3a0
[  557.177747][T22769]        __x64_sys_setxattr+0xbc/0xe0
[  557.179834][T22769]        do_syscall_64+0xfa/0x3b0
[  557.181772][T22769]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.184322][T22769] 
[  557.184322][T22769] -> #1 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
[  557.188520][T22769]        lock_acquire+0x120/0x360
[  557.190566][T22769]        down_write+0x96/0x1f0
[  557.192525][T22769]        ocfs2_reserve_suballoc_bits+0x15e/0x4640
[  557.195082][T22769]        ocfs2_reserve_new_metadata_blocks+0x403/0x940
[  557.197660][T22769]        ocfs2_init_xattr_set_ctxt+0x307/0x700
[  557.199937][T22769]        ocfs2_xattr_set+0xb70/0x11f0
[  557.202052][T22769]        __vfs_setxattr+0x43c/0x480
[  557.204085][T22769]        __vfs_setxattr_noperm+0x12d/0x660
[  557.206305][T22769]        vfs_setxattr+0x16b/0x2f0
[  557.208200][T22769]        filename_setxattr+0x274/0x600
[  557.210534][T22769]        path_setxattrat+0x364/0x3a0
[  557.212619][T22769]        __x64_sys_setxattr+0xbc/0xe0
[  557.214700][T22769]        do_syscall_64+0xfa/0x3b0
[  557.216710][T22769]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.219225][T22769] 
[  557.219225][T22769] -> #0 (&oi->ip_xattr_sem){++++}-{4:4}:
[  557.222297][T22769]        validate_chain+0xb9b/0x2140
[  557.224364][T22769]        __lock_acquire+0xab9/0xd20
[  557.226423][T22769]        lock_acquire+0x120/0x360
[  557.228406][T22769]        down_read+0x46/0x2e0
[  557.230246][T22769]        ocfs2_init_acl+0x2f9/0x720
[  557.232288][T22769]        ocfs2_mknod+0x1321/0x2050
[  557.234368][T22769]        ocfs2_create+0x1a5/0x440
[  557.236378][T22769]        path_openat+0x14f4/0x3830
[  557.238423][T22769]        do_filp_open+0x1fa/0x410
[  557.240482][T22769]        do_sys_openat2+0x121/0x1c0
[  557.242576][T22769]        __x64_sys_creat+0x8f/0xc0
[  557.244597][T22769]        do_syscall_64+0xfa/0x3b0
[  557.246534][T22769]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.248937][T22769] 
[  557.248937][T22769] other info that might help us debug this:
[  557.248937][T22769] 
[  557.252954][T22769] Chain exists of:
[  557.252954][T22769]   &oi->ip_xattr_sem --> &journal->j_trans_barrier --> jbd2_handle
[  557.252954][T22769] 
[  557.258111][T22769]  Possible unsafe locking scenario:
[  557.258111][T22769] 
[  557.261056][T22769]        CPU0                    CPU1
[  557.263243][T22769]        ----                    ----
[  557.265274][T22769]   rlock(jbd2_handle);
[  557.266843][T22769]                                lock(&journal->j_trans_barrier);
[  557.269424][T22769]                                lock(jbd2_handle);
[  557.271893][T22769]   rlock(&oi->ip_xattr_sem);
[  557.273523][T22769] 
[  557.273523][T22769]  *** DEADLOCK ***
[  557.273523][T22769] 
[  557.276003][T22769] 8 locks held by syz.7.7254/22769:
[  557.277617][T22769]  #0: ffff888023280428 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90
[  557.280957][T22769]  #1: ffff8881125f60c0 (&type->i_mutex_dir_key#15){++++}-{4:4}, at: path_openat+0x8da/0x3830
[  557.285029][T22769]  #2: ffff888036c31840 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_suballoc_bits+0x15e/0x4640
[  557.290413][T22769]  #3: ffff8881125f26c0 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_suballoc_bits+0x15e/0x4640
[  557.295595][T22769]  #4: ffff888036c35240 (&ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_local_alloc_bits+0x125/0x24e0
[  557.300955][T22769]  #5: ffff888023280618 (sb_internal#3){.+.+}-{0:0}, at: ocfs2_mknod+0xe93/0x2050
[  557.304463][T22769]  #6: ffff888023a8cce8 (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x36a/0x6d0
[  557.308580][T22769]  #7: ffff8881276f8950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f87/0x21c0
[  557.312393][T22769] 
[  557.312393][T22769] stack backtrace:
[  557.314757][T22769] CPU: 1 UID: 0 PID: 22769 Comm: syz.7.7254 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  557.314784][T22769] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  557.314796][T22769] Call Trace:
[  557.314806][T22769]  <TASK>
[  557.314817][T22769]  dump_stack_lvl+0x189/0x250
[  557.314845][T22769]  ? __pfx_dump_stack_lvl+0x10/0x10
[  557.314868][T22769]  ? __pfx__printk+0x10/0x10
[  557.314891][T22769]  ? stack_trace_save+0x9c/0xe0
[  557.314919][T22769]  print_circular_bug+0x2ee/0x310
[  557.314940][T22769]  check_noncircular+0x134/0x160
[  557.314962][T22769]  validate_chain+0xb9b/0x2140
[  557.314992][T22769]  __lock_acquire+0xab9/0xd20
[  557.315024][T22769]  ? ocfs2_init_acl+0x2f9/0x720
[  557.315044][T22769]  lock_acquire+0x120/0x360
[  557.315066][T22769]  ? ocfs2_init_acl+0x2f9/0x720
[  557.315087][T22769]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[  557.315113][T22769]  down_read+0x46/0x2e0
[  557.315137][T22769]  ? ocfs2_init_acl+0x2f9/0x720
[  557.315157][T22769]  ocfs2_init_acl+0x2f9/0x720
[  557.315173][T22769]  ? ocfs2_mknod_locked+0x148/0x250
[  557.315204][T22769]  ? __pfx_ocfs2_init_acl+0x10/0x10
[  557.315228][T22769]  ? dquot_alloc_inode+0x216/0xa50
[  557.315251][T22769]  ? ocfs2_block_signals+0x94/0xe0
[  557.315280][T22769]  ? __pfx_ocfs2_block_signals+0x10/0x10
[  557.315305][T22769]  ? ocfs2_init_security_get+0x139/0x1a0
[  557.315332][T22769]  ocfs2_mknod+0x1321/0x2050
[  557.315366][T22769]  ? __pfx_ocfs2_mknod+0x10/0x10
[  557.315390][T22769]  ? __pfx_ocfs2_find_entry+0x10/0x10
[  557.315409][T22769]  ? __lock_acquire+0xab9/0xd20
[  557.315481][T22769]  ? look_up_lock_class+0x74/0x170
[  557.315507][T22769]  ? register_lock_class+0x51/0x320
[  557.315533][T22769]  ? __lock_acquire+0xab9/0xd20
[  557.315563][T22769]  ? __lock_acquire+0xab9/0xd20
[  557.315591][T22769]  ? do_raw_spin_lock+0x121/0x290
[  557.315617][T22769]  ? do_raw_spin_unlock+0x4d/0x240
[  557.315644][T22769]  ? rcu_is_watching+0x15/0xb0
[  557.315661][T22769]  ? ocfs2_lookup+0x5b9/0x9b0
[  557.315687][T22769]  ocfs2_create+0x1a5/0x440
[  557.315713][T22769]  ? __pfx_ocfs2_lookup+0x10/0x10
[  557.315735][T22769]  ? from_kgid+0x1b0/0x650
[  557.315756][T22769]  ? __pfx_ocfs2_create+0x10/0x10
[  557.315774][T22769]  ? HAS_UNMAPPED_ID+0x11a/0x180
[  557.315791][T22769]  ? inode_permission+0x149/0x470
[  557.315803][T22769]  ? __pfx_ocfs2_permission+0x10/0x10
[  557.315823][T22769]  ? bpf_lsm_inode_create+0x9/0x20
[  557.315839][T22769]  ? __pfx_ocfs2_create+0x10/0x10
[  557.315858][T22769]  path_openat+0x14f4/0x3830
[  557.315875][T22769]  ? arch_stack_walk+0xfc/0x150
[  557.315904][T22769]  ? __pfx_path_openat+0x10/0x10
[  557.315921][T22769]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.315945][T22769]  do_filp_open+0x1fa/0x410
[  557.315961][T22769]  ? __lock_acquire+0xab9/0xd20
[  557.315982][T22769]  ? __pfx_do_filp_open+0x10/0x10
[  557.316010][T22769]  ? __pfx_page_put_link+0x10/0x10
[  557.316031][T22769]  ? _raw_spin_unlock+0x28/0x50
[  557.316043][T22769]  ? alloc_fd+0x64c/0x6c0
[  557.316064][T22769]  do_sys_openat2+0x121/0x1c0
[  557.316079][T22769]  ? __se_sys_futex+0x36f/0x400
[  557.316098][T22769]  ? __pfx_do_sys_openat2+0x10/0x10
[  557.316115][T22769]  ? rcu_is_watching+0x15/0xb0
[  557.316130][T22769]  __x64_sys_creat+0x8f/0xc0
[  557.316144][T22769]  do_syscall_64+0xfa/0x3b0
[  557.316172][T22769]  ? lockdep_hardirqs_on+0x9c/0x150
[  557.316197][T22769]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.316226][T22769]  ? exc_page_fault+0x9f/0xf0
[  557.316246][T22769]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  557.316264][T22769] RIP: 0033:0x7fd514f8ebe9
[  557.316282][T22769] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  557.316300][T22769] RSP: 002b:00007fd515e36038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
[  557.316319][T22769] RAX: ffffffffffffffda RBX: 00007fd5151b5fa0 RCX: 00007fd514f8ebe9
[  557.316331][T22769] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
[  557.316341][T22769] RBP: 00007fd515011e19 R08: 0000000000000000 R09: 0000000000000000
[  557.316351][T22769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  557.316359][T22769] R13: 00007fd5151b6038 R14: 00007fd5151b5fa0 R15: 00007ffce4daf9e8
[  557.316384][T22769]  </TASK>
[  557.532749][T20016] ocfs2: Unmounting device (7,7) on (node local)
[  562.641342][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  562.643639][ T1364] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
23:42:35  Registers:
info registers vcpu 0

CPU#0
RAX=1ffffffff1729b4c RBX=ffff88801f969cc0 RCX=0000000000080000 RDX=ffffc9000911a000
RSI=000000000007ffff RDI=0000000000080000 RBP=ffffc90009687c58 RSP=ffffc90009687b20
R8 =ffff88801f969cc7 R9 =1ffff11003f2d398 R10=dffffc0000000000 R11=ffffed1003f2d399
R12=dffffc0000000000 R13=000000000004d000 R14=0000000000001000 R15=0000000000000000
RIP=ffffffff81f7952d RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f7f338746c0 ffffffff 00c00000
GS =0000 ffff8880b8624000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f7f295ff000 CR3=0000000110404000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=99ba8f5414f9889d 651fed9a1a5b4d3e
XMM06=3fb4884adaf2d59b ebaf0f2811dffdfa XMM07=96a2955af7cf7977 9326fb01b13a7b87
XMM08=6161616161616161 6161616161616161 XMM09=0000000000000000 00007f89f3612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8
RSI=00000000000039ed RDI=00000000000039ee RBP=00000000000003f8 RSP=ffffc90009e068f0
R8 =ffff888107080237 R9 =1ffff11020e10046 R10=dffffc0000000000 R11=ffffffff854e72a0
R12=dffffc0000000000 R13=ffffffff99af18cb R14=ffffffff99de64e0 R15=0000000000000000
RIP=ffffffff854e731c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fd515e366c0 ffffffff 00c00000
GS =0000 ffff8881a3c24000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2fd19ff8 CR3=0000000109b8a000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=6161616161616161 6161616161616161
XMM06=6161616161616161 6161616161616161 XMM07=6161616161616161 6161616161616161
XMM08=6161616161616161 6161616161616161 XMM09=0000000000000000 00007fd515012fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
