last executing test programs:

111.301857ms ago: executing program 1 (id=107):
open_tree(0xffffffffffffffff, &(0x7f0000000000), 0x0)

90.951988ms ago: executing program 1 (id=110):
setrlimit(0x0, &(0x7f0000000000))

90.694938ms ago: executing program 3 (id=112):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vtpmx', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vtpmx', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vtpmx', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vtpmx', 0x800, 0x0)

65.808698ms ago: executing program 2 (id=115):
getpriority(0x0, 0x0)

65.614068ms ago: executing program 3 (id=116):
fchownat(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)

65.489208ms ago: executing program 4 (id=117):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem', 0x1, 0x0)

65.435268ms ago: executing program 1 (id=118):
setuid(0x0)

64.979398ms ago: executing program 2 (id=119):
msgget(0xffffffffffffffff, 0x0)

64.858048ms ago: executing program 4 (id=120):
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)

64.704958ms ago: executing program 0 (id=121):
clone3(&(0x7f0000000000), 0x0)
exit(0x0)

64.608118ms ago: executing program 3 (id=122):
sched_getscheduler(0x0)

30.153179ms ago: executing program 0 (id=123):
socket$inet6_icmp(0xa, 0x2, 0x3a)

29.812059ms ago: executing program 2 (id=124):
socket$nl_xfrm(0x10, 0x3, 0x6)

29.685799ms ago: executing program 0 (id=125):
socket$inet(0x2, 0x1, 0x0)

29.623089ms ago: executing program 1 (id=126):
listen(0xffffffffffffffff, 0x0)

29.559939ms ago: executing program 2 (id=127):
getresgid(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))

29.502149ms ago: executing program 3 (id=128):
lsm_set_self_attr(0x0, &(0x7f0000000000), 0x0, 0x0)

29.408689ms ago: executing program 4 (id=129):
close(0xffffffffffffffff)

29.367769ms ago: executing program 3 (id=130):
lsetxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0)

29.291269ms ago: executing program 4 (id=131):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord', 0x800, 0x0)

1.45982ms ago: executing program 0 (id=132):
mq_notify(0xffffffffffffffff, &(0x7f0000000000))

1.31461ms ago: executing program 1 (id=133):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec', 0x2, 0x0)

1.24564ms ago: executing program 0 (id=134):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null', 0x800, 0x0)

1.09177ms ago: executing program 2 (id=135):
quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000))

956.47µs ago: executing program 4 (id=136):
clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
exit(0x0)

817.59µs ago: executing program 3 (id=137):
readlinkat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0)

392.67µs ago: executing program 1 (id=138):
fdatasync(0xffffffffffffffff)

272.85µs ago: executing program 0 (id=139):
lgetxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0)

98.54µs ago: executing program 4 (id=140):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock', 0x800, 0x0)

0s ago: executing program 2 (id=141):
pselect6(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.41' (ED25519) to the list of known hosts.
[   30.369110][ T4035] cgroup: Unknown subsys name 'net'
[   30.639390][ T4035] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   30.922812][ T4035] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k SSFS
[   31.787270][ T4086] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability
[   32.182718][ T4191] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP
[   32.184090][ T4191] Modules linked in:
[   32.184738][ T4191] CPU: 1 PID: 4191 Comm: syz.4.136 Not tainted syzkaller #0
[   32.185990][ T4191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
[   32.187852][ T4191] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc)
[   32.189300][ T4191] pc : do_notify_resume+0xad4/0x30a8
[   32.190231][ T4191] lr : do_notify_resume+0xab8/0x30a8
[   32.191179][ T4191] sp : ffff80001fc27be0
[   32.191905][ T4191] x29: ffff80001fc27e00 x28: ffff0000c7788000 x27: dfff800000000000
[   32.193292][ T4191] x26: ffff80001fc27eb0 x25: 0000000000000000 x24: ffff0000c7788024
[   32.194783][ T4191] x23: ffff0000c7788024 x22: 0000000000000001 x21: 0000000000000001
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   32.196193][ T4191] x20: 000000001fffee20 x19: 0000001fffee2000 x18: 0000000000000200
[   32.197894][ T4191] x17: 0000000000000000 x16: ffff800008041f30 x15: 0000000000000002
[   32.199545][ T4191] x14: 0000000000000009 x13: 1ffff0000288002b x12: 0000000097863b1e
[   32.201072][ T4191] x11: 00000000fffffff2 x10: 0000ffffffffffff x9 : 000000001fffee20
[   32.202504][ T4191] x8 : 000000001fffee20 x7 : ffff800008763378 x6 : 0000000000000000
[   32.203858][ T4191] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
[   32.205219][ T4191] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
[   32.206576][ T4191] Call trace:
[   32.207129][ T4191]  do_notify_resume+0xad4/0x30a8
[   32.208129][ T4191]  el0_da+0x10c/0x1ec
[   32.208966][ T4191]  el0t_64_sync_handler+0xd8/0xe4
[   32.209992][ T4191]  el0t_64_sync+0x1a0/0x1a4
[   32.210945][ T4191] Code: 9a9f0289 d503229f 2a1f03eb f8000939 (b90067eb) 
[   32.212248][ T4191] ---[ end trace f8f9708b35e773c3 ]---
[   32.380945][ T4191] Kernel panic - not syncing: Oops - BTI: Fatal exception
[   32.382137][ T4191] SMP: stopping secondary CPUs
[   32.382942][ T4191] Kernel Offset: disabled
[   32.383820][ T4191] CPU features: 0xa,000003c1,7d33ffd9
[   32.384949][ T4191] Memory Limit: none
[   32.551078][ T4191] Rebooting in 86400 seconds..