------------[ cut here ]------------
c->control.rates[0].idx < 0
WARNING: ./include/net/mac80211.h:3420 at mac80211_hwsim_write_tsf+0x4ca/0x6b0, CPU#1: kworker/1:9/13279
Modules linked in:
CPU: 1 UID: 0 PID: 13279 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: mld mld_dad_work
RIP: 0010:mac80211_hwsim_write_tsf+0x4ca/0x6b0
Code: 41 5c 41 5d 41 5e 41 5f 5d e9 32 2a ac 04 e8 8d e5 8c fa 66 bd 64 00 4d 8d bc 24 a8 49 00 00 e9 18 fc ff ff e8 77 e5 8c fa 90 <0f> 0b 90 e9 86 fc ff ff 89 d9 80 e1 07 38 c1 0f 8c be fb ff ff be
RSP: 0018:ffffc90000a18698 EFLAGS: 00010246
RAX: ffffffff873ad5a9 RBX: ffff8881a935ac30 RCX: ffff888169af5a00
RDX: 8000000000000300 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffff8880235b0f40 R08: 0000000000000100 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001430c4 R12: ffff8880235b3220
R13: ffff8881a935ac00 R14: dffffc0000000000 R15: ffffffffffffff98
FS:  0000000000000000(0000) GS:ffff8882a8cd9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f79669eb840 CR3: 0000000171172000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 mac80211_hwsim_tx_frame_no_nl+0x16b/0x1760
 mac80211_hwsim_tx+0x18cb/0x2580
 ieee80211_hwsim_wake_tx_queue+0xd4/0x150
 ieee80211_queue_skb+0x1918/0x22e0
 ieee80211_tx+0x2c2/0x4b0
 ieee80211_tx_pending+0x754/0xba0
 tasklet_action_common+0x2d7/0x490
 handle_softirqs+0x226/0x860
 do_softirq+0x77/0xd0
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140
 __dev_queue_xmit+0x1edc/0x3820
 ip6_output+0x337/0x540
 NF_HOOK+0x177/0x4f0
 mld_sendpack+0x890/0xe10
 mld_dad_work+0x3d/0x480
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
