last executing test programs:

5.794057806s ago: executing program 3 (id=4):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/virtio/devices/virtio0/../driver_override\x00', 0x0, 0x0)

5.585436402s ago: executing program 3 (id=7):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1b1c, 0x1c03, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1d}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x7}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00221d0000000600ff0901a101150026ff007508954009018102090191020901b102c0"], 0x0}, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="20014000"/70], 0x0})
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00221d0000000600ff0901a101150026ff007508954009018102090191020901b102c0"], 0x0}, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="20014000"/70], 0x0})
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00221d0000000600ff0901a101150026ff007508954009018102090191020901b102c0"], 0x0}, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="20014000"/70], 0x0})
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00221d0000000600ff0901a101150026ff007508954009018102090191020901b102c0"], 0x0}, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="20014000"/70], 0x0})

4.626292243s ago: executing program 1 (id=2):
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000001000), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000001040)={0x1, 0x1}, 0x2)
write$USERIO_CMD_REGISTER(r0, &(0x7f0000001080), 0x2)
read(r0, &(0x7f00000010c0)=""/4096, 0x1000)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000020c0)={0x2, 0xfa}, 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000002100), 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000002140), 0x2)
read(r0, &(0x7f0000002180)=""/4096, 0x1000)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000003180)={0x2, 0xfa}, 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000031c0), 0x2)

4.458936719s ago: executing program 2 (id=3):
syz_mount_image$ext4(&(0x7f0000000680)='ext4\x00', &(0x7f00000006c0)='./file0\x00', 0x0, &(0x7f0000000700), 0x0, 0x676, &(0x7f0000000740)="$eJzs3UtsXFcZB/DvXj/IY8COkgXpBkMWRUKxPXFcBQRqi1jw6AJEF1SqBFYycayMkxC7VWyMaAMSjwVCXdAFUlVY0FJAWBTUIkBYPFYgVIlKqAgiYAWVqqK2YoU06Ixn7KG+rp36cSvu7yddz7nnzOR84+Q/917lHjuAyhpJX/KI4xExnEUM9Yz1R2dwZPV5SxPLF9KWRav18RezyCJiZmL5Qvf5WefxcOfFZyLil++POPHFjfPOLSxenGo2G1c7+2Pzs1fG5hYWT87MTk03phuXTtVvq58Zr09Ont619/rnH99/9PbDH/7J95997IfXvnXxb1ncEbXOWO/72C0jMbL2PenVn0XctduTlaSv8+9koOxCuGlfuO/sl9Pf39GIOBERR2Io+jqpv+Ud9740FNf+stlr//WrR/65n7UCu6/1uYgWUEllf/4AAAAAAAAAAAAAAAAAAADrWq3M+n+oqLI/fwAAAAAAAAAAAAAAAAAAgI1mJpYvdLf9mvOPP9uvmYAiL9wZEf2r+V/qbKsj/THSfjwQAxFx6OUsPW1NFhEf3eHcK3dEjMT7Hp7/xD3fSVt0Pod2+McC2/TAgxHx1qLjf9bO/3AcaO8dejn/n/zn6bWdx9R//XXMffy5lP+Z7/X2yT/sn53k/2s9+X/odcx98hsp/1//UW+f/EM1LP267AqAsnzo6bIrgGprn/+P9/dvdv6/E1e2GP/PXDr/f/HdvX3O/6EaHv9M2RUAZfnpD8quACjLV/9QdgVQbSt3puv/ov//y9fu/4mC+39qEfGpHc49+fN0/f/2o719rv9h/3Tv/1vacP/fev77Nrn/79FtztH69/Sxov5jT6X8P3qte/9f2tL83XsBgb31woMRtxTmP1vLf1aQ/zwilrc5x9Jv750t6j96d8r/4/fLP5Sj9c2IW6M4/12pNTY/e2VsbmHx5Mzs1HRjunHpVP22+pnx+uTk6bHzM83G+OrXwjnqD13/fFH/87en/A9dl38oRzr+H9ok/1ud/69sc45PfmX4Y0X9p+9J+f/AxGvnP39+MLs7lRCDnZ5rU/PzV+sRg9ldG/tP3ex3AKqjm5FuhlL+33nita//i87/D0bEM9ucc/HqU98t6n/ksZT/bz/h+A/lSPk/t8Xxvyj/qe+v25zjvS/9vnB50JN/Svn/+2flHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3qjwiapHlo2vtPB8djTgcEcfiUN68PDf/rvOX77t0Lo1FDMdA3v1N/0Or+1nar7fb6/unXrU/ERFHIuJLfQfb+6NnLzfPlf3moaJqETee/PTZwbLrAAAAAAAAAAAAAAAAAAAA1h1+1fr/f/Strv8H/n/VIm48+5unf5Har/SVXQ2wn1L+n3hl9iMh/1A58g/VJf9QXfIP1SX/UF3yD9Ul/1Bd8g/VJf9QXfIP1dWbfwAAAAAAAAAAAAAAAAAAAAAAAABgbx1528pzWUQ88J6D7S0Z7IwNlFoZsNfysgsASuNHf0N19ZddAFAa1/hAtsX4gc0GVrZ6JQAAAAAAAAAAAACwW249bv0/VJX1/1Bd1v9DdVn/D9XlGh+w/h8AAAAAAAAAAAAA3vhq7S3LRztrgWuR56OjEW+OiOEYyM7PNBvjEfGWiPhd38Cb0n697KKBHalF3PjgM8ceLrsOAAAAAAAAAAAAAAAAAABg3dzC4sWpZrNxVUNDQ2OtUfYnEwAAAAAAAAAAAAAAAAAAVM/6ot+yKwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA8qz//v+9a5T9HgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBm/TcAAP//7HpP/g==")
r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0)
ioctl(r0, 0x4c04, &(0x7f0000000200)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000")
read(r0, &(0x7f0000100000), 0x80000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
write(r1, &(0x7f0000100000), 0x80000)
ftruncate(r1, 0x200000)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
ioctl(r0, 0x4c04, &(0x7f0000000200)='\x00'/56)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07)
r2 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0, 0x0)
ioctl(r2, 0x40086610, &(0x7f0000000800)='\x00\x00 \x00\x00\x00\x00\x00')

3.903499155s ago: executing program 2 (id=8):
mknodat(0xffffffffffffff9c, &(0x7f0000001000)='./backing0\x00', 0x81ff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000001040)='./backing0\x00', 0x2, 0x0)
fallocate(r0, 0x0, 0x0, 0x1000)
r1 = syz_open_dev$loop(&(0x7f0000001080), 0x0, 0x0)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
mknodat(0xffffffffffffff9c, &(0x7f00000010c0)='./loop0\x00', 0x6180, 0x700)
mknodat(0xffffffffffffff9c, &(0x7f0000001100)='./backing1\x00', 0x81ff, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000001140)='./backing1\x00', 0x2, 0x0)
fallocate(r2, 0x0, 0x0, 0x1000)
r3 = syz_open_dev$loop(&(0x7f0000001180), 0x1, 0x0)
ioctl$LOOP_SET_FD(r3, 0x4c00, r2)
mknodat(0xffffffffffffff9c, &(0x7f00000011c0)='./loop1\x00', 0x6180, 0x701)
mknodat(0xffffffffffffff9c, &(0x7f0000001200)='./backing2\x00', 0x81ff, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000001240)='./backing2\x00', 0x2, 0x0)
fallocate(r4, 0x0, 0x0, 0x1000)
r5 = syz_open_dev$loop(&(0x7f0000001280), 0x2, 0x0)
ioctl$LOOP_SET_FD(r5, 0x4c00, r4)
mknodat(0xffffffffffffff9c, &(0x7f00000012c0)='./loop2\x00', 0x6180, 0x702)
r6 = syz_mount_image$btrfs(&(0x7f0000001300), &(0x7f0000001340)='./file0\x00', 0x0, &(0x7f0000001380), 0x0, 0x559e, &(0x7f0000005680)="$eJzs3X1sVeUdB/BzKQWkQLs4FEMyGUNdls0gZoJOscjAUUHuwA1Jxmhl0iBBu2ZuaRdd49hwcS6Vl20sQV0iI6uNdnSDzBHFhCjE8TI0xoxXGaMZccjrwpjGpffe53LvubS9Mmd9+XxIe85zf+d57nNPzh/3e+lzbgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABRFCWntzYv/t1Vm9849c7TDVe93LfvoxP+Vv+TW1cOHfu5R/5atvJP+1+aN7Jm+MTLWvcl5jbsHbskihKpfolM/7k3fWXG/Jlzpw0IA1Z/Nb2tqOjqKdNd96cb/fIe7OyX/1MTRVFpbICSzHZSWXrbJ2+A7G594YDdGjfozcWDj1a1rKkuq1368NRjhS+dTgN6ewK9JXNdHTx7LVWmfveJHZFt51x6ibxLNN0/fsG9Ly8CAHhXRidTm+zb0cxb3Gy7KV6PtStj7eZYO7xDaM5tnI/0uP26mueIeL2X5lmZjgr9u5xnrJ45/9l2Mt4/1o5FjXcxz/xDM5FmQFfzrIvVe2ueAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8kD2zd9K+bpz13eOJNT0y5bu9rs58/Oelrzy/63rED/x5+8eoD/1mz/6V5I2uGT7ysdV9ibsPesUuiqCLVL5Hunpg5cPLFX/hV1fd/39Ewdd2g5pdLMuOGbd+cg6PXws615VF0R07lYBj2H0OiKJlfSDWjlYWFBamdKaEAAADAR8klqd99su10HCzNaydSaTKR+hekw+K4QW8uHny0qmVNdVnt0oenHjv/8ZJdjFd5zvGy7YqzP4mcYBzib3y8s/VwaH3BON2LjxjP8yUdVy5Pbl/7jR2Pnn7x6r23bxtec881F97VUrv2kxdUHd/x99kF+b+i+/wfzpz8DwAAwP9C/o+P072e8v9FB8p2Ljrz6obrv/zHZ75527a7T/3mx1u+fVfHoSNNY35Qu2TzloL8PyLvKQvyf5hxyP99ovPL/wAAAPBB9v/O/5UF43Svp/xfOfrtZffcW7d26c6tZ8b/4fLWJ9reuHz1tTNGrWiN5j/bfuitgvw/urj83zd32uHBP4cJLyyPotHFn1QAAAAgT/h/97MfLYS8nv7kIJ7X77hlQvnu45d+d9Km2+7fM6zhwJ2n7xxXs3bh5gWfGX3ftMcqDxbk/8ri8n/p+/NyAQAAgCKMWrWj5q1ZV+4e88qe++qf2t06YPX0f75y/faWK5pOHF60ZeftBfk/WVz+7987LwcAAAA4h58+c82Pbm5c/K05VZvGnznx+uAH395zYX3rrgk/W7Fv2zvPrthVkP+ri8v/AzPbzMqHdKcXwl8hLCuPogGdO3XpwotR843ZAgAAAPAeCTl96aixHSvmD/3srP5TaluWr3ro0hGHP5VofnDonMbxpXs2Hrm3IP/XdX///3Cng7D+P+/+fwXr/3MK6bv+fcmNAQAAAPg4KlzPH26Pn/7mgq6+f7/Y9f+rrtv6622JG1+f3nTJvF+OWDRu8uQj+zY2nnyg+vObXh24ft0jBfm/qbj8X5K7fS+//w8AAADOw4ft+/9mF4zTvZ7u/998dePTj+2/+7kXntx8y6kLDp25of2KJ9vX33p/++HhJ6PG7acL8n9zcfk/bMtyX97GcH5+WB5Fwzp3MncT/G2Y7sJYoa00p5A+8bEeM0OPTKGtf04hpS7WY0x5FH26c6cpVvhEKDTHCkeHZAqPxwrbQyFzPWQLT8UKG8OV9vMhmenGC+tDIbPAoi2soCjLLomI9TjRVY/Owjl77Mo+OQAAwMdKCM+ZLFua34ziUbYt0dMBA3s6oE9PB5T0dEDf2AHxA7t6PKrOL4TH23+xoGb+X5bdMHRD+YxZO0u+fnDahC8uX1f9nQ1zJh8feVF5R0H+f7y4/B9ORb/0pqv1/1FY/5/5XsPs+v/qUKiIFdpCIRm/Y0AyPEc67D4UnqMimelxdFi2AAAAAB9p4XOBkl6eBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPyXvTsPk6q6EwZ8uumFbpruNvoIar6EYNh8pGkg4hITUQwkaLSJe4wKQqNIiyiQCEE/XOJuPk38RmNmDIyJWxBxGbfRiKJohESigyOKS6IO7ga3jMsj83RXnaLqVpddCCjtvO8fXafqd9ZbS9e599a5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA/w4HvTB63pQZZ6y67JUVr4ehd14+6uKSX2w3fOnSPtf98urrf/XSA88tHd973HYj+sx/tuSomc/sfHYITW3lSlLFSw6oHtlj4OWjf3rL6pn73lpz0WMV6XrT8dCt9U9p+s6ZsdUXuodwW0kIZcnAwJpUoDx9vybW9+WaELYI6wKZEs3VqRLJhsMDVSHMDesCmaruqAqhJitw4KP33XNha+KSqhD6hBAqk208XZlqoyoZ6FuRClQnAyeUpQL/WJuSCdxemgrABotvhsyLfmFTbob69ssVeP2Vb7SOfb6Sw+sSE/WF872+5ybuVJaK5ANNG/S05VXHJpH39ljk3dYJ3m152/kiT1v2F6n0N5S160KVoXRC88RxM1qmx0dKQ0NDl0I1baLneeWa2ePXJ91pXoexA/Ub5XVY3nfYQX16jj7yyhXLFz1Ut3iD/xk8kbVJs9ObWmVIv+Y6zfMYDfd50gnefnlvjF6+dIUQDt1y5ajdRx700qDD6v+1zwU7X9/wq5t/WPrKlFW7HLzbguU/O7Iqb/5f/8nz/8zHUvq2NCd3bPXD2tTcPD5SExNv1qbm5gAAANBpdIa9pv94f8sF7yy5t/n6c4a+d8OcGwYuvq9uSfWYAbcePGzfO9b0bVqRN//vVdzx/3jIvyZ7tItCGN6WOKMuhJ5tj6cC18buHF0XwtfaUk25gT0TgUUhbNOWGJCpKlGiayzRKxFYXZsODE8ElsRAUyLwuxi4KBE4MwYWJgLjY2BRIrBXDIRJuePYoTY9jqIDVTEwNrURF8azEN6uja0lttVTmaoAAAA2kvTssDz3bta5DhuaIU4vF1Z1lCGegV0wQ2WihuQMNjOtKlhDWUc1lHZUQ2bccz55+Hk1l3RUc95pGCW5GUZc++C8Pz92Vp/59b9d/fX/6vnfO15+yHHTzxy65Yw5r75z6MrVPfLm/42fPP+vbKcjJXnH/0MY0/Y35i5NR1oy8bFNORkAAACADTB7h0sefuX42of7TVn0+nn//uP/X/H7W2cdsetri3/x5DM/Kq1ZdXDe/H94cef/x30iXbIyh2VxN8TkuhAacwOpar+ZH0gd9e6WDgAAAEBnkDkenzkWPil9mzpFOzmfzs/ftJ7544H/4e3mP7Bl0ZcOm95/7KPbXvKP+7f//d3zljXsf832V+yy8poRS7b69qiP8+b/TcWd/1+de5vqxJLYi1/WhdA1K/Bg7GVroE2vGHhuj9xAevxL4gY4P1aVPjEhU9X5scTYGGhMBOYWKrE8U6JnbiD9ZGUaPyMzjknpElkBAAAA+MzF3QHxuHw8//+qv/W/eeceF2+9d/3ybd6d/MJPbnj+vv5rSpde+vZ7x5z75Qtv/Hne/H/s+p3/3zYPzju9v6VbCIPKQuiS/GHAsurUwoAxUFOSTtxdnaqrS7Kq06pD2L11YMmq/ppe/78sucbgo1WpqmKgZ+9r1vRtTVxZFcKg7MDjh8/bqTUxPRHINH5QVQhfbR1tsvF/65pqvDzZ+KVdQ/hKViBT1dFdQ2htrCJZ1X2V6esYJKu6oTKELbMCmaqGVYYwMwDQScV/pROyH5w2c9bkcS0tzSdtwkTch18VJk5qaW4Yf0LLhMoCfZqQ6HPOMkan5Y+p2CvfPJVeouij7/SuLyad+Z1gY3Zb6f34eScOpu/H70LlbeMcUp5zd2hyyP23z28iZH2TKjTk0k085OrsStY9iXn1x/wVoVvoOmNa80kNJ4+bPv2kwam/xWYfkvobDzOlttXg5Laqbq9vRbw8Cq6WlfBpt1W/7EoGTT9+6qBpM2cNnHT8uGOaj2meMnhIY+OuuwwdOqRxUOuo0n87GGq/9qpODHXtvCLHtRGHum1ZViWfxaeGhIREZ0t87YRjH5l65VtX7Fe3y1m3DPv+DTce98bBP2nceu3ZNYfvM/m1xbPy5v9TP3n+Hz914id/en2GQsf/6+Nh/tTj6w7zj42BucUe/68vdDQ/c2JAr0RgTgzMcZgfAACAL4a4OzLuzYx7pbc85Nu3r9rjr8+8stuu/+cPdx9a++FVXQ4b9f+m7fjkFo+U//Hwl/bJm//PKe73/xtp/f/M0vWjCy3zPyCWaCy0/n9ymf/M+v9zCq3/n1zmP7P+/9zPYf3/GZlAYpO8bf1/AADgi+CzW/+/w+X9kxcIyMvQ4fL+yQsE5GXocBn/Yi8QsN7r/zesOnrkhT1//dWXv3nIvj+Y8uKUBf2P/NYe1/zwvHvDNXd/Y0W/OXnz/4uKm/9buB8AAAA2HxOe/N3qwcfv+sEjD91eutdPl7/4lTeeOKbp7gfWXvzqHe9cMWKbiXnz/7nFzf8/+/X/QqHz/3sVCjQVWhjQ+n8AAAB0UoXW/3vxT996cGTlTxpPffS3f7hqp8sP3+PUh6+6d6+JV9fuc9MOo3913q558/+Fxc3/42kXpTm5Y28+rE2taReSa9q9WZv5yQAAAAB0DqWhoaG8yLw5K6Pu+enbXJleCvST0tlmXP7uqgmX7D1w3N9eHXDgf9w4+83vn/jEHac/PfvpWUsve3Pvd5blzf8XFTf/z/ldRnnfYQf16Tn6yA+vXLF80UN1iyvWHf8HAAAANp1i90sAAAAAAAAAAAAAAACfvzvXvPfro7a+b9jP77z1xj1Hvdpnu4/3ffGt58/Z7XsPz/7z1Y99sDTv9/9hTFu5Qr//j9f9i78v2Cond2y14/X/0vcP3GfBzLYlC5fVhrB9dmDy6ZO3COlr8/fLDtxzxIAerYnTkyXuemavF1sTRyUD3x34pfdaE7snAmPjIonbJAPxqorvdU8E4vKKjyUDcXssTAYq0oFzu6fGUZLcVi/XpLZVSXJbPVkTQl1WILOtbqtJtVGSHOAliUBmgCcmA3GA+6UDpcleLeiW6lUM1MSiv+mW6hUAAJut+C2wPEyc1NLcGL/Cx9tty3Jvo5wly07Lr7akyOafSi9N9tF3etcXk+6S/C667lrj5aGydQiD876uZmcpaRvlxqmlg023VYEhd7TaW2mBcknru+kqCo+oKjWihvEntEwo73DgQzvOMqSswyyD8yY72VlK2zZpEbUU0ZciRlTktimiy/F+aWho6JLItVsM1occHb0iiv29fvY6f4VeBdl56vcetcfWpTsNOXjns08cM2TJN7ZY/MrbO52y7OQXVvzTbd8be2rPvPl/fXHz/8rscb2XvhjAnHhlvW/WhTC2yBEBAADAF9/1/3f+TYeesOTliYvK/vMvf5lcuv+h5Wtn3zJ71s+evPv8756749UbGr/goVNaRk4sq7jx5t/ude3yc07ft+nQ5mGr7yx9ftmfLm3u/0b++v+9ipv/xz1Y6UPBqb0di+L1/8+oC6Ht0vr1qcC1cbhH14XwtbZUUyyRuqD+6FiiMRW4Nu4wGRBLjG3KraprDCxMBFbXpgOLEoElMZDeS3FNSO/Kubg2hJ3aUmNyS0yNJeoTgf1joFci0BADjYlA9xgYngi81j0daEoElsZAmJS7rW7unt5WAAAA6yM9zyrPvRuS87yFZR1lKOkoQ3VHGUo7ylDZUYZCo4j3b4oZyhMnr5RkZSpP1lqVqCUvQ7wY/nr3Ky9DWJ6bM1kwr+l4/kHmfIOS3AyndLvgrMe/HYYteG23h2e+Nbphu7/vd/9T90+/dPm5Kz8896DlL+TN/xuLm/9X596mWl8S5//rrv+XCjwYu/fLeOp4rxh4bo/cQHrHwJI42T0/U1VTukR60n5+LDE8BnolAlNjYHgiMHZMOjC3R24gPdPONH5GpvFJ6RJZAQAAAPjMxR0EcTdNnP8fu1/vRy+/+bqWxecMuP3da689r9eIZ2+cc9ezFxz2VGh6feWEN/Pm/8OLm//H9rplN3Zm7M0L3UO4rWRdbzKBgTWpQNyPURN/Hv/lmhC2yNrBkSnRXJ0qUZFoODxQlfqFekWyqjuqUmsMxPsHPnrfPRe2Ji6pCqFP1t6XTBtPV6baqEoG+lakAtXJwAllqUDc85MJ3F6aCsAGy+wVjC+o9KkuGfXtlyvw+vuiXBM0Oby8faDt5GvvN1ebSmXygfQ+1Yz1e9ryqmOTyHt7LPJu64zvtnrvtuwvUulvKGvXhSpD6YTmieNmtEyPj2T/kjXPJnqes3+lWkx6I7wO53z63nasMtmBxsTHR2P75dp/HZZkFtrqO+ygPj1HH3nliuWLHqpbXFF0NwqIPxQ+o+7i+ieyNu+mVhnSr7lO93nS5POkM/4b6OVpCyF0feK4poV7f/z02V23fmCbmz96aOdDV1z19rfuOXr3J7cYNeKKhT/Mm/83FTf/L0vctnk/bsxpdSH0z9q4y+LmH1GX+hzMCqQ+JbfMD6QOuT9fW/CTEwAAADa2zO6OzP6CSenb1AnhyXlyfv6m9cwf91cMbzd/sf1++eNVP3p+4bwPTq2bcdabp87d9/2xj1837u8Nu9xXd/Ir/zLvgGPz5v9jP3n+3zXRTcf/Hf9nE3H8v12b+67orskH5mzQrui86tgkHP9v1+b+bnP8v12O/zv+3x7H/zvg+H+7NvenLe9b0lRfukII83+0w13LLxt/y0tNLVefPWvk19/9ftPiU+4aPuXXD7y6ZOaf7+yXN/+fWtz83/p/7S/al1n/b2yh9f+mFlr/b471/wAAgE2qwEJzyXle3up9eRmSq/flZehwgcAOlxi0/t96r/939KpH99/jlt1/80TpvBuv2/+DytuOGLLVDdvPn3j4+688tWb+vb/Pm//PKW7+H18O3bJb7yzr//UaU6Cqi2JgqoUBAQAA2BwV2kEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA56ux/48fm73ghSUf/vjIvd4+f/FFlx6wY8/5Y+5/640eB77z1iEjlz63dHzvcduN6DP/2ZKjZj6z89khTGorV5IqXnJA9cgeAy8f/dNbVs/c99aaix6rTNdbnr7dLid3bPXD2hDmZj1SExNv1rbeWRc4cJ8FM8taE8tqQ9g+OzD59MlbtCZ+VxtCv+zAPUcM6NGaOD1Z4q5n9nqxNXFUMvDdgV96rzWxezpQkuzuP3dPdbck2d0Lu4dQlxXIdPe47rlVZdoYlQ6UJtu4uibVRgzUxKKX1aTaiIGWWGJS1xAGlYXQJVnVHytTVXVJVnVnZaqqLsmqTq0MYfcQQlmyqmcqUlWVJUf+SEWqqhjo2fuaNX1bE3MrQhiUHXj88Hk7tSZOTAQyjf+gIoSvtr5kko3fVJ5qvDzZ+CXlIXwlhFCRLPFOWapERbLEX8tC2DIrkGn82LIQZga+EOKHz4TsB6fNnDV5XEtL80mbMFGRbqsqTJzU0tww/oSWCZWJPhVSkpVee9qnH/tTa2aPb7396Du964tJl6XLlbd1eUh5zt2hm3vvY7+qsytZ93zk1R/zV4RuoeuMac0nNZw8bvr0kwan/habfUjqb5d0NLWtBneWbdUvu5JB04+fOmjazFkDJx0/7pjmY5qnDB7S2LjrLkOHDmkc1Dqq9N+NMdR5n/1Qty3LquSz+ACQkJDobInSnE+3xs39gzzvi/66jpaHyrYP6LxpRXaWkrZRboxB7/kpR/xpvqd0OKLBeROHvCxDOs4yNG8ysS5LVSpL2/e6vMlhdk2lbZs03i8NDQ1dCm2H+ty72Zv39Q3YvCvTm67YNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8DztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCwAAAAAI87cOo2cDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBLAQAA//8d6cf4")
ioctl$BTRFS_IOC_ADD_DEV(r6, 0x5000940a, &(0x7f00000013c0)={{0x0}, './loop0\x00'})
ioctl$BTRFS_IOC_ADD_DEV(r6, 0x5000940a, &(0x7f00000023c0)={{0x0}, './loop1\x00'})
ioctl$BTRFS_IOC_ADD_DEV(r6, 0x5000940a, &(0x7f00000033c0)={{0x0}, './loop2\x00'})
ioctl$BTRFS_IOC_BALANCE_V2(r6, 0xc4009420, &(0x7f00000043c0)={0x1, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x1}})

3.594981631s ago: executing program 0 (id=1):
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040641122060000000000010902270001010080fa0904000003ffffff00070501020002000705810200020007058402000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x989680}, 0x0)
syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)=""/64)
syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)=""/64)
syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)=""/64)
syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)=""/64)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)

3.411405233s ago: executing program 4 (id=5):
r0 = syz_usb_connect(0x2, 0x2e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40f30c709100010000000109022e0001010080fa0904000004ffffff0007050102000200070582020002000705830340000107050403400001"], 0x0)
nanosleep(&(0x7f0000000100)={0x1}, 0x0)
syz_usb_ep_write(r0, 0x83, 0x8, &(0x7f0000000200)="04cc000000000000")

3.041734s ago: executing program 5 (id=6):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/yuyv\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/yuyv/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/yuyv\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/yuyv\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0/streaming_maxpacket\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='1023\n', 0x5)
symlinkat(&(0x7f0000000740)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r1, &(0x7f0000000800)='dummy_udc.1', 0xb)
nanosleep(&(0x7f0000000840)={0x0, 0x5f5e100}, 0x0)
r2 = syz_open_dev$video(&(0x7f0000000880), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f00000008c0)={0x0, 0x56595559})

2.405633533s ago: executing program 5 (id=9):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/lirc0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000400)="0100000002000000", 0x8)

2.405044039s ago: executing program 2 (id=10):
r0 = syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000005140)='./file0\x00', 0x0, &(0x7f0000000040), 0x0, 0x50ec, &(0x7f00000051c0)="$eJzs3U+IVVUcB/Dz5o8zKcw8QcighS3chhQtVIYeYZCL9KUQtDAnF0EIMtguwWxEEIwaCaSsQAuG3MgDIUGYEBe1CTRJEFqY4KaVQrtaFO/de968d67vvueojennEzP3nvu759zzHncx35fnvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhhDVv194vq09tvHJh4eyWg7MHGsdvzh89EkKldbyS13e/8tqOd3fufn08dph+I9tWq72GzLr+njVWdB1s9uv+eSeEMJoMMJxvXx0ujNq5u784YKlrx/adnj25fdPCmvVTl3bNnyu+dJrGl3sCyyW/r24t3ku11u+h5Ix2u+PWq3Tdoln/9Ib7T14EAHBPNtRbm/afo/mfuO32obSetGtJey5px78Q5jobS5GNu6LXPNel9WWaZy2LCmM955nU8/e/3a6n/ZN2EjXuYZ7dp+aRZrzXPGeS+nLNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBRcqb2wday+tTGKxcWzm45OHugcfzm/NEjIVRbxytZufL07RMjY9e3/fDRja9PvrT66t/Deb+4Hek4OVyPOxsnQ9jTUbkVh/1jIoR6d6HVDF8UC++1drbGAgAAAI+TZ1q/h9rtLA6OdrUrrTRZaf0XZWHx2rF9p2dPbt+0sGb91KVd8+eWPl69x3i1u47XblcXfyodwTjG33S8xXo8dX9hnHLpiGmeP//Ltq/K+hfyf7U8/8d3Tv4HAADgfsj/6Tjl+uX/PZufnSnrX8j/67ouWcj/ccYx/w+FpeV/AAAAeJQ97PxfK4xTrl/+f/Hwm9+X9S/k/w2D5f+RzmnHgz/HCe+dDGFDv6kDAAAAPcT/77740ULM69knB2lev/rNU7+WjVfI/7XB8v/oA31VAAAAwP3YXr3xfFm9kP/rg+X/sYc6awAAAOBefF75ZLasXsj/04Pl/5X5Nl/5kHX6Mf4rhM8mQxhv7sxkhZ/C3MvtAgAAAPCAxJz+6cffXi47r5D/Z8qf/x+fdBDX/3c9/6+w/r+jkD31b7MHAwAAAPAkKq7nj4/Hz765oNf37w+6/n/i5u3vyq5fyP+HBsv/w53bB/n9fwAAALAE/7fv/3urME65fs///2von4tl/Qv5f26w/B+3qzpf3sX4/hyeDGFtcyd/muCZeLm9SaEx2lFoqSc9dsYeeaEx1lFomUl6vDAZwnPNnUNJYXUszCWFOxN54VRSuBwL+f3QLpxNChfjnXZiIp9uWjgfC/kCi0ZcQbGqvSQi6fFnrx7Nwl17/Na+OAAAwBMlhuc8y452N0MaZRuVfies7HfCUL8ThvudMJKckJ7Y63iY7i7E4x/uOP1lKFHI/6cGy//xrViRbXqt/w9x/X/+vYbt9f/TsVBNCo1YqKdPDKjHa2Rh91i8RrWe97iztl0AAACAx1r8XGB4mecBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/7J3rzFyXfUBwM8+Z3e93l0TpASKYAElIZW8Xm+wpZAgbKAEgQSbynyoUISNvUk33iTGDwmHh9YOQaAUNSkpCShQuxUUf0lWVIhHgVhRcVQ1VaNUQk5T8qYREtTkoVTUQa5m7z2zd87deTjedbzp7yd558z8z/POw3PuvXMuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/8ORW95xXrP4uy976Mc/vef9nz/4mbnbn/zOl24JYXL+8Y4s3HH+ia91V45/5GcHHv/mNzasefhkb14uj4dV1T+d+Z0vxFqfWR3CDzpC6E4DawezQE9+fzDW96bBENaEhUCtxNRAViJtOPy8P4RDYSFQq+pH/SEMFgJbHr7/vq9UE3f0h3BhCKGStvHLStZGfxq4qDcLDKSBG7uzwP+cytQCP+zMAnDG4puh9qKfm6zPMLJ4uQavv54l69irKx1eV0yMNM73283L3KmC3vSByTN62krVsSxKb4+j3m0r4N1W2s63edqKX6TybyinFkKV0Llj6ppt+2b2xkc6w9hYV6Oalul5fuS5z24/nfSKeR3GDowsyevwzq8/9blvPX3l3Xd98QNX3/vi86Nn2s3jhU1aTC+3SshfcyvmeYw2+TxZAW+/0rekUV+6QghffuJv/6RZvDT/H2k+/48v53jbWZc71npyKJubx0cGY+LEUDY3BwAAgBVjJew1nf3O5RPN6ivN/0fbO/4fD/nnk/lstEdD2DSfuHk4hAvmH88CR2JznxwO4a3zqcn6wOYkcDSEN8wnLqlVlZToiyVGk8CzQ3lgUxI4FgOTSeDbMXBbEvhCDMwlge0xcDQJvDcGwnT9OP54KB9H24H+GNiabcS5eBbCC0OxtWRbPVqrCgAAYInks8Oe+ruFcx3ONEOcXs71t8oQz8BumKGS1JDOYGvTqoY1dLeqobNVDbVxzzYffqnmjlY1l07D6KjPsPuzv/uz0ERp/j/efP5fWaQjHaXj/yFcNf835u7MIzO1+NbJugwAAADAGVi1+YYtzeKl+f+m9s7/j/tEugqZw4NxN8TO4RDG6wNZtZeXA9lR71V5AAAAAFaC2vH42rHw6fw2O0U7nU+X80+eZv544H/Tovl//cF3Xdesv6X5/2R75/8P1N9mnTgWe/HV4RD6CoEHYi+rgXmjMfDEe+oD+fiPxQ1wa6wqPzGhVtWtscTWGBhPAocalXioVuKC+kD+ZNUav7k2jum8RCEAAAAAZ13cHRCPy8fz/x/Zd/x9zcqV5v9bT+/8//l5cOn0/plVIazrDqEr/WHAgwPZwoAxMNiRJ346kNXVlVZ1YCCEK6oDS6t6Ml//vztdY/Dh/qyqGLjgbd997qJq4u/6Q1hXDPzi44c3VBN7k0Ct8Y/1h/CW6mjTxr/flzXekzZ+Z18Iby4EalV9si+EamO9aVX3V/LrGKRV3VsJ4bxCoFbVxkoI+wMAK1T8r3RH8cE9+2/auW1mZmr3MibiPvz+cM30zNTY9htndlQa9GlH0ue6ZYwOlMfUcDmkxKP5EkVHXr5sqJ107XeC48W+5PvxSycO5vfjd6Ge+XFO9NTdvTQd8jveXm4iFL5JvVpDHihWsvAkluqP+XvDqtC3b8/U7rFPb9u7d/f67G+72Seyv3FQ2bZan26rgcX6dg68PC4uVrJu7/W71u3Zf9Pa6eu3XTt17dQNE+Pv3LBxw8T4xo3rqqMaz/62GOrFi1WdDPXU4bM/1Dd2Fyo5G58aEhISKy0xe/PhVc0+fkrz/13N5//xUyd+8ufrMzQ6/j8SD/Nnjy8c5t8aA4faPf4/0uhofu3EgNEkMBsDsw7zAwAA8NoQd0fG3Y5xr3Xv4Ut/06xcaf4/297v/5do/f/a0vUfarTM/yWxxHij9f/TZf5r6//PNlr/P13mv7b+/6FXYf3/fbVAsklesP4/AADwWnD21v9vubx/eoGAUoaWy/unFwgoZWi5jH+7Fwg47fX/J657/JnQRGn+f1t7838L9wMAAMC54/Z/eu4tzeKl+f+h9ub/Z3/9v9Do/P/RRoHJRgsDWv8PAACAFarR+n+nhv/iY83Kleb/c+3N/+NpF511uWOtJ4eyNe1CuqbdiaHaTwYAAABgZegMY2M9beatWxl18ytv85F8KdBm6aIHLv+va5vVV5r/H21v/l/3u4w7v/7U57719JV3n7zrix+4+t4Xnx9dOP4PAAAALJ9290sAAAAAAAAAAAAAAACvvn2f+NcTzeKl3/+Hq+Yfb/T7/3jdv/j7gtfX5Y61tl7/L7+/5cP37J9fsvDBoRDeXgzsPLhzTcivzX9xMXDf1ZecX00cTEv85LH3/qqa+EQa+ODa171UTVyRBLbGRRLfkAbiVRVfWp0E4vKK/54G4vaYSwO9eeDLq7NxdKTb6teD2bbqSLfVfwyGMFwI1LbVDwazNjrSAd6RBGoD/FQaiAP8SB7oTHt1z6qsVzEwGIv+zaqsVwAAnLPit8CecM30zNR4/Aofb9/YXX8b1S1ZdqBcbVebzT+aL0125OXLhtpJd6XfRReuNd4TKtUhrC99XS1m6Zgf5dLU0mLTvb7BkFut9rZcm6638Yj6sxGNbb9xZkdPy4Ff2jrLRHfLLOtLk51ils75TdpGLW30pY0Rtblt2uhyvN8Zxsa6klzvisGRUKfVK6Ld3+sX1/lr9Coo5jkw0/OHZvWV5v8j7c3/K8VxvZRfDGA2XlnvL4ct8w8AAADL68ubf39X/PeT4Y/+Z7O8pfn/aHvz/7hjLD8UnO3tOBqv/3/zcAjzl9YfyQJHYnOfHA7hrfOpyVgiu6D+h2KJ8SxwJO4wuSSW2DpZX1VfDMwlgWeH8sDRJHAsBvK9FN8N+a6c24dC2DCfuqq+xK5YYiQJfDQGRpPAWAyMJ4HVMbApCfxmdR6YTAL/EgNhun5b/cPqfFsBAACcjnye1VN/N6TzvLnuVhk6WmUYaJWhs1WGSqsMjUYR738vZugpHo/PM8SHetJa+5NaShnixfBPu1+lDOGh+pxpwVLTtTNJRupzxgxb5g6uDk2U5v/j7c3/B+pvs9aPxfn/wvX/ssADsXtfjaeOj8bAE++pD+Q7Bo7Fye6ttaom8xL5pP3WWGJTDIwmgV0xsCkJbL0qDxw6vz6Qz7Rrjd9ca3w6L1EIAAAAwFkXdxDE3TRx/v/ffX/462blSvP/Te3N/2N7q4qNfSHW+szqEH7QsdCbWmDtYBaI+zEG48/j3zQYwprCDo5aiamBrERv0nD4eX/2C/XetKof9Wc/Poj3tzx8/31fqSbu6A/hwsLel1obv6xkbfSngYt6s8BAGrixOwvEPT+1wA87swCcsdpewfiCyk91qRlZvFyD199r5Zqg6fBK+0AXybfYb66WSyV9IN+nWnN6T1upOpZF6e1x1LttJb7bRrzbil+k8m8opxZCldC5Y+qabftm9sZHir9kLVmm57n4K9V20kvwOpx95b1trZJ2YDz5+BhfvNzir8OOWN2dX3/qc996+sq77/riB66+98XnR9vuRgPxh8I3XPe/Q8cLm3e5VUL+mltxnyeTPk9W4n8Do562EMItcxe80Cxemv9Ptjf/705u5/0+bsw9wyG8o7BxH4yb/33D2edgIZB9Sp5XDmSH3J8eavjJCQAAAEuttrujtr9gOr/NTghP58nl/JOnmT/ur9i0aP52+/2ZCy/8x2bx0vx/a/P5f1/STcf/Hf9nmTj+v6hzfVd0X/rA7Bntii5Vx7Jw/H9R5/q7zfH/RTn+7/j/Yhz/b8Hx/0Wd609b6VvSLl+6Qgj937/8oWbx0vx/V3vzf+v/Lb5oX239v62N1v/b1Wj9v1nr/wEAAMuqwUJz6TyvtHpfKUO6el8pQ8sFAlsuMWj9v9Ne/2/grz7+u9BEaf4/2978P74cVhVbXynr/41e1aCq22Jgl4UBAQAAOBc12kEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAq+vZ4wPvbxZ/92UP/fin97z/8wc/M3f7k9/50i0hTM8/3pGFO84/8bXuyvGP/OzA49/8xoY1D5+s5OV68ts/qssdaz05FMKhwiODMXFiqHpnIbDlw/fs764mHhwK4e3FwM6DO9dUE98eCuHiYuC+qy85v5o4mJb4yWPv/VU18Yk08MG1r3upmrgiD3Sk3b17ddbdjrS7X1kdwnAhUOvudavrq6q1cWUe6Ezb+PvBrI0YGIxF7xrM2oiBmVhiui+Edd0hdKVV/XMlq6orrerHlayqrrSqz1dCuCKE0J1W9VhvVlV3OvJ/682qioEL3vbd5y6qJg71hrCuGPjFxw9vqCY+lQRqjf9pbwhvqb5k0sa/15M13pM2fkdPCG8OIfSmJV7szkr0piWe7A7hvEKg1vifd4ewP/CaED98dhQf3LP/pp3bZmamdi9jojdvqz9cMz0zNbb9xpkdlaRPjXQU0qcOlOOdbY790ec+u716e+Tly4baSXfn5XrmuzzRU3f30qXqfccy9T72a6BYycLzUao/5u8Nq0Lfvj1Tu8c+vW3v3t3rs7/tZp/I/nbl0WxbrV+qbdWuV7qtLi5Wsm7v9bvW7dl/09rp67ddO3Xt1A0T4+/csHHDxPjGjeuqoxrP/i7FUA+X413LPNQ3dhcqORsfABISEist0Vn36TZ+rv+XXfqiv9DRnlCZ/4AuTSuKWTrmR7kUg97cPL6Ugy5NSUojWl+aOJSyTLTOcmlpMrGQpT/LMv+9rjQ5LNbUOb9J4/3OMDbW8H+6kfq7xc3320U2b7seyTddu2kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/YwcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IFjAQAAAABh/tZh9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlwIAAP//19BHGg==")
r1 = openat(r0, &(0x7f0000000000)='file\x00', 0x42, 0x1ff)
r2 = memfd_create(&(0x7f0000000100)='memfd\x00', 0x0)
ftruncate(r2, 0x10000000)
sendfile(r1, r2, 0x0, 0x10000000)
fsync(r1)

2.38013862s ago: executing program 3 (id=11):
r0 = syz_usb_connect(0x3, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40da0b53810000010203010902270001010080fa0904000003ffffff00070581020002000705020200020007058303080008"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x3, 0x4, {0x4, 0x3, '\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x5, 0x4, "00105c00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x3, 0x4, {0x4, 0x3, '\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x5, 0x4, "00105c00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x3, 0x4, {0x4, 0x3, '\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x5, 0x4, "00105c00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x3, 0x4, {0x4, 0x3, '\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x5, 0x4, "00105c00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x3, 0x4, {0x4, 0x3, '\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x5, 0x4, "00105c00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x3, 0x4, {0x4, 0x3, '\x00\x00'}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x5, 0x4, "00105c00"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)

1.242940475s ago: executing program 4 (id=12):
syz_usb_connect(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d030100010102030109026400020100803209040000000101000009240100011e0001010c2402010102000203000000092403020101000100090401000001020000090401010101020000072401020101000b2402010202100180bb0009058101c0000100000725010100"/128], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x2}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x3}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x4}})
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc0c85512, &(0x7f0000000200)={{0x5}})

1.173803706s ago: executing program 2 (id=13):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/net/x25/route\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/100, 0x64)

794.154308ms ago: executing program 2 (id=14):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='tpm_crb_acpi\x00', 0xd)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/drivers/tpm_crb_acpi/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='pcspkr\x00', 0x7)

669.517117ms ago: executing program 2 (id=15):
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2)
write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2)
writev(r0, &(0x7f0000001000)=[{&(0x7f0000000300)="02fa", 0x2}, {&(0x7f0000000302)="0200", 0x2}, {&(0x7f0000000304)="0200", 0x2}], 0x3)
read(r0, &(0x7f0000000200)=""/50, 0x32)

135.954472ms ago: executing program 0 (id=16):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a0000001400078005"], 0x60}}, 0x0)

0s ago: executing program 0 (id=17):
syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000005140)='./file0\x00', 0x0, &(0x7f0000005180)={[{@subvol={'subvol', 0x3d, '/,compress-force=zstd:15'}}]}, 0x1, 0x50ed, &(0x7f00000051c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTsT3573JENYvrOR3E/wmHm5XUpgfKxQ6WkmPbbFHXpgfLxQ65pIemydDeHBhZX9S+H8stJPClbV54UhSOB0L+fnQLRxLCifimfb52ny6aeH7WMgvsJiPV1Cs6V4SkfS42q/HQuGGPc52Dw4AAHBPieE5z7Jjvc2QRtn52qAdVg/aYWTQDvVBO4wmO6Q79tseZnsLcXv7zMalPf//yHD5P74Vq7JFv+v/Q7z+P3+uYff6/9lYaCSF+VhopXcMaMVjZGH343iMRivvcWV9twAAAAB3tfi9QH2F5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP+zda4xc1X0A8LPP8T68XkiqEBolm6TGcROv1zaQqKXKmlI1IqVZNxRURRQbe00WL9ixTYlRiIxNRCMEpQ1S8qEIoyiq+QC1AhFJAeEixREqj4iqKIBAoTVEQaSUJCJNkEI1e++ZvXPuzsOPNV76+0neOTP/87zz8Jx775wLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPD/w8GvXPO3zeKP/va8Z1+4ePyKPWsvfvW68059MoSJmcc7snBH/423j//87nPv2fPA6jvuO3z+R3vzcnk8DFT/dOZ3boi1Hl4cwv0dIXSngRWDWaAnvz8Y63vfYAinhNlArcRkf1YibTh8vy+EfWE2UKvqe30hDBYCFz71yMM3VxO39YWwNIRQSdt4vpK10ZcGzujNAv1pYGt3FvjVW5la4LudWQCOWXwz1F70BybqMwzPXa7B66/nuHXs7ZUOrysmhhvn+9naee5UQW/6wMQxPW2l6pgXpbfHQe+2BfBuK23nWz1txS9S+TeUt2ZDldC5aXLzhqund8ZHOsPoaFejmubpeX7m9S9tPJL0gnkdxg4MH5fX4S1PLL27a/kFj9+3YunL+z+295Vj7eaPCpu0mJ5vlZC/5hbM8xiN+zxZAG+/0rekEV+6QgibP/97n2kWL83/h5vP/+PLOd521uWOtb45lM3N4yODMfHaUDY3BwAAgAVjIew13Tr60Cea1Vea/4+0d/w/HvLPJ/PZaA+GMD6T2LskhNNmHs8Cd8XmLlsSwgdnUhP1gbVJ4GAI751JLK9VlZRYFEuMJIGfDOWB8SRwKAYmksC3YuDWJHBDDBxIAhtj4GASODcGwlT9OH5/KB9H24G+GFifbcQD8SyEXwzF1pJt9VytKgAAgOMknx321N8tnOtwrBni9PJAX6sM8QzshhkqSQ3pDLY2rWpYQ3erGjpb1VAb9+7mwy/V3NGq5tJpGB31GW7/5d98NjRRmv+PNZ//V+boSEfp+H8I62b+xtydeWS6Fl8/UZcBAAAAOAYD//viN5vFS/P/8fbO/4/7RLoKmcNjcTfEliUhjNUHsmr/sBzIjnoP5AEAAABYCGrH42vHwqfy2+wU7XQ+Xc4/cYT544H/8Tnz9x58cH2z/pbm/xPtnf/fX3+bdeJQ7MXXloSwqBD4QexlNTBjJAZ+/Mn6QD7+Q3ED3BSryk9MqFV1UyyxPgbGksC+RiV+WCtxWn0gf7Jqje+tjWMqL1EIAAAAwAkXdwfE4/Lx/P8P/Wb1Nc3Kleb/64/s/P+ZeXDp9P7pgRBWdofQlf4w4LH+bGHAGBjsyBMP9Wd1daVVXd8fwjnVgaVVvZiv/9+drjH4VF9WVQyc9qH9r59RTXyzL4SVxcDTn7vzrGpiZxKoNf6XfSF8oDratPHvLMoa70kb//qiEN5fCNSqumxRCNXGetOqHqnk1zFIq/rnSgjvKgRqVZ1dCWFXAGCBiv+Vbio+uGPXtVs2TE9Pbp/HRNyH3xc2T01Pjm7cOr2p0qBPm5I+1y1jdH15TO1e+ea5fImii+5dN9hOuvY7wbFiW/l+/NKJg/n9+F2oZ2acq3vq7q5Jh/yRD5ebCIVvUo2G3DnPQ+4vVjL7JJbqj/l7w0BYdPWOye2jX9ywc+f2VdnfdrOvzv7Gw0zZtlqVbqv+ufrWxsuj4WpZiaPdVsuKlazceeW2lTt2Xbti6soNl09ePnnVqrNXj505tmbs42eurI5qLPvbYqjL5qo6Gepbd7Y5ruM41NO7C5WciE8NCQmJhZbYOrCs6f/Jpfn/tubz//ipEz/58/UZGh3/H46H+bPHZw/zr4+Bfe0e/x9udDS/dmLASBLYHQO7HeYHAADgnSFO8uPezLhX+qfLv/Nys3Kl+f/u9n7/f5zW/68tXX9+o2X+l8cSY43W/0+X+a+t/7+70fr/6TL/tfX/970N6/9fXQskm+QX1v8HAADeCU7c+v8tl/dPLxBQytByef/0AgGlDC2X8W/3AgFHvP7/8//5V/8dmijN/29tb/5v4X4AAAA4eXz5z675nWbx0vx/X3vz/xO//l9odP7/SKPARKOFAa3/BwAAwALVaP2/4Rv7L21WrjT/P9De/D+edtFZlzvW+uZQtqZdSNe0e22o9pMBAAAAWBg6w+hoT5t561ZGXXv0bT6TLwXaLF304p8cPrLz/w+2N/+v+13GLU8svbtr+QWPv3nfiqUv7//Y3ldmj/8DAAAA86fd/RIAAAAAAAAAAAAAAMDb78X/2LOmWbz0+/+wbubxRr//j9f9i78veHdd7lhr6/X/8vsXfvqeXTNLFj42FMKHi4Ete7acEvJr8y8rBh6+ZPl7qok9aYkHXzj3pWri0jTwqRWnvlFNnJME1sdFEt+bBuJVFd9YnATi8or/ngbi9jiQBnrzwFcXZ+PoSLfVTwezbdWRbqtnB0NYUgjUttX9g1kbHekAb0sCtQF+IQ3EAf55HuhMe3XPQNarGBiMRe8YyHoFAMBJK34L7Ambp6Ynx+JX+Hh7enf9bVS3ZNn15Wo72mz+uXxpsovuXTfYTror/S46e63xnlCpDmFV6etqMUvHzCiPTy0tNt27Gwy51WpvnQ3KpY500/U2HlFfNqLRjVunN/W0HPia1llWd7fMsqo02Slm6ZzZpG3U0kZf2hhRm9umjS7H+51hdLQryfUHMTgc6rR6RbT7e/3iOn+NXgXFPFcd3vurZvWV5v/D7c3/K8VxvZFfDGB3vLLe3y2xzD8AAADMr6+u/fU34r/P3vjo083ylub/I+3N/+MerPxQcLa342C8/v/eJSHMXFp/OAvcFZu7bEkIH5xJTcQS2QX1z48lxrLAXXGHyfJYYv1EfVWLYuBAEvjJUB44mAQOxUC+l2J/yHfl/P1QCGfNpNbVl9gWSwwngc/EwEgSGI2BsSSwOAbGk8Cri/PARBL4txgIU/Xb6t7F+bYCAAA4Evk8q6f+bkjneQe6W2XoaJWhv1WGzlYZKq0yNBpFvP/tmKEnOXmlo5CpJ621L6mllCFeDP+I+1XKEH5YnzMtWGo6nn9QO9+goz7DA5/oroQmSvP/sfbm//31t1nrh+L8f/b6f1ngB7F7X4unjo/EwI8/WR/IdwwcipPdm2pVTeQl8kn7TbHEeAyMJIFtMTCeBNavywP73lMfyGfatcb31hqfyksUAgAAAHDCxR0EcTdNnP/fseMrA83Kleb/4+3N/2N7A8XGboi1Hl4cwv0ds72pBVYMZoG4H2Mw/jz+fYMhnFLYwVErMdmflehNGg7f78t+od6bVvW9vuzHB/H+hU898vDN1cRtfSEsLex9qbXxfCVroy8NnNGbBfrTwNbuLBD3/NQC3+3MAnDMansF4wsqP9WlZnjucg1ef++Ua4KmwyvtA50j31y/uZovpR2u+T7VmiN72pruv+W4Kb09Dnq3LcR327B3W/GLVP4N5a3ZUCV0bprcvOHq6Z3xkeIvWUvm6Xku/kq1nfRxeB3uPvretlZJOzCWfHyMzV1u7tdhR6zulieW3t21/ILH71ux9OX9H9v7StvdaCD+UPiR6/518EeFzTvfKiF/zS24z5MJnycL8b+BEU9bCGHdq1+/qVm8NP+faG/+353czvh13Jg7loTwkcLGfSxu/j9ekn0OFgLZp+S7yoHskPt/DTX85AQAAIDjrba7o7a/YCq/zU4IT+fJ5fwTR5g/7q8YnzN/u/3u/+tLljaLl+b/65vP/xcl3XT83/F/5onj/3M62XdFL0of2H1Mu6JL1TEvHP+f08n+bnP8f06O/zv+PxfH/1tw/H9OJ/vTVvqWtM2XrhDCy3/00LPN4qX5/7b25v/W/5t70b7a+n/rG63/t63R+n+7rf8HAADMqwYLzaXzvNLqfaUM6ep9pQwtFwhsucSg9f+OeP2/l05//jehidL8f3d78//4chgotr5Q1v8bWdegqltjYJuFAQEAADgZNdpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNvrgX/4n03N4o/+9rxnX7h4/Io9ay9+9brzTn0yhKmZxzuycEf/jbeP//zuc+/Z88DqO+47fP5HK3m5nvz2d+tyx1rfHAphX+GRwZh4bah6ZzZw4afv2dVdTTw2FMKHi4Ete7acUk18ayiEZcXAw5csf081sSct8eAL575UTVyaBj614tQ3qolz8kBH2t1/XJx1tyPt7s2LQ1hSCNS6e8Xi+qpqbfxpHuhM2/inwayNGBiMRb8xmLURA9OxxNSiEFZ2h9CVVvVoJauqK63qXypZVV1pVV+uhHBOCKE7reqF3qyq7nTkT/ZmVcXAaR/a//oZ1cS+3hBWFgNPf+7Os6qJLySBWuN/0RvCB6ovmbTxb/dkjfekjd/WE8L7Qwi9aYlfdmcletMSL3aH8K5CoNb457tD2BV4R4gfPnWfaDt2Xbtlw/T05PZ5TPTmbfWFzVPTk6Mbt05vqiR9aqSjkH7r+qMf+3Ovf2lj9faie9cNtpPuzsv1zHR5dU/d3TUne+9jv/qLlcw+H6X6Y/7eMBAWXb1jcvvoFzfs3Ll9Vfa33eyrs79deTTbVqsWyrZaVqxk5c4rt63csevaFVNXbrh88vLJq1advXrszLE1Yx8/c2V1VGPZ3+Mx1DtP/FBP7y5UciI+ACQkJBZaorPu023sZP8gL33Rn+1oT6jMfECXphXFLB0zozweg157lCM+mu8pLUe0qjRxKGVZ3TrLmtJkYjZLX5Zl5ntdaXJYrKlzZpPG+51hdLSr0XYYrr9b3Lw/O4bN+0y+6dpNAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwf+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwLAAAAAAgzN86jJ4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALgUAAD//wNUIwc=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0/test\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000500), 0x50000)
fsync(r0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.0.172' (ED25519) to the list of known hosts.
[   83.618171][ T5607] cgroup: Unknown subsys name 'net'
[   83.716771][ T5607] cgroup: Unknown subsys name 'cpuset'
[   83.726897][ T5607] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   85.382200][ T5607] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   88.069213][ T5626] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   88.080095][ T5629] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   88.088523][ T5630] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   88.099656][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   88.107674][ T5629] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   88.116493][ T5629] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   88.126642][ T5629] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   88.135712][ T5629] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   88.142885][ T5640] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   88.144024][ T5629] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   88.159032][ T5629] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   88.166359][ T5640] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   88.167042][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   88.174161][ T5640] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   88.181021][ T5629] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   88.189658][ T5640] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   88.195973][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   88.208550][ T5640] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   88.212770][ T5629] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   88.219741][ T5644] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   88.224681][ T5629] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   88.231413][ T5644] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   88.240662][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   88.244521][ T5640] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   88.257849][ T5644] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   88.263058][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   88.272512][ T5640] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   88.280055][ T5640] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   88.289984][ T4938] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   88.297665][ T5640] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   90.313577][ T5640] Bluetooth: hci1: command tx timeout
[   90.315713][ T5626] Bluetooth: hci0: command tx timeout
[   90.391564][ T5626] Bluetooth: hci5: command tx timeout
[   90.393046][ T5633] Bluetooth: hci4: command tx timeout
[   90.397503][ T5626] Bluetooth: hci3: command tx timeout
[   90.403459][ T5640] Bluetooth: hci2: command tx timeout
[   91.033508][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state
[   91.041045][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.048680][ T5620] bridge_slave_0: entered allmulticast mode
[   91.057411][ T5620] bridge_slave_0: entered promiscuous mode
[   91.081156][ T5634] bridge0: port 1(bridge_slave_0) entered blocking state
[   91.089393][ T5634] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.097011][ T5634] bridge_slave_0: entered allmulticast mode
[   91.105800][ T5634] bridge_slave_0: entered promiscuous mode
[   91.156219][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state
[   91.164691][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.171947][ T5623] bridge_slave_0: entered allmulticast mode
[   91.179459][ T5623] bridge_slave_0: entered promiscuous mode
[   91.187193][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state
[   91.195119][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.200411][  T803] cfg80211: failed to load regulatory.db
[   91.202373][ T5620] bridge_slave_1: entered allmulticast mode
[   91.216255][ T5620] bridge_slave_1: entered promiscuous mode
[   91.235619][ T5634] bridge0: port 2(bridge_slave_1) entered blocking state
[   91.242822][ T5634] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.250004][ T5634] bridge_slave_1: entered allmulticast mode
[   91.257838][ T5634] bridge_slave_1: entered promiscuous mode
[   91.302859][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state
[   91.310151][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.317701][ T5623] bridge_slave_1: entered allmulticast mode
[   91.325999][ T5623] bridge_slave_1: entered promiscuous mode
[   91.359409][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state
[   91.366605][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.373834][ T5635] bridge_slave_0: entered allmulticast mode
[   91.381364][ T5635] bridge_slave_0: entered promiscuous mode
[   91.466001][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state
[   91.473538][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.480684][ T5635] bridge_slave_1: entered allmulticast mode
[   91.488385][ T5635] bridge_slave_1: entered promiscuous mode
[   91.498889][ T5634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   91.508150][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state
[   91.515844][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.523154][ T5624] bridge_slave_0: entered allmulticast mode
[   91.530776][ T5624] bridge_slave_0: entered promiscuous mode
[   91.539391][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state
[   91.547436][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.554681][ T5621] bridge_slave_0: entered allmulticast mode
[   91.562515][ T5621] bridge_slave_0: entered promiscuous mode
[   91.573493][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   91.586391][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   91.611879][ T5634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.621116][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state
[   91.628627][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.635890][ T5624] bridge_slave_1: entered allmulticast mode
[   91.643501][ T5624] bridge_slave_1: entered promiscuous mode
[   91.650526][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state
[   91.657839][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.665664][ T5621] bridge_slave_1: entered allmulticast mode
[   91.673637][ T5621] bridge_slave_1: entered promiscuous mode
[   91.683246][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.695187][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.789203][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   91.868050][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.879542][ T5634] team0: Port device team_slave_0 added
[   91.888656][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   91.901175][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   91.913193][ T5623] team0: Port device team_slave_0 added
[   91.921034][ T5620] team0: Port device team_slave_0 added
[   91.941196][ T5634] team0: Port device team_slave_1 added
[   91.949894][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.961924][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.973563][ T5623] team0: Port device team_slave_1 added
[   91.981231][ T5620] team0: Port device team_slave_1 added
[   92.065482][ T5635] team0: Port device team_slave_0 added
[   92.139159][ T5635] team0: Port device team_slave_1 added
[   92.146143][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.153296][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.179542][ T5634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.193938][ T5624] team0: Port device team_slave_0 added
[   92.202112][ T5621] team0: Port device team_slave_0 added
[   92.208441][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.215901][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.242227][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.254365][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.261381][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.287999][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.325998][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.333149][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.359467][ T5634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.372987][ T5624] team0: Port device team_slave_1 added
[   92.380709][ T5621] team0: Port device team_slave_1 added
[   92.387426][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.391744][ T5640] Bluetooth: hci0: command tx timeout
[   92.394995][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.399932][ T5626] Bluetooth: hci1: command tx timeout
[   92.426729][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.443111][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.450071][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.476022][ T5626] Bluetooth: hci3: command tx timeout
[   92.476067][ T5626] Bluetooth: hci2: command tx timeout
[   92.476100][ T5626] Bluetooth: hci4: command tx timeout
[   92.481550][ T5640] Bluetooth: hci5: command tx timeout
[   92.498851][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.523254][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.530229][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.556894][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.625378][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.632791][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.659478][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.699062][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.706069][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.732202][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.746113][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.753392][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.779390][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.802112][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.809050][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.835545][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.919920][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.927268][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.953320][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.980603][ T5623] hsr_slave_0: entered promiscuous mode
[   92.987392][ T5623] hsr_slave_1: entered promiscuous mode
[   93.014557][ T5620] hsr_slave_0: entered promiscuous mode
[   93.021223][ T5620] hsr_slave_1: entered promiscuous mode
[   93.027650][ T5620] debugfs: 'hsr0' already exists in 'hsr'
[   93.033447][ T5620] Cannot create hsr debugfs directory
[   93.059460][ T5634] hsr_slave_0: entered promiscuous mode
[   93.066170][ T5634] hsr_slave_1: entered promiscuous mode
[   93.072533][ T5634] debugfs: 'hsr0' already exists in 'hsr'
[   93.078252][ T5634] Cannot create hsr debugfs directory
[   93.175474][ T5624] hsr_slave_0: entered promiscuous mode
[   93.182061][ T5624] hsr_slave_1: entered promiscuous mode
[   93.188244][ T5624] debugfs: 'hsr0' already exists in 'hsr'
[   93.194442][ T5624] Cannot create hsr debugfs directory
[   93.207141][ T5635] hsr_slave_0: entered promiscuous mode
[   93.213753][ T5635] hsr_slave_1: entered promiscuous mode
[   93.219954][ T5635] debugfs: 'hsr0' already exists in 'hsr'
[   93.225840][ T5635] Cannot create hsr debugfs directory
[   93.273297][ T5621] hsr_slave_0: entered promiscuous mode
[   93.279819][ T5621] hsr_slave_1: entered promiscuous mode
[   93.286164][ T5621] debugfs: 'hsr0' already exists in 'hsr'
[   93.291929][ T5621] Cannot create hsr debugfs directory
[   94.054071][ T5634] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   94.071235][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   94.079577][ T5634] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   94.091314][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   94.100911][ T5634] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   94.112411][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   94.120593][ T5634] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   94.131285][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   94.213449][ T5620] netdevsim netdevsim4 netdevsim0: renamed from eth0
[   94.226069][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   94.235734][ T5620] netdevsim netdevsim4 netdevsim1: renamed from eth1
[   94.245768][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   94.254914][ T5620] netdevsim netdevsim4 netdevsim2: renamed from eth2
[   94.264917][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   94.276125][ T5620] netdevsim netdevsim4 netdevsim3: renamed from eth3
[   94.286445][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   94.376968][ T5623] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   94.387270][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   94.407519][ T5623] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   94.419120][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   94.432677][ T5623] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   94.445089][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   94.467780][ T5623] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   94.472178][ T5640] Bluetooth: hci1: command tx timeout
[   94.474842][ T5633] Bluetooth: hci0: command tx timeout
[   94.489471][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   94.551990][ T5633] Bluetooth: hci4: command tx timeout
[   94.552219][ T5640] Bluetooth: hci2: command tx timeout
[   94.557780][ T5633] Bluetooth: hci5: command tx timeout
[   94.563535][ T5626] Bluetooth: hci3: command tx timeout
[   94.598868][ T5624] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   94.609289][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   94.617718][ T5624] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   94.628873][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   94.657115][ T5624] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   94.668615][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   94.696573][ T5624] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   94.707892][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   94.730055][ T5634] 8021q: adding VLAN 0 to HW filter on device bond0
[   94.842320][ T5621] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   94.856106][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   94.880282][ T5621] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   94.892423][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   94.900584][ T5621] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   94.910983][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   94.920176][ T5621] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   94.930309][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   94.948558][ T5634] 8021q: adding VLAN 0 to HW filter on device team0
[   94.997018][  T537] bridge0: port 1(bridge_slave_0) entered blocking state
[   95.004455][  T537] bridge0: port 1(bridge_slave_0) entered forwarding state
[   95.045389][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[   95.052606][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[   95.107247][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0
[   95.137553][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0
[   95.184941][ T5620] 8021q: adding VLAN 0 to HW filter on device team0
[   95.201405][ T5635] netdevsim netdevsim5 netdevsim0: renamed from eth0
[   95.212202][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   95.232128][ T5635] netdevsim netdevsim5 netdevsim1: renamed from eth1
[   95.243455][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   95.265980][ T5635] netdevsim netdevsim5 netdevsim2: renamed from eth2
[   95.277016][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   95.285371][ T5635] netdevsim netdevsim5 netdevsim3: renamed from eth3
[   95.297922][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   95.311779][ T1012] bridge0: port 1(bridge_slave_0) entered blocking state
[   95.318919][ T1012] bridge0: port 1(bridge_slave_0) entered forwarding state
[   95.330823][ T5623] 8021q: adding VLAN 0 to HW filter on device team0
[   95.370786][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   95.377939][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   95.413759][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   95.420916][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   95.433857][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   95.441002][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   95.507052][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0
[   95.609521][ T5624] 8021q: adding VLAN 0 to HW filter on device team0
[   95.683298][   T13] bridge0: port 1(bridge_slave_0) entered blocking state
[   95.690499][   T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[   95.702358][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[   95.709513][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[   95.783754][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0
[   95.939937][ T5621] 8021q: adding VLAN 0 to HW filter on device team0
[   96.007548][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0
[   96.021796][ T3288] bridge0: port 1(bridge_slave_0) entered blocking state
[   96.028958][ T3288] bridge0: port 1(bridge_slave_0) entered forwarding state
[   96.055656][ T3288] bridge0: port 2(bridge_slave_1) entered blocking state
[   96.062849][ T3288] bridge0: port 2(bridge_slave_1) entered forwarding state
[   96.209846][ T5635] 8021q: adding VLAN 0 to HW filter on device team0
[   96.262955][ T3288] bridge0: port 1(bridge_slave_0) entered blocking state
[   96.270159][ T3288] bridge0: port 1(bridge_slave_0) entered forwarding state
[   96.377286][ T3288] bridge0: port 2(bridge_slave_1) entered blocking state
[   96.384505][ T3288] bridge0: port 2(bridge_slave_1) entered forwarding state
[   96.552483][ T5640] Bluetooth: hci1: command tx timeout
[   96.552571][ T5626] Bluetooth: hci0: command tx timeout
[   96.633153][ T5626] Bluetooth: hci2: command tx timeout
[   96.634029][ T5633] Bluetooth: hci5: command tx timeout
[   96.638632][ T5626] Bluetooth: hci4: command tx timeout
[   96.644266][ T5640] Bluetooth: hci3: command tx timeout
[   96.660465][ T5635] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   96.756921][ T5634] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.044262][ T5634] veth0_vlan: entered promiscuous mode
[   97.095315][ T5634] veth1_vlan: entered promiscuous mode
[   97.260715][ T5634] veth0_macvtap: entered promiscuous mode
[   97.308580][ T5634] veth1_macvtap: entered promiscuous mode
[   97.428758][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_0
[   97.486620][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_1
[   97.546840][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.580641][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.592048][   T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   97.742696][  T537] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   97.964167][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0
[   97.977902][ T5623] veth0_vlan: entered promiscuous mode
[   98.047451][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.064389][ T5623] veth1_vlan: entered promiscuous mode
[   98.078576][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.141852][   T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   98.248109][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0
[   98.267233][ T1012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.303543][ T1012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.353779][  T537] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   98.378552][ T5624] veth0_vlan: entered promiscuous mode
[   98.444731][ T5634] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   98.464787][ T5624] veth1_vlan: entered promiscuous mode
[   98.485114][ T5623] veth0_macvtap: entered promiscuous mode
[   98.512296][ T5623] veth1_macvtap: entered promiscuous mode
[   98.534576][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0
[   98.704665][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0
[   98.729146][ T5621] veth0_vlan: entered promiscuous mode
[   98.740771][ T5624] veth0_macvtap: entered promiscuous mode
[   98.800193][ T5624] veth1_macvtap: entered promiscuous mode
[   98.828363][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1
[   98.855142][ T5621] veth1_vlan: entered promiscuous mode
[   98.870467][ T5620] veth0_vlan: entered promiscuous mode
[   98.911854][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   98.929048][ T5620] veth1_vlan: entered promiscuous mode
[   98.955203][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0
[   98.982926][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1
[   99.014256][   T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   99.085712][ T5621] veth0_macvtap: entered promiscuous mode
[   99.123400][  T142] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   99.135988][  T185] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   99.155845][ T1012] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   99.170882][ T5621] veth1_macvtap: entered promiscuous mode
[   99.239484][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.255943][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.275788][ T5620] veth0_macvtap: entered promiscuous mode
[   99.301345][  T185] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1c03, bcdDevice= 0.00
[   99.314593][  T185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   99.339205][  T185] usb 4-1: config 0 descriptor??
[   99.339629][  T142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.352574][ T5620] veth1_macvtap: entered promiscuous mode
[   99.361833][   T48] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   99.382421][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0
[   99.387198][  T142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.396819][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1
[   99.440580][ T5635] veth0_vlan: entered promiscuous mode
[   99.444945][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.454319][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.525672][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0
[   99.549791][ T5635] veth1_vlan: entered promiscuous mode
[   99.562836][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1
[   99.571607][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.579273][   T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   99.594597][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.783769][ T1012] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   99.810270][ T1012] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   99.883467][  T185] corsair-psu 0003:1B1C:1C03.0001: hidraw0: USB HID v0.00 Device [HID 1b1c:1c03] on usb-dummy_hcd.3-1/input0
[   99.982821][  T185] corsair-psu 0003:1B1C:1C03.0001: unable to initialize device (-38)
[   99.995987][ T5866] loop2: detected capacity change from 0 to 1024
[  100.003254][ T1012] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  100.026686][ T5635] veth0_macvtap: entered promiscuous mode
[  100.044859][  T142] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  100.078490][  T142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  100.087366][  T185] corsair-psu 0003:1B1C:1C03.0001: probe with driver corsair-psu failed with error -38
[  100.101387][ T5799] psmouse serio2: Failed to reset mouse on : -5
[  100.118355][  T142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  100.155501][  T142] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  100.177633][ T5866] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  100.219272][ T5635] veth1_macvtap: entered promiscuous mode
[  100.288677][ T5866] EXT4-fs warning (device loop2): ext4_resize_fs:2018: can't read last block, resize aborted
[  100.330704][  T142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  100.343424][  T142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  100.350090][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0
[  100.397138][ T5624] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  100.408601][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1
[  100.448597][ T1119] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  100.473481][ T1119] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  100.572069][ T5874] loop0: detected capacity change from 0 to 8
[  100.577918][   T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  100.587812][   T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  100.607323][ T5874] loop1: detected capacity change from 0 to 8
[  100.623183][  T142] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  100.679648][ T5874] loop2: detected capacity change from 0 to 8
[  100.688498][   T48] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  100.868368][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  100.889684][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  100.941801][ T1012] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  100.973123][ T1012] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  101.051976][   T48] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  101.061254][   T48] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  101.076224][   T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.095990][   T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.171840][  T185] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  101.206768][ T1012] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  101.223723][   T10] usb 5-1: new full-speed USB device number 2 using dummy_hcd
[  101.262622][   T36] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  101.345009][  T185] usb 1-1: New USB device found, idVendor=1164, idProduct=0622, bcdDevice= 0.00
[  101.356696][   T36] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  101.378963][  T185] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  101.481135][  T185] pvrusb2: Hardware description: Gotview USB 2.0 DVD 2
[  101.570095][   T30] audit: type=1800 audit(1785876886.202:2): pid=5881 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.6" name="streaming_maxpacket" dev="configfs" ino=8775 res=0 errno=0
[  101.574767][ T5881] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind()
[  101.601021][ T5881] configfs-gadget.g1 gadget.1: uvc: Unable to allocate streaming EP
[  101.611142][ T5881] udc dummy_udc.1: failed to start g1: -22
[  101.646231][   T30] audit: type=1800 audit(1785876886.212:3): pid=5881 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.6" name="UDC" dev="configfs" ino=8777 res=0 errno=0
[  101.646609][ T5881] configfs-gadget.g1 gadget.1: probe with driver configfs-gadget.g1 failed with error -22
[  101.706865][ T5881] UDC core: g1: couldn't find an available UDC or it's busy
[  101.927507][    T9] usb 4-1: USB disconnect, device number 2
[  102.313976][   T29] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[  102.383649][    T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  102.449840][   T10] usb 5-1: unable to read config index 0 descriptor/start: -71
[  102.464160][   T10] usb 5-1: can't read configurations, error -71
[  102.474413][ T5889] loop2: detected capacity change from 0 to 32768
[  102.497857][   T29] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  102.509549][ T5889] BTRFS: device fsid 3d39d0ba-bdae-447e-827b-b091e1a68885 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.10 (5889)
[  102.521752][   T29] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[  102.549152][   T29] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
[  102.571657][    T9] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice= 0.00
[  102.578407][   T29] usb 6-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
[  102.590784][   T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  102.599545][   T29] usb 6-1: Product: syz
[  102.602859][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  102.619597][ T5889] BTRFS info (device loop2): first mount of filesystem 3d39d0ba-bdae-447e-827b-b091e1a68885
[  102.633232][   T29] usb 6-1: Manufacturer: syz
[  102.635338][    T9] usb 4-1: Product: syz
[  102.645090][   T29] usb 6-1: SerialNumber: syz
[  102.657192][ T5889] BTRFS info (device loop2): using crc32c checksum algorithm
[  102.659734][    T9] usb 4-1: Manufacturer: syz
[  102.668600][ T5886] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  102.690073][ T5886] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  102.698231][    T9] usb 4-1: SerialNumber: syz
[  102.720775][ T5886] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  102.752970][    T9] r8152-cfgselector 4-1: Unknown version 0x0000
[  102.878799][ T5889] BTRFS info (device loop2): enabling ssd optimizations
[  102.900606][ T5889] BTRFS info (device loop2): turning on async discard
[  102.925135][ T5889] BTRFS info (device loop2): enabling free space tree
[  102.988768][    T9] r8152-cfgselector 4-1: Unknown version 0x0050
[  103.061914][ T5799] misc userio: Buffer overflowed, userio client isn't keeping up
[  103.269910][ T5624] BTRFS info (device loop2): last unmount of filesystem 3d39d0ba-bdae-447e-827b-b091e1a68885
[  103.512960][   T10] usb 5-1: new full-speed USB device number 3 using dummy_hcd
[  103.674647][   T10] usb 5-1: not running at top speed; connect to a high speed hub
[  103.696716][   T10] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 1.00
[  103.721616][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  103.735553][   T10] usb 5-1: Product: syz
[  103.741563][   T10] usb 5-1: Manufacturer: syz
[  103.746287][   T10] usb 5-1: SerialNumber: syz
[  103.979852][   T29] redrat3 6-1:1.0: Problem fetching firmware ID
[  104.001262][   T29] redrat3 6-1:1.0: Failed to read timeout from hardware
[  104.102945][   T29] rc_core: IR keymap rc-hauppauge not found
[  104.109705][   T29] Registered IR keymap rc-empty
[  104.114244][ T2363] pvrusb2: Failed to submit write-control URB status=-2
[  104.120749][   T29] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/rc/rc0
[  104.141253][ T2363] pvrusb2: Device being rendered inoperable
[  104.165446][  T185] usb 1-1: USB disconnect, device number 2
[  104.167439][   T29] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/rc/rc0/input7
[  104.180001][ T2363] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  104.217424][ T2363] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  104.247511][   T29] redrat3 6-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[  104.264232][   T29] redrat3 6-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
[  104.286634][   T29] redrat3 6-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
[  104.305791][   T29] redrat3 6-1:1.0: probe with driver redrat3 failed with error -5
[  104.348508][   T29] usb 6-1: USB disconnect, device number 2
[  104.386101][ T4988] ==================================================================
[  104.394223][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  104.401204][ T4988] Read of size 1 at addr ffff888036950758 by task udevd/4988
[  104.408584][ T4988] 
[  104.410916][ T4988] CPU: 1 UID: 0 PID: 4988 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  104.410961][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  104.410985][ T4988] Call Trace:
[  104.410997][ T4988]  <TASK>
[  104.411011][ T4988]  dump_stack_lvl+0x100/0x190
[  104.411055][ T4988]  print_report+0x13d/0x4b0
[  104.411111][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.411158][ T4988]  ? __virt_addr_valid+0x239/0x430
[  104.411205][ T4988]  ? string+0x471/0x4d0
[  104.411248][ T4988]  kasan_report+0xdf/0x1c0
[  104.411291][ T4988]  ? string+0x471/0x4d0
[  104.411339][ T4988]  string+0x471/0x4d0
[  104.411383][ T4988]  ? __pfx_string+0x10/0x10
[  104.411433][ T4988]  vsnprintf+0x422/0x1300
[  104.411488][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  104.411541][ T4988]  ? ksys_read+0x12a/0x250
[  104.411587][ T4988]  ? do_syscall_64+0x115/0x870
[  104.411637][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  104.411681][ T4988]  add_uevent_var+0x183/0x3a0
[  104.411724][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  104.411775][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  104.411811][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  104.411845][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  104.411883][ T4988]  dev_uevent+0x2f1/0x870
[  104.411920][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  104.411953][ T4988]  ? kasan_save_track+0x14/0x30
[  104.412013][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.412061][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  104.412120][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.412167][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  104.412220][ T4988]  ? uevent_show+0x166/0x3a0
[  104.412271][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  104.412319][ T4988]  uevent_show+0x1ca/0x3a0
[  104.412368][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.412417][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  104.412464][ T4988]  dev_attr_show+0x52/0xa0
[  104.412526][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  104.412592][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  104.412647][ T4988]  seq_read_iter+0x32f/0x1270
[  104.412698][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.412774][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  104.412817][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.412863][ T4988]  ? rw_verify_area+0xce/0x6d0
[  104.412904][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  104.412949][ T4988]  vfs_read+0x82e/0xb40
[  104.412998][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  104.413043][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.413092][ T4988]  ? find_held_lock+0x2b/0x80
[  104.413149][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  104.413214][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  104.413282][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.413327][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  104.413392][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.413439][ T4988]  ? find_held_lock+0x2b/0x80
[  104.413499][ T4988]  ksys_read+0x12a/0x250
[  104.413551][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  104.413599][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.413647][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  104.413697][ T4988]  do_syscall_64+0x115/0x870
[  104.413756][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  104.413796][ T4988] RIP: 0033:0x7f8363aa7407
[  104.413825][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  104.413862][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  104.413898][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  104.413924][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  104.413949][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  104.413972][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  104.413996][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  104.414033][ T4988]  </TASK>
[  104.414045][ T4988] 
[  104.796063][ T4988] Allocated by task 29:
[  104.800210][ T4988]  kasan_save_stack+0x30/0x50
[  104.804922][ T4988]  kasan_save_track+0x14/0x30
[  104.809632][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  104.814250][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  104.819643][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  104.824670][ T4988]  usb_probe_interface+0x303/0x8f0
[  104.829811][ T4988]  really_probe+0x241/0xa60
[  104.834336][ T4988]  __driver_probe_device+0x20e/0x450
[  104.839654][ T4988]  driver_probe_device+0x4a/0x140
[  104.844703][ T4988]  __device_attach_driver+0x1df/0x320
[  104.850095][ T4988]  bus_for_each_drv+0x159/0x1e0
[  104.854959][ T4988]  __device_attach+0x1e4/0x4d0
[  104.859743][ T4988]  device_initial_probe+0xaf/0xd0
[  104.864792][ T4988]  bus_probe_device+0x64/0x160
[  104.869570][ T4988]  device_add+0x121d/0x1970
[  104.874105][ T4988]  usb_set_configuration+0xd97/0x1c60
[  104.879499][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  104.884887][ T4988]  usb_probe_device+0xef/0x400
[  104.889675][ T4988]  really_probe+0x241/0xa60
[  104.894204][ T4988]  __driver_probe_device+0x20e/0x450
[  104.899513][ T4988]  driver_probe_device+0x4a/0x140
[  104.904566][ T4988]  __device_attach_driver+0x1df/0x320
[  104.909961][ T4988]  bus_for_each_drv+0x159/0x1e0
[  104.914820][ T4988]  __device_attach+0x1e4/0x4d0
[  104.919604][ T4988]  device_initial_probe+0xaf/0xd0
[  104.924655][ T4988]  bus_probe_device+0x64/0x160
[  104.929439][ T4988]  device_add+0x121d/0x1970
[  104.933969][ T4988]  usb_new_device.cold+0x685/0x115c
[  104.939181][ T4988]  hub_event+0x30a3/0x4a60
[  104.943621][ T4988]  process_one_work+0xa23/0x1940
[  104.948569][ T4988]  worker_thread+0x5ef/0xe50
[  104.953165][ T4988]  kthread+0x370/0x450
[  104.957258][ T4988]  ret_from_fork+0x72b/0xd50
[  104.961864][ T4988]  ret_from_fork_asm+0x1a/0x30
[  104.966659][ T4988] 
[  104.968974][ T4988] Freed by task 29:
[  104.972771][ T4988]  kasan_save_stack+0x30/0x50
[  104.977480][ T4988]  kasan_save_track+0x14/0x30
[  104.982191][ T4988]  kasan_save_free_info+0x3b/0x70
[  104.987231][ T4988]  __kasan_slab_free+0x5f/0x80
[  104.991998][ T4988]  kfree+0x22b/0x6c0
[  104.995915][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  105.001033][ T4988]  usb_probe_interface+0x303/0x8f0
[  105.006172][ T4988]  really_probe+0x241/0xa60
[  105.010694][ T4988]  __driver_probe_device+0x20e/0x450
[  105.016002][ T4988]  driver_probe_device+0x4a/0x140
[  105.021050][ T4988]  __device_attach_driver+0x1df/0x320
[  105.026447][ T4988]  bus_for_each_drv+0x159/0x1e0
[  105.031305][ T4988]  __device_attach+0x1e4/0x4d0
[  105.036089][ T4988]  device_initial_probe+0xaf/0xd0
[  105.041139][ T4988]  bus_probe_device+0x64/0x160
[  105.045917][ T4988]  device_add+0x121d/0x1970
[  105.050450][ T4988]  usb_set_configuration+0xd97/0x1c60
[  105.055843][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  105.061230][ T4988]  usb_probe_device+0xef/0x400
[  105.066104][ T4988]  really_probe+0x241/0xa60
[  105.070624][ T4988]  __driver_probe_device+0x20e/0x450
[  105.075933][ T4988]  driver_probe_device+0x4a/0x140
[  105.080983][ T4988]  __device_attach_driver+0x1df/0x320
[  105.086410][ T4988]  bus_for_each_drv+0x159/0x1e0
[  105.091273][ T4988]  __device_attach+0x1e4/0x4d0
[  105.096060][ T4988]  device_initial_probe+0xaf/0xd0
[  105.101116][ T4988]  bus_probe_device+0x64/0x160
[  105.105894][ T4988]  device_add+0x121d/0x1970
[  105.110426][ T4988]  usb_new_device.cold+0x685/0x115c
[  105.115639][ T4988]  hub_event+0x30a3/0x4a60
[  105.120078][ T4988]  process_one_work+0xa23/0x1940
[  105.125023][ T4988]  worker_thread+0x5ef/0xe50
[  105.129619][ T4988]  kthread+0x370/0x450
[  105.133714][ T4988]  ret_from_fork+0x72b/0xd50
[  105.138332][ T4988]  ret_from_fork_asm+0x1a/0x30
[  105.143122][ T4988] 
[  105.145436][ T4988] The buggy address belongs to the object at ffff888036950000
[  105.145436][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  105.159488][ T4988] The buggy address is located 1880 bytes inside of
[  105.159488][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  105.173471][ T4988] 
[  105.175790][ T4988] The buggy address belongs to the physical page:
[  105.182192][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  105.190954][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  105.199455][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  105.207005][ T4988] page_type: f5(slab)
[  105.210990][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  105.219582][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  105.228177][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  105.236853][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  105.245536][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  105.254212][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  105.262886][ T4988] page dumped because: kasan: bad access detected
[  105.269290][ T4988] page_owner tracks the page as allocated
[  105.274994][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  105.296386][ T4988]  post_alloc_hook+0xfd/0x120
[  105.301089][ T4988]  get_page_from_freelist+0xf48/0x3530
[  105.306575][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  105.312492][ T4988]  new_slab+0xa2/0x640
[  105.316588][ T4988]  refill_objects+0xe3/0x410
[  105.321233][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  105.326798][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  105.333243][ T4988]  kmalloc_reserve+0xe8/0x350
[  105.337927][ T4988]  __alloc_skb+0x185/0x710
[  105.342361][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  105.347413][ T4988]  add_grhead+0x299/0x340
[  105.351769][ T4988]  add_grec+0x1389/0x1930
[  105.356128][ T4988]  mld_send_initial_cr+0x156/0x320
[  105.361265][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  105.366382][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  105.371778][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  105.376823][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  105.383143][ T4988]  __free_frozen_pages+0x79f/0x1090
[  105.388357][ T4988]  qlist_free_all+0x47/0xf0
[  105.392888][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  105.398374][ T4988]  __kasan_slab_alloc+0x69/0x90
[  105.403232][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  105.408668][ T4988]  kernfs_fop_open+0x23d/0xd50
[  105.413443][ T4988]  do_dentry_open+0x6ab/0x14d0
[  105.418224][ T4988]  vfs_open+0x82/0x3f0
[  105.422294][ T4988]  path_openat+0x2873/0x4280
[  105.426908][ T4988]  do_file_open+0x20e/0x430
[  105.431434][ T4988]  do_sys_openat2+0x10f/0x1e0
[  105.436122][ T4988]  __x64_sys_openat+0x12d/0x210
[  105.440978][ T4988]  do_syscall_64+0x115/0x870
[  105.445585][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  105.451488][ T4988] 
[  105.453802][ T4988] Memory state around the buggy address:
[  105.459425][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  105.467493][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  105.475562][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  105.483617][ T4988]                                                     ^
[  105.490550][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  105.498608][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  105.506664][ T4988] ==================================================================
[  105.540189][ T4988] Disabling lock debugging due to kernel taint
[  105.583596][   T10] usb 5-1: 1:1: cannot set freq 48000 to ep 0x81
[  105.628241][ T4988] ==================================================================
[  105.636335][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  105.643298][ T4988] Read of size 1 at addr ffff888036950759 by task udevd/4988
[  105.650674][ T4988] 
[  105.653002][ T4988] CPU: 1 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  105.653051][ T4988] Tainted: [B]=BAD_PAGE
[  105.653064][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  105.653085][ T4988] Call Trace:
[  105.653095][ T4988]  <TASK>
[  105.653107][ T4988]  dump_stack_lvl+0x100/0x190
[  105.653147][ T4988]  print_report+0x13d/0x4b0
[  105.653198][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.653241][ T4988]  ? __virt_addr_valid+0x239/0x430
[  105.653284][ T4988]  ? string+0x471/0x4d0
[  105.653322][ T4988]  kasan_report+0xdf/0x1c0
[  105.653360][ T4988]  ? string+0x471/0x4d0
[  105.653402][ T4988]  string+0x471/0x4d0
[  105.653442][ T4988]  ? __pfx_string+0x10/0x10
[  105.653487][ T4988]  vsnprintf+0x422/0x1300
[  105.653540][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  105.653585][ T4988]  ? ksys_read+0x12a/0x250
[  105.653627][ T4988]  ? do_syscall_64+0x115/0x870
[  105.653673][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  105.653714][ T4988]  add_uevent_var+0x183/0x3a0
[  105.653756][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  105.653799][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  105.653834][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  105.653867][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  105.653901][ T4988]  dev_uevent+0x2f1/0x870
[  105.653934][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  105.653965][ T4988]  ? kasan_save_track+0x14/0x30
[  105.654020][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.654062][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  105.654117][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.654159][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  105.654207][ T4988]  ? uevent_show+0x166/0x3a0
[  105.654253][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  105.654296][ T4988]  uevent_show+0x1ca/0x3a0
[  105.654339][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.654383][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  105.654427][ T4988]  dev_attr_show+0x52/0xa0
[  105.654482][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  105.654542][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  105.654591][ T4988]  seq_read_iter+0x32f/0x1270
[  105.654638][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.654689][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  105.654727][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.654769][ T4988]  ? rw_verify_area+0xce/0x6d0
[  105.654807][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  105.654847][ T4988]  vfs_read+0x82e/0xb40
[  105.654892][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  105.654933][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.654978][ T4988]  ? find_held_lock+0x2b/0x80
[  105.655031][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  105.655092][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  105.655155][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.655197][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  105.655255][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.655297][ T4988]  ? find_held_lock+0x2b/0x80
[  105.655351][ T4988]  ksys_read+0x12a/0x250
[  105.655393][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  105.655437][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.655480][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  105.655526][ T4988]  do_syscall_64+0x115/0x870
[  105.655580][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  105.655616][ T4988] RIP: 0033:0x7f8363aa7407
[  105.655642][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  105.655676][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  105.655708][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  105.655732][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  105.655753][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  105.655775][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  105.655796][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  105.655830][ T4988]  </TASK>
[  105.655841][ T4988] 
[  106.043400][ T4988] Allocated by task 29:
[  106.047544][ T4988]  kasan_save_stack+0x30/0x50
[  106.052252][ T4988]  kasan_save_track+0x14/0x30
[  106.056955][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  106.061567][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  106.066955][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  106.071983][ T4988]  usb_probe_interface+0x303/0x8f0
[  106.077131][ T4988]  really_probe+0x241/0xa60
[  106.081656][ T4988]  __driver_probe_device+0x20e/0x450
[  106.086968][ T4988]  driver_probe_device+0x4a/0x140
[  106.092013][ T4988]  __device_attach_driver+0x1df/0x320
[  106.097404][ T4988]  bus_for_each_drv+0x159/0x1e0
[  106.102261][ T4988]  __device_attach+0x1e4/0x4d0
[  106.107045][ T4988]  device_initial_probe+0xaf/0xd0
[  106.112087][ T4988]  bus_probe_device+0x64/0x160
[  106.116860][ T4988]  device_add+0x121d/0x1970
[  106.121390][ T4988]  usb_set_configuration+0xd97/0x1c60
[  106.126788][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  106.132172][ T4988]  usb_probe_device+0xef/0x400
[  106.136957][ T4988]  really_probe+0x241/0xa60
[  106.141476][ T4988]  __driver_probe_device+0x20e/0x450
[  106.146817][ T4988]  driver_probe_device+0x4a/0x140
[  106.151859][ T4988]  __device_attach_driver+0x1df/0x320
[  106.157252][ T4988]  bus_for_each_drv+0x159/0x1e0
[  106.162110][ T4988]  __device_attach+0x1e4/0x4d0
[  106.166898][ T4988]  device_initial_probe+0xaf/0xd0
[  106.171941][ T4988]  bus_probe_device+0x64/0x160
[  106.176715][ T4988]  device_add+0x121d/0x1970
[  106.181242][ T4988]  usb_new_device.cold+0x685/0x115c
[  106.186451][ T4988]  hub_event+0x30a3/0x4a60
[  106.190917][ T4988]  process_one_work+0xa23/0x1940
[  106.195856][ T4988]  worker_thread+0x5ef/0xe50
[  106.200448][ T4988]  kthread+0x370/0x450
[  106.204542][ T4988]  ret_from_fork+0x72b/0xd50
[  106.209146][ T4988]  ret_from_fork_asm+0x1a/0x30
[  106.213926][ T4988] 
[  106.216236][ T4988] Freed by task 29:
[  106.220032][ T4988]  kasan_save_stack+0x30/0x50
[  106.224733][ T4988]  kasan_save_track+0x14/0x30
[  106.229445][ T4988]  kasan_save_free_info+0x3b/0x70
[  106.234483][ T4988]  __kasan_slab_free+0x5f/0x80
[  106.239255][ T4988]  kfree+0x22b/0x6c0
[  106.243163][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  106.248276][ T4988]  usb_probe_interface+0x303/0x8f0
[  106.253410][ T4988]  really_probe+0x241/0xa60
[  106.257930][ T4988]  __driver_probe_device+0x20e/0x450
[  106.263233][ T4988]  driver_probe_device+0x4a/0x140
[  106.268277][ T4988]  __device_attach_driver+0x1df/0x320
[  106.273665][ T4988]  bus_for_each_drv+0x159/0x1e0
[  106.278526][ T4988]  __device_attach+0x1e4/0x4d0
[  106.283309][ T4988]  device_initial_probe+0xaf/0xd0
[  106.288352][ T4988]  bus_probe_device+0x64/0x160
[  106.293127][ T4988]  device_add+0x121d/0x1970
[  106.297653][ T4988]  usb_set_configuration+0xd97/0x1c60
[  106.303056][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  106.308442][ T4988]  usb_probe_device+0xef/0x400
[  106.313227][ T4988]  really_probe+0x241/0xa60
[  106.317749][ T4988]  __driver_probe_device+0x20e/0x450
[  106.323056][ T4988]  driver_probe_device+0x4a/0x140
[  106.328108][ T4988]  __device_attach_driver+0x1df/0x320
[  106.333499][ T4988]  bus_for_each_drv+0x159/0x1e0
[  106.338358][ T4988]  __device_attach+0x1e4/0x4d0
[  106.343138][ T4988]  device_initial_probe+0xaf/0xd0
[  106.348180][ T4988]  bus_probe_device+0x64/0x160
[  106.352955][ T4988]  device_add+0x121d/0x1970
[  106.357484][ T4988]  usb_new_device.cold+0x685/0x115c
[  106.362692][ T4988]  hub_event+0x30a3/0x4a60
[  106.367127][ T4988]  process_one_work+0xa23/0x1940
[  106.372066][ T4988]  worker_thread+0x5ef/0xe50
[  106.376657][ T4988]  kthread+0x370/0x450
[  106.380748][ T4988]  ret_from_fork+0x72b/0xd50
[  106.385350][ T4988]  ret_from_fork_asm+0x1a/0x30
[  106.390131][ T4988] 
[  106.392446][ T4988] The buggy address belongs to the object at ffff888036950000
[  106.392446][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  106.406500][ T4988] The buggy address is located 1881 bytes inside of
[  106.406500][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  106.420474][ T4988] 
[  106.422789][ T4988] The buggy address belongs to the physical page:
[  106.429191][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  106.437952][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  106.446449][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  106.453993][ T4988] page_type: f5(slab)
[  106.457979][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  106.466568][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  106.475158][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  106.483835][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  106.492550][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  106.501222][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  106.509883][ T4988] page dumped because: kasan: bad access detected
[  106.516288][ T4988] page_owner tracks the page as allocated
[  106.521993][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  106.543378][ T4988]  post_alloc_hook+0xfd/0x120
[  106.548077][ T4988]  get_page_from_freelist+0xf48/0x3530
[  106.553559][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  106.559484][ T4988]  new_slab+0xa2/0x640
[  106.563573][ T4988]  refill_objects+0xe3/0x410
[  106.568182][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  106.573743][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  106.580185][ T4988]  kmalloc_reserve+0xe8/0x350
[  106.584867][ T4988]  __alloc_skb+0x185/0x710
[  106.589298][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  106.594344][ T4988]  add_grhead+0x299/0x340
[  106.598693][ T4988]  add_grec+0x1389/0x1930
[  106.603045][ T4988]  mld_send_initial_cr+0x156/0x320
[  106.608179][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  106.613295][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  106.618683][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  106.623723][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  106.630047][ T4988]  __free_frozen_pages+0x79f/0x1090
[  106.635267][ T4988]  qlist_free_all+0x47/0xf0
[  106.639793][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  106.645275][ T4988]  __kasan_slab_alloc+0x69/0x90
[  106.650129][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  106.655516][ T4988]  kernfs_fop_open+0x23d/0xd50
[  106.660287][ T4988]  do_dentry_open+0x6ab/0x14d0
[  106.665064][ T4988]  vfs_open+0x82/0x3f0
[  106.669132][ T4988]  path_openat+0x2873/0x4280
[  106.673742][ T4988]  do_file_open+0x20e/0x430
[  106.678262][ T4988]  do_sys_openat2+0x10f/0x1e0
[  106.682939][ T4988]  __x64_sys_openat+0x12d/0x210
[  106.687790][ T4988]  do_syscall_64+0x115/0x870
[  106.692395][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  106.698295][ T4988] 
[  106.700606][ T4988] Memory state around the buggy address:
[  106.706227][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  106.714286][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  106.722349][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  106.730403][ T4988]                                                     ^
[  106.737327][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  106.745388][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  106.753442][ T4988] ==================================================================
[  106.795117][ T5872] r8152-cfgselector 4-1: USB disconnect, device number 3
[  106.820551][ T4988] ==================================================================
[  106.828648][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  106.835615][ T4988] Read of size 1 at addr ffff88803695075a by task udevd/4988
[  106.842993][ T4988] 
[  106.845331][ T4988] CPU: 1 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  106.845385][ T4988] Tainted: [B]=BAD_PAGE
[  106.845399][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  106.845422][ T4988] Call Trace:
[  106.845433][ T4988]  <TASK>
[  106.845447][ T4988]  dump_stack_lvl+0x100/0x190
[  106.845490][ T4988]  print_report+0x13d/0x4b0
[  106.845546][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.845593][ T4988]  ? __virt_addr_valid+0x239/0x430
[  106.845642][ T4988]  ? string+0x471/0x4d0
[  106.845684][ T4988]  kasan_report+0xdf/0x1c0
[  106.845725][ T4988]  ? string+0x471/0x4d0
[  106.845772][ T4988]  string+0x471/0x4d0
[  106.845816][ T4988]  ? __pfx_string+0x10/0x10
[  106.845865][ T4988]  vsnprintf+0x422/0x1300
[  106.845918][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  106.845966][ T4988]  ? ksys_read+0x12a/0x250
[  106.846012][ T4988]  ? do_syscall_64+0x115/0x870
[  106.846068][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  106.846113][ T4988]  add_uevent_var+0x183/0x3a0
[  106.846155][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  106.846202][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  106.846241][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  106.846278][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  106.846315][ T4988]  dev_uevent+0x2f1/0x870
[  106.846351][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  106.846385][ T4988]  ? kasan_save_track+0x14/0x30
[  106.846445][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.846491][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  106.846551][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.846597][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  106.846650][ T4988]  ? uevent_show+0x166/0x3a0
[  106.846700][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  106.846748][ T4988]  uevent_show+0x1ca/0x3a0
[  106.846795][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.846843][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  106.846891][ T4988]  dev_attr_show+0x52/0xa0
[  106.846951][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  106.847011][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  106.847070][ T4988]  seq_read_iter+0x32f/0x1270
[  106.847121][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.847177][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  106.847220][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.847266][ T4988]  ? rw_verify_area+0xce/0x6d0
[  106.847308][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  106.847352][ T4988]  vfs_read+0x82e/0xb40
[  106.847401][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  106.847447][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.847495][ T4988]  ? find_held_lock+0x2b/0x80
[  106.847552][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  106.847618][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  106.847686][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.847732][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  106.847795][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.847840][ T4988]  ? find_held_lock+0x2b/0x80
[  106.847899][ T4988]  ksys_read+0x12a/0x250
[  106.847946][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  106.847994][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.848047][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  106.848098][ T4988]  do_syscall_64+0x115/0x870
[  106.848153][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  106.848192][ T4988] RIP: 0033:0x7f8363aa7407
[  106.848221][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  106.848258][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  106.848293][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  106.848320][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  106.848344][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  106.848368][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  106.848392][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  106.848428][ T4988]  </TASK>
[  106.848441][ T4988] 
[  107.235933][ T4988] Allocated by task 29:
[  107.240078][ T4988]  kasan_save_stack+0x30/0x50
[  107.244786][ T4988]  kasan_save_track+0x14/0x30
[  107.249500][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  107.254117][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  107.259506][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  107.264531][ T4988]  usb_probe_interface+0x303/0x8f0
[  107.269667][ T4988]  really_probe+0x241/0xa60
[  107.274187][ T4988]  __driver_probe_device+0x20e/0x450
[  107.279494][ T4988]  driver_probe_device+0x4a/0x140
[  107.284535][ T4988]  __device_attach_driver+0x1df/0x320
[  107.289927][ T4988]  bus_for_each_drv+0x159/0x1e0
[  107.294789][ T4988]  __device_attach+0x1e4/0x4d0
[  107.299572][ T4988]  device_initial_probe+0xaf/0xd0
[  107.304615][ T4988]  bus_probe_device+0x64/0x160
[  107.309394][ T4988]  device_add+0x121d/0x1970
[  107.313932][ T4988]  usb_set_configuration+0xd97/0x1c60
[  107.319323][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  107.324707][ T4988]  usb_probe_device+0xef/0x400
[  107.329488][ T4988]  really_probe+0x241/0xa60
[  107.334004][ T4988]  __driver_probe_device+0x20e/0x450
[  107.339310][ T4988]  driver_probe_device+0x4a/0x140
[  107.344350][ T4988]  __device_attach_driver+0x1df/0x320
[  107.349742][ T4988]  bus_for_each_drv+0x159/0x1e0
[  107.354600][ T4988]  __device_attach+0x1e4/0x4d0
[  107.359383][ T4988]  device_initial_probe+0xaf/0xd0
[  107.364425][ T4988]  bus_probe_device+0x64/0x160
[  107.369197][ T4988]  device_add+0x121d/0x1970
[  107.373722][ T4988]  usb_new_device.cold+0x685/0x115c
[  107.378934][ T4988]  hub_event+0x30a3/0x4a60
[  107.383365][ T4988]  process_one_work+0xa23/0x1940
[  107.388306][ T4988]  worker_thread+0x5ef/0xe50
[  107.392898][ T4988]  kthread+0x370/0x450
[  107.396989][ T4988]  ret_from_fork+0x72b/0xd50
[  107.401606][ T4988]  ret_from_fork_asm+0x1a/0x30
[  107.406388][ T4988] 
[  107.408700][ T4988] Freed by task 29:
[  107.412496][ T4988]  kasan_save_stack+0x30/0x50
[  107.417199][ T4988]  kasan_save_track+0x14/0x30
[  107.421899][ T4988]  kasan_save_free_info+0x3b/0x70
[  107.426936][ T4988]  __kasan_slab_free+0x5f/0x80
[  107.431704][ T4988]  kfree+0x22b/0x6c0
[  107.435617][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  107.440730][ T4988]  usb_probe_interface+0x303/0x8f0
[  107.445864][ T4988]  really_probe+0x241/0xa60
[  107.450383][ T4988]  __driver_probe_device+0x20e/0x450
[  107.455687][ T4988]  driver_probe_device+0x4a/0x140
[  107.460728][ T4988]  __device_attach_driver+0x1df/0x320
[  107.466117][ T4988]  bus_for_each_drv+0x159/0x1e0
[  107.471017][ T4988]  __device_attach+0x1e4/0x4d0
[  107.475801][ T4988]  device_initial_probe+0xaf/0xd0
[  107.480844][ T4988]  bus_probe_device+0x64/0x160
[  107.485643][ T4988]  device_add+0x121d/0x1970
[  107.490168][ T4988]  usb_set_configuration+0xd97/0x1c60
[  107.495558][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  107.500939][ T4988]  usb_probe_device+0xef/0x400
[  107.505722][ T4988]  really_probe+0x241/0xa60
[  107.510240][ T4988]  __driver_probe_device+0x20e/0x450
[  107.515543][ T4988]  driver_probe_device+0x4a/0x140
[  107.520589][ T4988]  __device_attach_driver+0x1df/0x320
[  107.525980][ T4988]  bus_for_each_drv+0x159/0x1e0
[  107.530841][ T4988]  __device_attach+0x1e4/0x4d0
[  107.535620][ T4988]  device_initial_probe+0xaf/0xd0
[  107.540673][ T4988]  bus_probe_device+0x64/0x160
[  107.545447][ T4988]  device_add+0x121d/0x1970
[  107.549974][ T4988]  usb_new_device.cold+0x685/0x115c
[  107.555185][ T4988]  hub_event+0x30a3/0x4a60
[  107.559625][ T4988]  process_one_work+0xa23/0x1940
[  107.564565][ T4988]  worker_thread+0x5ef/0xe50
[  107.569159][ T4988]  kthread+0x370/0x450
[  107.573251][ T4988]  ret_from_fork+0x72b/0xd50
[  107.577857][ T4988]  ret_from_fork_asm+0x1a/0x30
[  107.582638][ T4988] 
[  107.584951][ T4988] The buggy address belongs to the object at ffff888036950000
[  107.584951][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  107.599001][ T4988] The buggy address is located 1882 bytes inside of
[  107.599001][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  107.612977][ T4988] 
[  107.615294][ T4988] The buggy address belongs to the physical page:
[  107.621693][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  107.630451][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  107.638948][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  107.646492][ T4988] page_type: f5(slab)
[  107.650477][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  107.659063][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  107.667651][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  107.676325][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  107.684997][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  107.693693][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  107.702359][ T4988] page dumped because: kasan: bad access detected
[  107.708760][ T4988] page_owner tracks the page as allocated
[  107.714462][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  107.735839][ T4988]  post_alloc_hook+0xfd/0x120
[  107.740537][ T4988]  get_page_from_freelist+0xf48/0x3530
[  107.746015][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  107.751936][ T4988]  new_slab+0xa2/0x640
[  107.756019][ T4988]  refill_objects+0xe3/0x410
[  107.760628][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  107.766193][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  107.772640][ T4988]  kmalloc_reserve+0xe8/0x350
[  107.777321][ T4988]  __alloc_skb+0x185/0x710
[  107.781753][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  107.786798][ T4988]  add_grhead+0x299/0x340
[  107.791146][ T4988]  add_grec+0x1389/0x1930
[  107.795493][ T4988]  mld_send_initial_cr+0x156/0x320
[  107.800627][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  107.805743][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  107.811132][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  107.816172][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  107.822488][ T4988]  __free_frozen_pages+0x79f/0x1090
[  107.827698][ T4988]  qlist_free_all+0x47/0xf0
[  107.832221][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  107.837710][ T4988]  __kasan_slab_alloc+0x69/0x90
[  107.842567][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  107.847953][ T4988]  kernfs_fop_open+0x23d/0xd50
[  107.852735][ T4988]  do_dentry_open+0x6ab/0x14d0
[  107.857516][ T4988]  vfs_open+0x82/0x3f0
[  107.861583][ T4988]  path_openat+0x2873/0x4280
[  107.866203][ T4988]  do_file_open+0x20e/0x430
[  107.870725][ T4988]  do_sys_openat2+0x10f/0x1e0
[  107.875403][ T4988]  __x64_sys_openat+0x12d/0x210
[  107.880257][ T4988]  do_syscall_64+0x115/0x870
[  107.884863][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  107.890761][ T4988] 
[  107.893074][ T4988] Memory state around the buggy address:
[  107.898693][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  107.906750][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  107.914810][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  107.922865][ T4988]                                                     ^
[  107.929789][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  107.937845][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  107.945900][ T4988] ==================================================================
[  107.968904][   T10] usb 5-1: USB disconnect, device number 3
[  107.981401][ T4988] ==================================================================
[  107.989480][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  107.996458][ T4988] Read of size 1 at addr ffff88803695075b by task udevd/4988
[  108.003840][ T4988] 
[  108.006172][ T4988] CPU: 0 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  108.006227][ T4988] Tainted: [B]=BAD_PAGE
[  108.006241][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  108.006263][ T4988] Call Trace:
[  108.006275][ T4988]  <TASK>
[  108.006288][ T4988]  dump_stack_lvl+0x100/0x190
[  108.006333][ T4988]  print_report+0x13d/0x4b0
[  108.006391][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.006439][ T4988]  ? __virt_addr_valid+0x239/0x430
[  108.006487][ T4988]  ? string+0x471/0x4d0
[  108.006530][ T4988]  kasan_report+0xdf/0x1c0
[  108.006580][ T4988]  ? string+0x471/0x4d0
[  108.006627][ T4988]  string+0x471/0x4d0
[  108.006672][ T4988]  ? __pfx_string+0x10/0x10
[  108.006722][ T4988]  vsnprintf+0x422/0x1300
[  108.006777][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  108.006826][ T4988]  ? ksys_read+0x12a/0x250
[  108.006874][ T4988]  ? do_syscall_64+0x115/0x870
[  108.006925][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  108.006971][ T4988]  add_uevent_var+0x183/0x3a0
[  108.007013][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  108.007061][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  108.007101][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  108.007138][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  108.007176][ T4988]  dev_uevent+0x2f1/0x870
[  108.007253][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  108.007289][ T4988]  ? kasan_save_track+0x14/0x30
[  108.007350][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.007398][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  108.007458][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.007506][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  108.007566][ T4988]  ? uevent_show+0x166/0x3a0
[  108.007618][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  108.007665][ T4988]  uevent_show+0x1ca/0x3a0
[  108.007711][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.007759][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  108.007806][ T4988]  dev_attr_show+0x52/0xa0
[  108.007866][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  108.007928][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  108.007982][ T4988]  seq_read_iter+0x32f/0x1270
[  108.008033][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.008089][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  108.008131][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.008177][ T4988]  ? rw_verify_area+0xce/0x6d0
[  108.008219][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  108.008263][ T4988]  vfs_read+0x82e/0xb40
[  108.008312][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  108.008357][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.008406][ T4988]  ? find_held_lock+0x2b/0x80
[  108.008463][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  108.008530][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  108.008606][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.008653][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  108.008718][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.008765][ T4988]  ? find_held_lock+0x2b/0x80
[  108.008825][ T4988]  ksys_read+0x12a/0x250
[  108.008873][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  108.008922][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.008971][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  108.009021][ T4988]  do_syscall_64+0x115/0x870
[  108.009077][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  108.009117][ T4988] RIP: 0033:0x7f8363aa7407
[  108.009146][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  108.009184][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  108.009220][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  108.009246][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  108.009271][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  108.009296][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  108.009320][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  108.009357][ T4988]  </TASK>
[  108.009370][ T4988] 
[  108.396788][ T4988] Allocated by task 29:
[  108.400933][ T4988]  kasan_save_stack+0x30/0x50
[  108.405672][ T4988]  kasan_save_track+0x14/0x30
[  108.410377][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  108.414991][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  108.420383][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  108.425417][ T4988]  usb_probe_interface+0x303/0x8f0
[  108.430558][ T4988]  really_probe+0x241/0xa60
[  108.435083][ T4988]  __driver_probe_device+0x20e/0x450
[  108.440399][ T4988]  driver_probe_device+0x4a/0x140
[  108.445441][ T4988]  __device_attach_driver+0x1df/0x320
[  108.450837][ T4988]  bus_for_each_drv+0x159/0x1e0
[  108.455696][ T4988]  __device_attach+0x1e4/0x4d0
[  108.460478][ T4988]  device_initial_probe+0xaf/0xd0
[  108.465537][ T4988]  bus_probe_device+0x64/0x160
[  108.470314][ T4988]  device_add+0x121d/0x1970
[  108.474841][ T4988]  usb_set_configuration+0xd97/0x1c60
[  108.480233][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  108.485617][ T4988]  usb_probe_device+0xef/0x400
[  108.490412][ T4988]  really_probe+0x241/0xa60
[  108.494969][ T4988]  __driver_probe_device+0x20e/0x450
[  108.500277][ T4988]  driver_probe_device+0x4a/0x140
[  108.505320][ T4988]  __device_attach_driver+0x1df/0x320
[  108.510713][ T4988]  bus_for_each_drv+0x159/0x1e0
[  108.515572][ T4988]  __device_attach+0x1e4/0x4d0
[  108.520355][ T4988]  device_initial_probe+0xaf/0xd0
[  108.525401][ T4988]  bus_probe_device+0x64/0x160
[  108.530180][ T4988]  device_add+0x121d/0x1970
[  108.534706][ T4988]  usb_new_device.cold+0x685/0x115c
[  108.539917][ T4988]  hub_event+0x30a3/0x4a60
[  108.544351][ T4988]  process_one_work+0xa23/0x1940
[  108.549289][ T4988]  worker_thread+0x5ef/0xe50
[  108.553880][ T4988]  kthread+0x370/0x450
[  108.557970][ T4988]  ret_from_fork+0x72b/0xd50
[  108.562574][ T4988]  ret_from_fork_asm+0x1a/0x30
[  108.567356][ T4988] 
[  108.569665][ T4988] Freed by task 29:
[  108.573466][ T4988]  kasan_save_stack+0x30/0x50
[  108.578173][ T4988]  kasan_save_track+0x14/0x30
[  108.582878][ T4988]  kasan_save_free_info+0x3b/0x70
[  108.587917][ T4988]  __kasan_slab_free+0x5f/0x80
[  108.592681][ T4988]  kfree+0x22b/0x6c0
[  108.596607][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  108.601720][ T4988]  usb_probe_interface+0x303/0x8f0
[  108.606859][ T4988]  really_probe+0x241/0xa60
[  108.611377][ T4988]  __driver_probe_device+0x20e/0x450
[  108.616681][ T4988]  driver_probe_device+0x4a/0x140
[  108.621726][ T4988]  __device_attach_driver+0x1df/0x320
[  108.627116][ T4988]  bus_for_each_drv+0x159/0x1e0
[  108.631973][ T4988]  __device_attach+0x1e4/0x4d0
[  108.636755][ T4988]  device_initial_probe+0xaf/0xd0
[  108.641798][ T4988]  bus_probe_device+0x64/0x160
[  108.646572][ T4988]  device_add+0x121d/0x1970
[  108.651098][ T4988]  usb_set_configuration+0xd97/0x1c60
[  108.656485][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  108.661872][ T4988]  usb_probe_device+0xef/0x400
[  108.666655][ T4988]  really_probe+0x241/0xa60
[  108.671174][ T4988]  __driver_probe_device+0x20e/0x450
[  108.676477][ T4988]  driver_probe_device+0x4a/0x140
[  108.681525][ T4988]  __device_attach_driver+0x1df/0x320
[  108.686929][ T4988]  bus_for_each_drv+0x159/0x1e0
[  108.691789][ T4988]  __device_attach+0x1e4/0x4d0
[  108.696569][ T4988]  device_initial_probe+0xaf/0xd0
[  108.701612][ T4988]  bus_probe_device+0x64/0x160
[  108.706428][ T4988]  device_add+0x121d/0x1970
[  108.710954][ T4988]  usb_new_device.cold+0x685/0x115c
[  108.716162][ T4988]  hub_event+0x30a3/0x4a60
[  108.720596][ T4988]  process_one_work+0xa23/0x1940
[  108.725541][ T4988]  worker_thread+0x5ef/0xe50
[  108.730135][ T4988]  kthread+0x370/0x450
[  108.734227][ T4988]  ret_from_fork+0x72b/0xd50
[  108.738832][ T4988]  ret_from_fork_asm+0x1a/0x30
[  108.743618][ T4988] 
[  108.745931][ T4988] The buggy address belongs to the object at ffff888036950000
[  108.745931][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  108.759980][ T4988] The buggy address is located 1883 bytes inside of
[  108.759980][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  108.773954][ T4988] 
[  108.776269][ T4988] The buggy address belongs to the physical page:
[  108.782668][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  108.791428][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  108.799928][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  108.807471][ T4988] page_type: f5(slab)
[  108.811454][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  108.820043][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  108.828633][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  108.837305][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  108.845978][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  108.854649][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  108.863310][ T4988] page dumped because: kasan: bad access detected
[  108.869712][ T4988] page_owner tracks the page as allocated
[  108.875415][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  108.896797][ T4988]  post_alloc_hook+0xfd/0x120
[  108.901496][ T4988]  get_page_from_freelist+0xf48/0x3530
[  108.906977][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  108.912910][ T4988]  new_slab+0xa2/0x640
[  108.916994][ T4988]  refill_objects+0xe3/0x410
[  108.921599][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  108.927159][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  108.933598][ T4988]  kmalloc_reserve+0xe8/0x350
[  108.938301][ T4988]  __alloc_skb+0x185/0x710
[  108.942772][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  108.947821][ T4988]  add_grhead+0x299/0x340
[  108.952171][ T4988]  add_grec+0x1389/0x1930
[  108.956519][ T4988]  mld_send_initial_cr+0x156/0x320
[  108.961655][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  108.966770][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  108.972158][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  108.977199][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  108.983516][ T4988]  __free_frozen_pages+0x79f/0x1090
[  108.988734][ T4988]  qlist_free_all+0x47/0xf0
[  108.993261][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  108.998747][ T4988]  __kasan_slab_alloc+0x69/0x90
[  109.003598][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  109.008986][ T4988]  kernfs_fop_open+0x23d/0xd50
[  109.013754][ T4988]  do_dentry_open+0x6ab/0x14d0
[  109.018532][ T4988]  vfs_open+0x82/0x3f0
[  109.022600][ T4988]  path_openat+0x2873/0x4280
[  109.027210][ T4988]  do_file_open+0x20e/0x430
[  109.031731][ T4988]  do_sys_openat2+0x10f/0x1e0
[  109.036416][ T4988]  __x64_sys_openat+0x12d/0x210
[  109.041268][ T4988]  do_syscall_64+0x115/0x870
[  109.045871][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.051769][ T4988] 
[  109.054081][ T4988] Memory state around the buggy address:
[  109.059699][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  109.067758][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  109.075820][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  109.083873][ T4988]                                                     ^
[  109.090802][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  109.098863][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  109.106918][ T4988] ==================================================================
[  109.134654][ T4988] ==================================================================
[  109.142750][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  109.149715][ T4988] Read of size 1 at addr ffff88803695075c by task udevd/4988
[  109.157092][ T4988] 
[  109.159420][ T4988] CPU: 1 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  109.159469][ T4988] Tainted: [B]=BAD_PAGE
[  109.159481][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  109.159501][ T4988] Call Trace:
[  109.159512][ T4988]  <TASK>
[  109.159525][ T4988]  dump_stack_lvl+0x100/0x190
[  109.159566][ T4988]  print_report+0x13d/0x4b0
[  109.159617][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.159659][ T4988]  ? __virt_addr_valid+0x239/0x430
[  109.159702][ T4988]  ? string+0x471/0x4d0
[  109.159740][ T4988]  kasan_report+0xdf/0x1c0
[  109.159777][ T4988]  ? string+0x471/0x4d0
[  109.159820][ T4988]  string+0x471/0x4d0
[  109.159859][ T4988]  ? __pfx_string+0x10/0x10
[  109.159904][ T4988]  vsnprintf+0x422/0x1300
[  109.159953][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  109.159996][ T4988]  ? ksys_read+0x12a/0x250
[  109.160043][ T4988]  ? do_syscall_64+0x115/0x870
[  109.160089][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.160130][ T4988]  add_uevent_var+0x183/0x3a0
[  109.160167][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  109.160210][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  109.160245][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  109.160278][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  109.160311][ T4988]  dev_uevent+0x2f1/0x870
[  109.160344][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  109.160375][ T4988]  ? kasan_save_track+0x14/0x30
[  109.160429][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.160471][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  109.160525][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.160567][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  109.160615][ T4988]  ? uevent_show+0x166/0x3a0
[  109.160662][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  109.160705][ T4988]  uevent_show+0x1ca/0x3a0
[  109.160747][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.160791][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  109.160834][ T4988]  dev_attr_show+0x52/0xa0
[  109.160889][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  109.160944][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  109.160993][ T4988]  seq_read_iter+0x32f/0x1270
[  109.161044][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161095][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  109.161133][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161175][ T4988]  ? rw_verify_area+0xce/0x6d0
[  109.161212][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  109.161252][ T4988]  vfs_read+0x82e/0xb40
[  109.161297][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  109.161338][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161382][ T4988]  ? find_held_lock+0x2b/0x80
[  109.161434][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  109.161495][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  109.161558][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161599][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  109.161658][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161700][ T4988]  ? find_held_lock+0x2b/0x80
[  109.161754][ T4988]  ksys_read+0x12a/0x250
[  109.161797][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  109.161840][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161883][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  109.161928][ T4988]  do_syscall_64+0x115/0x870
[  109.161978][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.162014][ T4988] RIP: 0033:0x7f8363aa7407
[  109.162046][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  109.162080][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  109.162112][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  109.162135][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  109.162157][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  109.162179][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  109.162200][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  109.162233][ T4988]  </TASK>
[  109.162245][ T4988] 
[  109.549854][ T4988] Allocated by task 29:
[  109.554001][ T4988]  kasan_save_stack+0x30/0x50
[  109.558710][ T4988]  kasan_save_track+0x14/0x30
[  109.563411][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  109.568027][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  109.573425][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  109.578477][ T4988]  usb_probe_interface+0x303/0x8f0
[  109.583612][ T4988]  really_probe+0x241/0xa60
[  109.588132][ T4988]  __driver_probe_device+0x20e/0x450
[  109.593435][ T4988]  driver_probe_device+0x4a/0x140
[  109.598478][ T4988]  __device_attach_driver+0x1df/0x320
[  109.603869][ T4988]  bus_for_each_drv+0x159/0x1e0
[  109.608728][ T4988]  __device_attach+0x1e4/0x4d0
[  109.613513][ T4988]  device_initial_probe+0xaf/0xd0
[  109.618563][ T4988]  bus_probe_device+0x64/0x160
[  109.623339][ T4988]  device_add+0x121d/0x1970
[  109.627866][ T4988]  usb_set_configuration+0xd97/0x1c60
[  109.633255][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  109.638638][ T4988]  usb_probe_device+0xef/0x400
[  109.643419][ T4988]  really_probe+0x241/0xa60
[  109.647945][ T4988]  __driver_probe_device+0x20e/0x450
[  109.653245][ T4988]  driver_probe_device+0x4a/0x140
[  109.658287][ T4988]  __device_attach_driver+0x1df/0x320
[  109.663679][ T4988]  bus_for_each_drv+0x159/0x1e0
[  109.668536][ T4988]  __device_attach+0x1e4/0x4d0
[  109.673316][ T4988]  device_initial_probe+0xaf/0xd0
[  109.678359][ T4988]  bus_probe_device+0x64/0x160
[  109.683131][ T4988]  device_add+0x121d/0x1970
[  109.687656][ T4988]  usb_new_device.cold+0x685/0x115c
[  109.692863][ T4988]  hub_event+0x30a3/0x4a60
[  109.697299][ T4988]  process_one_work+0xa23/0x1940
[  109.702241][ T4988]  worker_thread+0x5ef/0xe50
[  109.706839][ T4988]  kthread+0x370/0x450
[  109.710930][ T4988]  ret_from_fork+0x72b/0xd50
[  109.715533][ T4988]  ret_from_fork_asm+0x1a/0x30
[  109.720318][ T4988] 
[  109.722627][ T4988] Freed by task 29:
[  109.726421][ T4988]  kasan_save_stack+0x30/0x50
[  109.731121][ T4988]  kasan_save_track+0x14/0x30
[  109.735821][ T4988]  kasan_save_free_info+0x3b/0x70
[  109.740858][ T4988]  __kasan_slab_free+0x5f/0x80
[  109.745622][ T4988]  kfree+0x22b/0x6c0
[  109.749527][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  109.754640][ T4988]  usb_probe_interface+0x303/0x8f0
[  109.759778][ T4988]  really_probe+0x241/0xa60
[  109.764296][ T4988]  __driver_probe_device+0x20e/0x450
[  109.769602][ T4988]  driver_probe_device+0x4a/0x140
[  109.774644][ T4988]  __device_attach_driver+0x1df/0x320
[  109.780039][ T4988]  bus_for_each_drv+0x159/0x1e0
[  109.784904][ T4988]  __device_attach+0x1e4/0x4d0
[  109.789685][ T4988]  device_initial_probe+0xaf/0xd0
[  109.794729][ T4988]  bus_probe_device+0x64/0x160
[  109.799504][ T4988]  device_add+0x121d/0x1970
[  109.804031][ T4988]  usb_set_configuration+0xd97/0x1c60
[  109.809429][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  109.814816][ T4988]  usb_probe_device+0xef/0x400
[  109.819599][ T4988]  really_probe+0x241/0xa60
[  109.824122][ T4988]  __driver_probe_device+0x20e/0x450
[  109.829424][ T4988]  driver_probe_device+0x4a/0x140
[  109.834466][ T4988]  __device_attach_driver+0x1df/0x320
[  109.839858][ T4988]  bus_for_each_drv+0x159/0x1e0
[  109.844713][ T4988]  __device_attach+0x1e4/0x4d0
[  109.849492][ T4988]  device_initial_probe+0xaf/0xd0
[  109.854534][ T4988]  bus_probe_device+0x64/0x160
[  109.859308][ T4988]  device_add+0x121d/0x1970
[  109.863833][ T4988]  usb_new_device.cold+0x685/0x115c
[  109.869068][ T4988]  hub_event+0x30a3/0x4a60
[  109.873502][ T4988]  process_one_work+0xa23/0x1940
[  109.878443][ T4988]  worker_thread+0x5ef/0xe50
[  109.883038][ T4988]  kthread+0x370/0x450
[  109.887139][ T4988]  ret_from_fork+0x72b/0xd50
[  109.891743][ T4988]  ret_from_fork_asm+0x1a/0x30
[  109.896526][ T4988] 
[  109.898846][ T4988] The buggy address belongs to the object at ffff888036950000
[  109.898846][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  109.912903][ T4988] The buggy address is located 1884 bytes inside of
[  109.912903][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  109.926876][ T4988] 
[  109.929187][ T4988] The buggy address belongs to the physical page:
[  109.935585][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  109.944344][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  109.952844][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  109.960386][ T4988] page_type: f5(slab)
[  109.964368][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  109.972953][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  109.981540][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  109.990213][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  109.998886][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  110.007561][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  110.016224][ T4988] page dumped because: kasan: bad access detected
[  110.022627][ T4988] page_owner tracks the page as allocated
[  110.028327][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  110.049705][ T4988]  post_alloc_hook+0xfd/0x120
[  110.054403][ T4988]  get_page_from_freelist+0xf48/0x3530
[  110.059887][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  110.065799][ T4988]  new_slab+0xa2/0x640
[  110.069884][ T4988]  refill_objects+0xe3/0x410
[  110.074491][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  110.080050][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  110.086489][ T4988]  kmalloc_reserve+0xe8/0x350
[  110.091170][ T4988]  __alloc_skb+0x185/0x710
[  110.095600][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  110.100649][ T4988]  add_grhead+0x299/0x340
[  110.104996][ T4988]  add_grec+0x1389/0x1930
[  110.109350][ T4988]  mld_send_initial_cr+0x156/0x320
[  110.114513][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  110.119630][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  110.125019][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  110.130066][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  110.136380][ T4988]  __free_frozen_pages+0x79f/0x1090
[  110.141590][ T4988]  qlist_free_all+0x47/0xf0
[  110.146116][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  110.151597][ T4988]  __kasan_slab_alloc+0x69/0x90
[  110.156455][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  110.161842][ T4988]  kernfs_fop_open+0x23d/0xd50
[  110.166612][ T4988]  do_dentry_open+0x6ab/0x14d0
[  110.171388][ T4988]  vfs_open+0x82/0x3f0
[  110.175457][ T4988]  path_openat+0x2873/0x4280
[  110.180067][ T4988]  do_file_open+0x20e/0x430
[  110.184589][ T4988]  do_sys_openat2+0x10f/0x1e0
[  110.189269][ T4988]  __x64_sys_openat+0x12d/0x210
[  110.194120][ T4988]  do_syscall_64+0x115/0x870
[  110.198727][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.204625][ T4988] 
[  110.206937][ T4988] Memory state around the buggy address:
[  110.212559][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.220620][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.228689][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.236743][ T4988]                                                     ^
[  110.243671][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.251729][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  110.259782][ T4988] ==================================================================
[  110.281233][ T4988] ==================================================================
[  110.289324][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  110.296286][ T4988] Read of size 1 at addr ffff88803695075d by task udevd/4988
[  110.303667][ T4988] 
[  110.306002][ T4988] CPU: 0 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  110.306057][ T4988] Tainted: [B]=BAD_PAGE
[  110.306071][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  110.306094][ T4988] Call Trace:
[  110.306105][ T4988]  <TASK>
[  110.306118][ T4988]  dump_stack_lvl+0x100/0x190
[  110.306162][ T4988]  print_report+0x13d/0x4b0
[  110.306219][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.306266][ T4988]  ? __virt_addr_valid+0x239/0x430
[  110.306313][ T4988]  ? string+0x471/0x4d0
[  110.306356][ T4988]  kasan_report+0xdf/0x1c0
[  110.306398][ T4988]  ? string+0x471/0x4d0
[  110.306445][ T4988]  string+0x471/0x4d0
[  110.306488][ T4988]  ? __pfx_string+0x10/0x10
[  110.306543][ T4988]  vsnprintf+0x422/0x1300
[  110.306597][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  110.306645][ T4988]  ? ksys_read+0x12a/0x250
[  110.306692][ T4988]  ? do_syscall_64+0x115/0x870
[  110.306743][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.306788][ T4988]  add_uevent_var+0x183/0x3a0
[  110.306829][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  110.306877][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  110.306917][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  110.306953][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  110.306990][ T4988]  dev_uevent+0x2f1/0x870
[  110.307026][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  110.307060][ T4988]  ? kasan_save_track+0x14/0x30
[  110.307120][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.307166][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  110.307226][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.307272][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  110.307324][ T4988]  ? uevent_show+0x166/0x3a0
[  110.307375][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  110.307424][ T4988]  uevent_show+0x1ca/0x3a0
[  110.307472][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.307520][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  110.307574][ T4988]  dev_attr_show+0x52/0xa0
[  110.307634][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  110.307694][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  110.307747][ T4988]  seq_read_iter+0x32f/0x1270
[  110.307797][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.307853][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  110.307895][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.307942][ T4988]  ? rw_verify_area+0xce/0x6d0
[  110.307984][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  110.308030][ T4988]  vfs_read+0x82e/0xb40
[  110.308078][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  110.308123][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.308172][ T4988]  ? find_held_lock+0x2b/0x80
[  110.308229][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  110.308294][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  110.308363][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.308409][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  110.308473][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.308520][ T4988]  ? find_held_lock+0x2b/0x80
[  110.308585][ T4988]  ksys_read+0x12a/0x250
[  110.308633][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  110.308681][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.308729][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  110.308779][ T4988]  do_syscall_64+0x115/0x870
[  110.308834][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.308872][ T4988] RIP: 0033:0x7f8363aa7407
[  110.308900][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  110.308937][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  110.308971][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  110.308997][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  110.309022][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  110.309046][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  110.309070][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  110.309108][ T4988]  </TASK>
[  110.309121][ T4988] 
[  110.696848][ T4988] Allocated by task 29:
[  110.701027][ T4988]  kasan_save_stack+0x30/0x50
[  110.705733][ T4988]  kasan_save_track+0x14/0x30
[  110.710435][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  110.715051][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  110.720613][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  110.725672][ T4988]  usb_probe_interface+0x303/0x8f0
[  110.730811][ T4988]  really_probe+0x241/0xa60
[  110.735334][ T4988]  __driver_probe_device+0x20e/0x450
[  110.740638][ T4988]  driver_probe_device+0x4a/0x140
[  110.745678][ T4988]  __device_attach_driver+0x1df/0x320
[  110.751072][ T4988]  bus_for_each_drv+0x159/0x1e0
[  110.755929][ T4988]  __device_attach+0x1e4/0x4d0
[  110.760711][ T4988]  device_initial_probe+0xaf/0xd0
[  110.765755][ T4988]  bus_probe_device+0x64/0x160
[  110.770530][ T4988]  device_add+0x121d/0x1970
[  110.775062][ T4988]  usb_set_configuration+0xd97/0x1c60
[  110.780453][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  110.785834][ T4988]  usb_probe_device+0xef/0x400
[  110.790617][ T4988]  really_probe+0x241/0xa60
[  110.795135][ T4988]  __driver_probe_device+0x20e/0x450
[  110.800467][ T4988]  driver_probe_device+0x4a/0x140
[  110.805513][ T4988]  __device_attach_driver+0x1df/0x320
[  110.810907][ T4988]  bus_for_each_drv+0x159/0x1e0
[  110.815764][ T4988]  __device_attach+0x1e4/0x4d0
[  110.820549][ T4988]  device_initial_probe+0xaf/0xd0
[  110.825595][ T4988]  bus_probe_device+0x64/0x160
[  110.830373][ T4988]  device_add+0x121d/0x1970
[  110.834902][ T4988]  usb_new_device.cold+0x685/0x115c
[  110.840113][ T4988]  hub_event+0x30a3/0x4a60
[  110.844550][ T4988]  process_one_work+0xa23/0x1940
[  110.849489][ T4988]  worker_thread+0x5ef/0xe50
[  110.854081][ T4988]  kthread+0x370/0x450
[  110.858175][ T4988]  ret_from_fork+0x72b/0xd50
[  110.862780][ T4988]  ret_from_fork_asm+0x1a/0x30
[  110.867562][ T4988] 
[  110.869872][ T4988] Freed by task 29:
[  110.873666][ T4988]  kasan_save_stack+0x30/0x50
[  110.878367][ T4988]  kasan_save_track+0x14/0x30
[  110.883067][ T4988]  kasan_save_free_info+0x3b/0x70
[  110.888105][ T4988]  __kasan_slab_free+0x5f/0x80
[  110.892868][ T4988]  kfree+0x22b/0x6c0
[  110.896773][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  110.901884][ T4988]  usb_probe_interface+0x303/0x8f0
[  110.907020][ T4988]  really_probe+0x241/0xa60
[  110.911543][ T4988]  __driver_probe_device+0x20e/0x450
[  110.916844][ T4988]  driver_probe_device+0x4a/0x140
[  110.921884][ T4988]  __device_attach_driver+0x1df/0x320
[  110.927273][ T4988]  bus_for_each_drv+0x159/0x1e0
[  110.932128][ T4988]  __device_attach+0x1e4/0x4d0
[  110.936911][ T4988]  device_initial_probe+0xaf/0xd0
[  110.941954][ T4988]  bus_probe_device+0x64/0x160
[  110.946728][ T4988]  device_add+0x121d/0x1970
[  110.951253][ T4988]  usb_set_configuration+0xd97/0x1c60
[  110.956640][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  110.962023][ T4988]  usb_probe_device+0xef/0x400
[  110.966807][ T4988]  really_probe+0x241/0xa60
[  110.971324][ T4988]  __driver_probe_device+0x20e/0x450
[  110.976627][ T4988]  driver_probe_device+0x4a/0x140
[  110.981669][ T4988]  __device_attach_driver+0x1df/0x320
[  110.987060][ T4988]  bus_for_each_drv+0x159/0x1e0
[  110.991918][ T4988]  __device_attach+0x1e4/0x4d0
[  110.996699][ T4988]  device_initial_probe+0xaf/0xd0
[  111.001742][ T4988]  bus_probe_device+0x64/0x160
[  111.006516][ T4988]  device_add+0x121d/0x1970
[  111.011045][ T4988]  usb_new_device.cold+0x685/0x115c
[  111.016252][ T4988]  hub_event+0x30a3/0x4a60
[  111.020685][ T4988]  process_one_work+0xa23/0x1940
[  111.025626][ T4988]  worker_thread+0x5ef/0xe50
[  111.030218][ T4988]  kthread+0x370/0x450
[  111.034311][ T4988]  ret_from_fork+0x72b/0xd50
[  111.038917][ T4988]  ret_from_fork_asm+0x1a/0x30
[  111.043700][ T4988] 
[  111.046014][ T4988] The buggy address belongs to the object at ffff888036950000
[  111.046014][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  111.060066][ T4988] The buggy address is located 1885 bytes inside of
[  111.060066][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  111.074041][ T4988] 
[  111.076354][ T4988] The buggy address belongs to the physical page:
[  111.082753][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  111.091512][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  111.100012][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  111.107554][ T4988] page_type: f5(slab)
[  111.111540][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  111.120125][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  111.128711][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  111.137386][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  111.146063][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  111.154739][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  111.163401][ T4988] page dumped because: kasan: bad access detected
[  111.169801][ T4988] page_owner tracks the page as allocated
[  111.175503][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  111.196884][ T4988]  post_alloc_hook+0xfd/0x120
[  111.201582][ T4988]  get_page_from_freelist+0xf48/0x3530
[  111.207058][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  111.212970][ T4988]  new_slab+0xa2/0x640
[  111.217052][ T4988]  refill_objects+0xe3/0x410
[  111.221661][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  111.227222][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  111.233662][ T4988]  kmalloc_reserve+0xe8/0x350
[  111.238344][ T4988]  __alloc_skb+0x185/0x710
[  111.242783][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  111.247831][ T4988]  add_grhead+0x299/0x340
[  111.252207][ T4988]  add_grec+0x1389/0x1930
[  111.256557][ T4988]  mld_send_initial_cr+0x156/0x320
[  111.261715][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  111.266829][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  111.272218][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  111.277260][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  111.283576][ T4988]  __free_frozen_pages+0x79f/0x1090
[  111.288787][ T4988]  qlist_free_all+0x47/0xf0
[  111.293310][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  111.298791][ T4988]  __kasan_slab_alloc+0x69/0x90
[  111.303643][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  111.309032][ T4988]  kernfs_fop_open+0x23d/0xd50
[  111.313804][ T4988]  do_dentry_open+0x6ab/0x14d0
[  111.318583][ T4988]  vfs_open+0x82/0x3f0
[  111.322650][ T4988]  path_openat+0x2873/0x4280
[  111.327262][ T4988]  do_file_open+0x20e/0x430
[  111.331783][ T4988]  do_sys_openat2+0x10f/0x1e0
[  111.336460][ T4988]  __x64_sys_openat+0x12d/0x210
[  111.341313][ T4988]  do_syscall_64+0x115/0x870
[  111.345922][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.351824][ T4988] 
[  111.354135][ T4988] Memory state around the buggy address:
[  111.359756][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  111.367822][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  111.375880][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  111.383933][ T4988]                                                     ^
[  111.390862][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  111.398919][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  111.406970][ T4988] ==================================================================
[  111.460384][ T4988] ==================================================================
[  111.468498][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  111.475468][ T4988] Read of size 1 at addr ffff88803695075e by task udevd/4988
[  111.482847][ T4988] 
[  111.485180][ T4988] CPU: 0 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  111.485236][ T4988] Tainted: [B]=BAD_PAGE
[  111.485250][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  111.485273][ T4988] Call Trace:
[  111.485285][ T4988]  <TASK>
[  111.485298][ T4988]  dump_stack_lvl+0x100/0x190
[  111.485343][ T4988]  print_report+0x13d/0x4b0
[  111.485400][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.485447][ T4988]  ? __virt_addr_valid+0x239/0x430
[  111.485496][ T4988]  ? string+0x471/0x4d0
[  111.485544][ T4988]  kasan_report+0xdf/0x1c0
[  111.485585][ T4988]  ? string+0x471/0x4d0
[  111.485632][ T4988]  string+0x471/0x4d0
[  111.485675][ T4988]  ? __pfx_string+0x10/0x10
[  111.485724][ T4988]  vsnprintf+0x422/0x1300
[  111.485779][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  111.485829][ T4988]  ? ksys_read+0x12a/0x250
[  111.485875][ T4988]  ? do_syscall_64+0x115/0x870
[  111.485926][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.485971][ T4988]  add_uevent_var+0x183/0x3a0
[  111.486015][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  111.486063][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  111.486103][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  111.486140][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  111.486178][ T4988]  dev_uevent+0x2f1/0x870
[  111.486215][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  111.486250][ T4988]  ? kasan_save_track+0x14/0x30
[  111.486310][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.486357][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  111.486418][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.486465][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  111.486519][ T4988]  ? uevent_show+0x166/0x3a0
[  111.486579][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  111.486627][ T4988]  uevent_show+0x1ca/0x3a0
[  111.486675][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.486723][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  111.486771][ T4988]  dev_attr_show+0x52/0xa0
[  111.486833][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  111.486894][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  111.486948][ T4988]  seq_read_iter+0x32f/0x1270
[  111.487000][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487054][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  111.487096][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487142][ T4988]  ? rw_verify_area+0xce/0x6d0
[  111.487183][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  111.487227][ T4988]  vfs_read+0x82e/0xb40
[  111.487277][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  111.487322][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487371][ T4988]  ? find_held_lock+0x2b/0x80
[  111.487428][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  111.487494][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  111.487569][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487616][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  111.487680][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487726][ T4988]  ? find_held_lock+0x2b/0x80
[  111.487785][ T4988]  ksys_read+0x12a/0x250
[  111.487832][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  111.487881][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487930][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  111.487980][ T4988]  do_syscall_64+0x115/0x870
[  111.488035][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  111.488074][ T4988] RIP: 0033:0x7f8363aa7407
[  111.488102][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  111.488139][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  111.488174][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  111.488201][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  111.488225][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  111.488249][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  111.488273][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  111.488310][ T4988]  </TASK>
[  111.488323][ T4988] 
[  111.875909][ T4988] Allocated by task 29:
[  111.880069][ T4988]  kasan_save_stack+0x30/0x50
[  111.884776][ T4988]  kasan_save_track+0x14/0x30
[  111.889479][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  111.894099][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  111.899490][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  111.904519][ T4988]  usb_probe_interface+0x303/0x8f0
[  111.909659][ T4988]  really_probe+0x241/0xa60
[  111.914179][ T4988]  __driver_probe_device+0x20e/0x450
[  111.919484][ T4988]  driver_probe_device+0x4a/0x140
[  111.924531][ T4988]  __device_attach_driver+0x1df/0x320
[  111.929927][ T4988]  bus_for_each_drv+0x159/0x1e0
[  111.934786][ T4988]  __device_attach+0x1e4/0x4d0
[  111.939567][ T4988]  device_initial_probe+0xaf/0xd0
[  111.944611][ T4988]  bus_probe_device+0x64/0x160
[  111.949385][ T4988]  device_add+0x121d/0x1970
[  111.953914][ T4988]  usb_set_configuration+0xd97/0x1c60
[  111.959307][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  111.964695][ T4988]  usb_probe_device+0xef/0x400
[  111.969479][ T4988]  really_probe+0x241/0xa60
[  111.974001][ T4988]  __driver_probe_device+0x20e/0x450
[  111.979305][ T4988]  driver_probe_device+0x4a/0x140
[  111.984351][ T4988]  __device_attach_driver+0x1df/0x320
[  111.989744][ T4988]  bus_for_each_drv+0x159/0x1e0
[  111.994604][ T4988]  __device_attach+0x1e4/0x4d0
[  111.999385][ T4988]  device_initial_probe+0xaf/0xd0
[  112.004431][ T4988]  bus_probe_device+0x64/0x160
[  112.009205][ T4988]  device_add+0x121d/0x1970
[  112.013736][ T4988]  usb_new_device.cold+0x685/0x115c
[  112.018946][ T4988]  hub_event+0x30a3/0x4a60
[  112.023380][ T4988]  process_one_work+0xa23/0x1940
[  112.028317][ T4988]  worker_thread+0x5ef/0xe50
[  112.032907][ T4988]  kthread+0x370/0x450
[  112.037002][ T4988]  ret_from_fork+0x72b/0xd50
[  112.041605][ T4988]  ret_from_fork_asm+0x1a/0x30
[  112.046388][ T4988] 
[  112.048699][ T4988] Freed by task 29:
[  112.052493][ T4988]  kasan_save_stack+0x30/0x50
[  112.057202][ T4988]  kasan_save_track+0x14/0x30
[  112.061915][ T4988]  kasan_save_free_info+0x3b/0x70
[  112.066958][ T4988]  __kasan_slab_free+0x5f/0x80
[  112.071724][ T4988]  kfree+0x22b/0x6c0
[  112.075630][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  112.080743][ T4988]  usb_probe_interface+0x303/0x8f0
[  112.085879][ T4988]  really_probe+0x241/0xa60
[  112.090398][ T4988]  __driver_probe_device+0x20e/0x450
[  112.095701][ T4988]  driver_probe_device+0x4a/0x140
[  112.100747][ T4988]  __device_attach_driver+0x1df/0x320
[  112.106139][ T4988]  bus_for_each_drv+0x159/0x1e0
[  112.110995][ T4988]  __device_attach+0x1e4/0x4d0
[  112.115809][ T4988]  device_initial_probe+0xaf/0xd0
[  112.120854][ T4988]  bus_probe_device+0x64/0x160
[  112.125627][ T4988]  device_add+0x121d/0x1970
[  112.130152][ T4988]  usb_set_configuration+0xd97/0x1c60
[  112.135546][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  112.140930][ T4988]  usb_probe_device+0xef/0x400
[  112.145711][ T4988]  really_probe+0x241/0xa60
[  112.150232][ T4988]  __driver_probe_device+0x20e/0x450
[  112.155541][ T4988]  driver_probe_device+0x4a/0x140
[  112.160585][ T4988]  __device_attach_driver+0x1df/0x320
[  112.165980][ T4988]  bus_for_each_drv+0x159/0x1e0
[  112.170843][ T4988]  __device_attach+0x1e4/0x4d0
[  112.175624][ T4988]  device_initial_probe+0xaf/0xd0
[  112.180666][ T4988]  bus_probe_device+0x64/0x160
[  112.185441][ T4988]  device_add+0x121d/0x1970
[  112.189968][ T4988]  usb_new_device.cold+0x685/0x115c
[  112.195176][ T4988]  hub_event+0x30a3/0x4a60
[  112.199610][ T4988]  process_one_work+0xa23/0x1940
[  112.204553][ T4988]  worker_thread+0x5ef/0xe50
[  112.209145][ T4988]  kthread+0x370/0x450
[  112.213235][ T4988]  ret_from_fork+0x72b/0xd50
[  112.217839][ T4988]  ret_from_fork_asm+0x1a/0x30
[  112.222621][ T4988] 
[  112.224933][ T4988] The buggy address belongs to the object at ffff888036950000
[  112.224933][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  112.238986][ T4988] The buggy address is located 1886 bytes inside of
[  112.238986][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  112.252990][ T4988] 
[  112.255307][ T4988] The buggy address belongs to the physical page:
[  112.261712][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  112.270473][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  112.278970][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  112.286516][ T4988] page_type: f5(slab)
[  112.290502][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  112.299094][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  112.307683][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  112.316358][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  112.325038][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  112.333713][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  112.342373][ T4988] page dumped because: kasan: bad access detected
[  112.348773][ T4988] page_owner tracks the page as allocated
[  112.354473][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  112.375860][ T4988]  post_alloc_hook+0xfd/0x120
[  112.380562][ T4988]  get_page_from_freelist+0xf48/0x3530
[  112.386044][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  112.391960][ T4988]  new_slab+0xa2/0x640
[  112.396043][ T4988]  refill_objects+0xe3/0x410
[  112.400649][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  112.406207][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  112.412649][ T4988]  kmalloc_reserve+0xe8/0x350
[  112.417334][ T4988]  __alloc_skb+0x185/0x710
[  112.421773][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  112.426820][ T4988]  add_grhead+0x299/0x340
[  112.431170][ T4988]  add_grec+0x1389/0x1930
[  112.435518][ T4988]  mld_send_initial_cr+0x156/0x320
[  112.440655][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  112.445769][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  112.451157][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  112.456196][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  112.462512][ T4988]  __free_frozen_pages+0x79f/0x1090
[  112.467987][ T4988]  qlist_free_all+0x47/0xf0
[  112.472513][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  112.478000][ T4988]  __kasan_slab_alloc+0x69/0x90
[  112.482854][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  112.488239][ T4988]  kernfs_fop_open+0x23d/0xd50
[  112.493008][ T4988]  do_dentry_open+0x6ab/0x14d0
[  112.497786][ T4988]  vfs_open+0x82/0x3f0
[  112.501850][ T4988]  path_openat+0x2873/0x4280
[  112.506457][ T4988]  do_file_open+0x20e/0x430
[  112.510976][ T4988]  do_sys_openat2+0x10f/0x1e0
[  112.515653][ T4988]  __x64_sys_openat+0x12d/0x210
[  112.520507][ T4988]  do_syscall_64+0x115/0x870
[  112.525119][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  112.531017][ T4988] 
[  112.533327][ T4988] Memory state around the buggy address:
[  112.538949][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  112.547008][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  112.555066][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  112.563143][ T4988]                                                     ^
[  112.570069][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  112.578129][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  112.586180][ T4988] ==================================================================
[  112.618521][ T4988] ==================================================================
[  112.626616][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  112.633556][ T4988] Read of size 1 at addr ffff88803695075f by task udevd/4988
[  112.640914][ T4988] 
[  112.643230][ T4988] CPU: 1 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  112.643270][ T4988] Tainted: [B]=BAD_PAGE
[  112.643280][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  112.643297][ T4988] Call Trace:
[  112.643306][ T4988]  <TASK>
[  112.643317][ T4988]  dump_stack_lvl+0x100/0x190
[  112.643350][ T4988]  print_report+0x13d/0x4b0
[  112.643390][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.643424][ T4988]  ? __virt_addr_valid+0x239/0x430
[  112.643459][ T4988]  ? string+0x471/0x4d0
[  112.643489][ T4988]  kasan_report+0xdf/0x1c0
[  112.643519][ T4988]  ? string+0x471/0x4d0
[  112.643555][ T4988]  string+0x471/0x4d0
[  112.643587][ T4988]  ? __pfx_string+0x10/0x10
[  112.643623][ T4988]  vsnprintf+0x422/0x1300
[  112.643663][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  112.643698][ T4988]  ? ksys_read+0x12a/0x250
[  112.643735][ T4988]  ? do_syscall_64+0x115/0x870
[  112.643771][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  112.643804][ T4988]  add_uevent_var+0x183/0x3a0
[  112.643835][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  112.643869][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  112.643897][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  112.643924][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  112.643951][ T4988]  dev_uevent+0x2f1/0x870
[  112.643978][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  112.644006][ T4988]  ? kasan_save_track+0x14/0x30
[  112.644068][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.644114][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  112.644158][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.644193][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  112.644232][ T4988]  ? uevent_show+0x166/0x3a0
[  112.644269][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  112.644304][ T4988]  uevent_show+0x1ca/0x3a0
[  112.644338][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.644373][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  112.644408][ T4988]  dev_attr_show+0x52/0xa0
[  112.644452][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  112.644496][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  112.644535][ T4988]  seq_read_iter+0x32f/0x1270
[  112.644573][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.644614][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  112.644645][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.644678][ T4988]  ? rw_verify_area+0xce/0x6d0
[  112.644708][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  112.644741][ T4988]  vfs_read+0x82e/0xb40
[  112.644776][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  112.644809][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.644845][ T4988]  ? find_held_lock+0x2b/0x80
[  112.644886][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  112.644932][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  112.644982][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.645015][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  112.645066][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.645099][ T4988]  ? find_held_lock+0x2b/0x80
[  112.645144][ T4988]  ksys_read+0x12a/0x250
[  112.645192][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  112.645231][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.645265][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  112.645302][ T4988]  do_syscall_64+0x115/0x870
[  112.645341][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  112.645370][ T4988] RIP: 0033:0x7f8363aa7407
[  112.645392][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  112.645419][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  112.645445][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  112.645464][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  112.645482][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  112.645500][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  112.645517][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  112.645545][ T4988]  </TASK>
[  112.645555][ T4988] 
[  113.033177][ T4988] Allocated by task 29:
[  113.037336][ T4988]  kasan_save_stack+0x30/0x50
[  113.042028][ T4988]  kasan_save_track+0x14/0x30
[  113.046719][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  113.051335][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  113.056715][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  113.061733][ T4988]  usb_probe_interface+0x303/0x8f0
[  113.066857][ T4988]  really_probe+0x241/0xa60
[  113.071369][ T4988]  __driver_probe_device+0x20e/0x450
[  113.076662][ T4988]  driver_probe_device+0x4a/0x140
[  113.081695][ T4988]  __device_attach_driver+0x1df/0x320
[  113.087096][ T4988]  bus_for_each_drv+0x159/0x1e0
[  113.091944][ T4988]  __device_attach+0x1e4/0x4d0
[  113.096713][ T4988]  device_initial_probe+0xaf/0xd0
[  113.101744][ T4988]  bus_probe_device+0x64/0x160
[  113.106508][ T4988]  device_add+0x121d/0x1970
[  113.111022][ T4988]  usb_set_configuration+0xd97/0x1c60
[  113.116424][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  113.121797][ T4988]  usb_probe_device+0xef/0x400
[  113.126568][ T4988]  really_probe+0x241/0xa60
[  113.131074][ T4988]  __driver_probe_device+0x20e/0x450
[  113.136399][ T4988]  driver_probe_device+0x4a/0x140
[  113.141430][ T4988]  __device_attach_driver+0x1df/0x320
[  113.146835][ T4988]  bus_for_each_drv+0x159/0x1e0
[  113.151684][ T4988]  __device_attach+0x1e4/0x4d0
[  113.156456][ T4988]  device_initial_probe+0xaf/0xd0
[  113.161493][ T4988]  bus_probe_device+0x64/0x160
[  113.166266][ T4988]  device_add+0x121d/0x1970
[  113.170779][ T4988]  usb_new_device.cold+0x685/0x115c
[  113.175976][ T4988]  hub_event+0x30a3/0x4a60
[  113.180402][ T4988]  process_one_work+0xa23/0x1940
[  113.185335][ T4988]  worker_thread+0x5ef/0xe50
[  113.189934][ T4988]  kthread+0x370/0x450
[  113.194033][ T4988]  ret_from_fork+0x72b/0xd50
[  113.198631][ T4988]  ret_from_fork_asm+0x1a/0x30
[  113.203402][ T4988] 
[  113.205709][ T4988] Freed by task 29:
[  113.209500][ T4988]  kasan_save_stack+0x30/0x50
[  113.214193][ T4988]  kasan_save_track+0x14/0x30
[  113.218918][ T4988]  kasan_save_free_info+0x3b/0x70
[  113.223942][ T4988]  __kasan_slab_free+0x5f/0x80
[  113.228698][ T4988]  kfree+0x22b/0x6c0
[  113.231499][ T5799] misc userio: Buffer overflowed, userio client isn't keeping up
[  113.232591][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  113.245378][ T4988]  usb_probe_interface+0x303/0x8f0
[  113.250530][ T4988]  really_probe+0x241/0xa60
[  113.255062][ T4988]  __driver_probe_device+0x20e/0x450
[  113.260353][ T4988]  driver_probe_device+0x4a/0x140
[  113.265382][ T4988]  __device_attach_driver+0x1df/0x320
[  113.270761][ T4988]  bus_for_each_drv+0x159/0x1e0
[  113.275608][ T4988]  __device_attach+0x1e4/0x4d0
[  113.280377][ T4988]  device_initial_probe+0xaf/0xd0
[  113.285412][ T4988]  bus_probe_device+0x64/0x160
[  113.290199][ T4988]  device_add+0x121d/0x1970
[  113.294730][ T4988]  usb_set_configuration+0xd97/0x1c60
[  113.300113][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  113.305492][ T4988]  usb_probe_device+0xef/0x400
[  113.310287][ T4988]  really_probe+0x241/0xa60
[  113.314813][ T4988]  __driver_probe_device+0x20e/0x450
[  113.320103][ T4988]  driver_probe_device+0x4a/0x140
[  113.325131][ T4988]  __device_attach_driver+0x1df/0x320
[  113.330508][ T4988]  bus_for_each_drv+0x159/0x1e0
[  113.335357][ T4988]  __device_attach+0x1e4/0x4d0
[  113.340126][ T4988]  device_initial_probe+0xaf/0xd0
[  113.345163][ T4988]  bus_probe_device+0x64/0x160
[  113.349933][ T4988]  device_add+0x121d/0x1970
[  113.354466][ T4988]  usb_new_device.cold+0x685/0x115c
[  113.359661][ T4988]  hub_event+0x30a3/0x4a60
[  113.364100][ T4988]  process_one_work+0xa23/0x1940
[  113.369032][ T4988]  worker_thread+0x5ef/0xe50
[  113.373619][ T4988]  kthread+0x370/0x450
[  113.377698][ T4988]  ret_from_fork+0x72b/0xd50
[  113.382291][ T4988]  ret_from_fork_asm+0x1a/0x30
[  113.387060][ T4988] 
[  113.389373][ T4988] The buggy address belongs to the object at ffff888036950000
[  113.389373][ T4988]  which belongs to the cache kmalloc-2k of size 2048
[  113.403432][ T4988] The buggy address is located 1887 bytes inside of
[  113.403432][ T4988]  freed 2048-byte region [ffff888036950000, ffff888036950800)
[  113.417393][ T4988] 
[  113.419702][ T4988] The buggy address belongs to the physical page:
[  113.426094][ T4988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36950
[  113.434845][ T4988] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  113.443333][ T4988] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  113.450869][ T4988] page_type: f5(slab)
[  113.454854][ T4988] raw: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  113.463431][ T4988] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  113.472009][ T4988] head: 00fff00000000040 ffff88813fe22000 dead000000000100 dead000000000122
[  113.480695][ T4988] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[  113.489365][ T4988] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  113.498030][ T4988] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  113.506689][ T4988] page dumped because: kasan: bad access detected
[  113.513083][ T4988] page_owner tracks the page as allocated
[  113.518778][ T4988] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1012, tgid 1012 (kworker/u8:7), ts 90131518893, free_ts 88383830410
[  113.540142][ T4988]  post_alloc_hook+0xfd/0x120
[  113.544832][ T4988]  get_page_from_freelist+0xf48/0x3530
[  113.550296][ T4988]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  113.556198][ T4988]  new_slab+0xa2/0x640
[  113.560270][ T4988]  refill_objects+0xe3/0x410
[  113.564863][ T4988]  __pcs_replace_empty_main+0x376/0x680
[  113.570412][ T4988]  __kmalloc_node_track_caller_noprof+0x679/0x830
[  113.576838][ T4988]  kmalloc_reserve+0xe8/0x350
[  113.581515][ T4988]  __alloc_skb+0x185/0x710
[  113.585958][ T4988]  mld_newpack.isra.0+0x18e/0xa20
[  113.590991][ T4988]  add_grhead+0x299/0x340
[  113.595337][ T4988]  add_grec+0x1389/0x1930
[  113.599693][ T4988]  mld_send_initial_cr+0x156/0x320
[  113.604821][ T4988]  ipv6_mc_dad_complete+0xa7/0x1d0
[  113.609933][ T4988]  addrconf_dad_completed+0xb55/0xff0
[  113.615311][ T4988]  addrconf_dad_work+0xb1e/0x1360
[  113.620342][ T4988] page last free pid 5647 tgid 5647 stack trace:
[  113.626656][ T4988]  __free_frozen_pages+0x79f/0x1090
[  113.631855][ T4988]  qlist_free_all+0x47/0xf0
[  113.636366][ T4988]  kasan_quarantine_reduce+0x1a0/0x1f0
[  113.641833][ T4988]  __kasan_slab_alloc+0x69/0x90
[  113.646679][ T4988]  __kmalloc_cache_noprof+0x265/0x6c0
[  113.652061][ T4988]  kernfs_fop_open+0x23d/0xd50
[  113.656831][ T4988]  do_dentry_open+0x6ab/0x14d0
[  113.661599][ T4988]  vfs_open+0x82/0x3f0
[  113.665662][ T4988]  path_openat+0x2873/0x4280
[  113.670258][ T4988]  do_file_open+0x20e/0x430
[  113.674767][ T4988]  do_sys_openat2+0x10f/0x1e0
[  113.679439][ T4988]  __x64_sys_openat+0x12d/0x210
[  113.684305][ T4988]  do_syscall_64+0x115/0x870
[  113.688902][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.694792][ T4988] 
[  113.697104][ T4988] Memory state around the buggy address:
[  113.702729][ T4988]  ffff888036950600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.710782][ T4988]  ffff888036950680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.718835][ T4988] >ffff888036950700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.726880][ T4988]                                                     ^
[  113.733800][ T4988]  ffff888036950780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.741851][ T4988]  ffff888036950800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  113.749983][ T4988] ==================================================================
[  113.766342][ T4988] ==================================================================
[  113.774419][ T4988] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  113.781376][ T4988] Read of size 1 at addr ffff888036950760 by task udevd/4988
[  113.788734][ T4988] 
[  113.791058][ T4988] CPU: 1 UID: 0 PID: 4988 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  113.791099][ T4988] Tainted: [B]=BAD_PAGE
[  113.791109][ T4988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  113.791127][ T4988] Call Trace:
[  113.791136][ T4988]  <TASK>
[  113.791147][ T4988]  dump_stack_lvl+0x100/0x190
[  113.791180][ T4988]  print_report+0x13d/0x4b0
[  113.791221][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.791256][ T4988]  ? __virt_addr_valid+0x239/0x430
[  113.791290][ T4988]  ? string+0x471/0x4d0
[  113.791321][ T4988]  kasan_report+0xdf/0x1c0
[  113.791352][ T4988]  ? string+0x471/0x4d0
[  113.791386][ T4988]  string+0x471/0x4d0
[  113.791418][ T4988]  ? __pfx_string+0x10/0x10
[  113.791466][ T4988]  vsnprintf+0x422/0x1300
[  113.791513][ T4988]  ? __pfx_vsnprintf+0x10/0x10
[  113.791550][ T4988]  ? ksys_read+0x12a/0x250
[  113.791583][ T4988]  ? do_syscall_64+0x115/0x870
[  113.791621][ T4988]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.791653][ T4988]  add_uevent_var+0x183/0x3a0
[  113.791694][ T4988]  ? __pfx_add_uevent_var+0x10/0x10
[  113.791741][ T4988]  ? rc_dev_uevent+0x12d/0x1c0
[  113.791772][ T4988]  ? __pfx_rc_dev_uevent+0x10/0x10
[  113.791799][ T4988]  rc_dev_uevent+0x17d/0x1c0
[  113.791827][ T4988]  dev_uevent+0x2f1/0x870
[  113.791854][ T4988]  ? __pfx_dev_uevent+0x10/0x10
[  113.791879][ T4988]  ? kasan_save_track+0x14/0x30
[  113.791923][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.791956][ T4988]  ? __kasan_kmalloc+0xaa/0xb0
[  113.792000][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792033][ T4988]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  113.792077][ T4988]  ? uevent_show+0x166/0x3a0
[  113.792114][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  113.792149][ T4988]  uevent_show+0x1ca/0x3a0
[  113.792184][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792219][ T4988]  ? __pfx_uevent_show+0x10/0x10
[  113.792254][ T4988]  dev_attr_show+0x52/0xa0
[  113.792298][ T4988]  ? __pfx_dev_attr_show+0x10/0x10
[  113.792343][ T4988]  sysfs_kf_seq_show+0x217/0x3f0
[  113.792382][ T4988]  seq_read_iter+0x32f/0x1270
[  113.792419][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792460][ T4988]  kernfs_fop_read_iter+0x46c/0x610
[  113.792491][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792525][ T4988]  ? rw_verify_area+0xce/0x6d0
[  113.792557][ T4988]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  113.792590][ T4988]  vfs_read+0x82e/0xb40
[  113.792626][ T4988]  ? __pfx_vfs_read+0x10/0x10
[  113.792659][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792695][ T4988]  ? find_held_lock+0x2b/0x80
[  113.792751][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  113.792815][ T4988]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  113.792870][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792904][ T4988]  ? count_memcg_events_mm.constprop.0+0x109/0x2a0
[  113.792950][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.792984][ T4988]  ? find_held_lock+0x2b/0x80
[  113.793026][ T4988]  ksys_read+0x12a/0x250
[  113.793066][ T4988]  ? __pfx_ksys_read+0x10/0x10
[  113.793101][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.793136][ T4988]  ? srso_alias_return_thunk+0x5/0xfbef5
[  113.793173][ T4988]  do_syscall_64+0x115/0x870
[  113.793213][ T4988]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.793242][ T4988] RIP: 0033:0x7f8363aa7407
[  113.793264][ T4988] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  113.793292][ T4988] RSP: 002b:00007ffdc68c45c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  113.793319][ T4988] RAX: ffffffffffffffda RBX: 00007f836419b880 RCX: 00007f8363aa7407
[  113.793338][ T4988] RDX: 0000000000001000 RSI: 000056505f3697d0 RDI: 000000000000000c
[  113.793357][ T4988] RBP: 00007f8363befff0 R08: 0000000000000000 R09: 0000000000000000
[  113.793375][ T4988] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  113.793393][ T4988] R13: 00007f8363befea0 R14: 0000000000000000 R15: 000056505f24dfe0
[  113.793420][ T4988]  </TASK>
[  113.793430][ T4988] 
[  114.180821][ T4988] Allocated by task 29:
[  114.184969][ T4988]  kasan_save_stack+0x30/0x50
[  114.189681][ T4988]  kasan_save_track+0x14/0x30
[  114.194394][ T4988]  __kasan_kmalloc+0xaa/0xb0
[  114.199009][ T4988]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  114.204400][ T4988]  redrat3_dev_probe+0x326/0x2b50
[  114.209429][ T4988]  usb_probe_interface+0x303/0x8f0
[  114.214571][ T4988]  really_probe+0x241/0xa60
[  114.219106][ T4988]  __driver_probe_device+0x20e/0x450
[  114.224410][ T4988]  driver_probe_device+0x4a/0x140
[  114.229457][ T4988]  __device_attach_driver+0x1df/0x320
[  114.234849][ T4988]  bus_for_each_drv+0x159/0x1e0
[  114.239709][ T4988]  __device_attach+0x1e4/0x4d0
[  114.244493][ T4988]  device_initial_probe+0xaf/0xd0
[  114.249539][ T4988]  bus_probe_device+0x64/0x160
[  114.254313][ T4988]  device_add+0x121d/0x1970
[  114.258840][ T4988]  usb_set_configuration+0xd97/0x1c60
[  114.264233][ T4988]  usb_generic_driver_probe+0xa1/0xe0
[  114.269616][ T4988]  usb_probe_device+0xef/0x400
[  114.274401][ T4988]  really_probe+0x241/0xa60
[  114.278920][ T4988]  __driver_probe_device+0x20e/0x450
[  114.284225][ T4988]  driver_probe_device+0x4a/0x140
[  114.289269][ T4988]  __device_attach_driver+0x1df/0x320
[  114.294661][ T4988]  bus_for_each_drv+0x159/0x1e0
[  114.299521][ T4988]  __device_attach+0x1e4/0x4d0
[  114.304301][ T4988]  device_initial_probe+0xaf/0xd0
[  114.309344][ T4988]  bus_probe_device+0x64/0x160
[  114.314117][ T4988]  device_add+0x121d/0x1970
[  114.318648][ T4988]  usb_new_device.cold+0x685/0x115c
[  114.323862][ T4988]  hub_event+0x30a3/0x4a60
[  114.328299][ T4988]  process_one_work+0xa23/0x1940
[  114.333238][ T4988]  worker_thread+0x5ef/0xe50
[  114.337832][ T4988]  kthread+0x370/0x450
[  114.341925][ T4988]  ret_from_fork+0x72b/0xd50
[  114.346529][ T4988]  ret_from_fork_asm+0x1a/0x30
[  114.351308][ T4988] 
[  114.353619][ T4988] Freed by task 29:
[  114.357418][ T4988]  kasan_save_stack+0x30/0x50
[  114.362122][ T4988]  kasan_save_track+0x14/0x30
[  114.366824][ T4988]  kasan_save_free_info+0x3b/0x70
[  114.371865][ T4988]  __kasan_slab_free+0x5f/0x80
[  114.376631][ T4988]  kfree+0x22b/0x6c0
[  114.380538][ T4988]  redrat3_dev_probe+0x107a/0x2b50
[  114.385649][ T4988]  usb_probe_interface+0x303/0x8f0
[  114.390814][ T4988]  really_probe+0x241/0xa60
[  114.395335][ T4988]  __driver_probe_device+0x20e/0x450
[  114.400640][ T4988]  driver_probe_device+0x4a/0x140
[  114.405683][ T4988]  __device_attach_driver+0x1df/0x320
[  114.411076][ T4988]  bus_for_each_drv+0x159/0x1e0
[  114.415933][ T4988]  __device_attach+0x1e4/0x4d0
[  114.420715][ T4988]  device_initial_probe+0xaf/0xd0