last executing test programs: 33.087077577s ago: executing program 2 (id=517): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x1800, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x15) setuid(0xee00) fchmodat(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0xfffffe42) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x4a040, 0x0) 33.05509489s ago: executing program 2 (id=518): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x400, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x0, 0x21) fsync(r0) 33.026183493s ago: executing program 2 (id=520): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@loopback, 0x0, 0x8, 0x0, 0x0, 0xa}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a"], 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 32.999932286s ago: executing program 2 (id=524): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./bus\x00', 0xe, &(0x7f0000000100)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x6}}]}, 0x1, 0x453, &(0x7f0000000400)="$eJzs3M2PE+UfAPDvTLfw2x/grogvvKiraNz4sssCKgcPajTxgImJHvS42V0IUljDrokQomAMnowx8W48+i940osxnky86t2QEMMF8FQz7czSlrbslnaL9vNJBp5n5pk+z7czT/vMPJ0NYGRNZf8kEdsj4veImKhnmwtM1f+7fvX8wo2r5xeSqFbf/iuplbt29fxCUbTYb1uemU4j0s+S2Num3pWz507OVypLZ/L87OqpD2ZXzp577sSp+eNLx5dOHzxy5PChuRdfOPh8X+LM2nRtz8fL+3a/8d5Xbx79oin+ljj6ZKrbxier1T5XN1w7GtLJ2BAbwoaUIiI7XOVa/5+IUtw8eBPx+qdDbRwwUNVqtbqt8+YLVeA/LInmvC4Po6L4os+uf4uldRDw8uCGH0N35ZX6BVAW9/V8qW8ZizQvU265vu2nqYh498Lf32RLDOY+BABAkx+y8c+z7cZ/aTzQUO6efG5oMiLujYidEXFfROyKiPsjamUfjIiHNlh/6yTJreOf9HJPga1TNv57KZ/bah7/FaO/mCzluR21+MvJsROVpQP5ezId5a1Zfq5LHT++9tuXnbY1jv+yJau/GAvm7bg8trV5n8X51fk7ibnRlYsRe8baxZ+szQQkEbE7Ivb0WMeJp7/b12nb7ePvog/zTNVvI56qH/8L0RJ/Iek+Pzn7v6gsHZgtzopb/fLrpbc61X9H8fdBdvz/3/b8X4t/Mmmcr13ZeB2X/vi84zVNr+f/luSdWnpLvu6j+dXVM3MRW5Kj9UY3rj94c98iX5TP4p/e377/74yb78TeiMhO4ocj4pGIeDRv+2MR8XhE7O8S/8+vPvF+7/EPVhb/4oaO/1piPKJlTYdE6eRP3zdVOnlL/De6H//DtdR0vmY9n3/raVdvZzMAAAD8+6QRsT2SdGYtnaYzM/Xfy++KSCvLK6vPHFv+8PRi/RmBySinxZ2uiYb7oXP5ZX09fzEi6j8tKLYfyu8bf10ar+VnFpYri8MOHkbcttosRl1j/8/8WRpeu4BN4nktGF36P4wu/R9Gl/4Po6tN/x8fRjuAzZf1/9Y/s/XJkNoCbK6W73/TfjBCXP/D6NL/YXTp/zCSVsbj9g/Jd00Ur9Tj7ndTotrPF4zysMMZbCLSu6IZEgNKDPdzCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoF/+CQAA///E5ODv") mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./file2\x00', 0x181) mount$overlay(0x0, &(0x7f00000008c0)='./file0\x00', &(0x7f0000000900), 0x0, &(0x7f0000000940)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000980), &(0x7f00000009c0)='./file0\x00', 0x14a0, &(0x7f0000000a00)=ANY=[], 0x1, 0x0, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x8000, 0x50) getdents(r0, 0x0, 0x0) 32.926825203s ago: executing program 2 (id=525): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='hfsplus\x00', 0x8041, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000001c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000300)={0x4, 0x0, 0x0, 0x170, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@linear={0x0, 0x2000, 0x0, 0x38, 'linear\x00', {@ram={'/dev/ram', 0x0}, 0x20, '0'}}]}) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x5800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_DEV_REMOVE(r0, 0xc138fd04, 0x0) 32.819154184s ago: executing program 2 (id=526): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000980)={0x0, 0x0, 0x0}, &(0x7f00000009c0)=0xc) syz_mount_image$exfat(&(0x7f0000000a00), &(0x7f0000000a40)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x20000848, &(0x7f0000000b40)=ANY=[@ANYBLOB='iocharset=ascii,discard,dmask=00000000000000000000007,uid=', @ANYRESHEX=r2, @ANYBLOB="00646d61c6d62d303030303030303030303030303135322c696f433161720300000069736f380000000000", @ANYRES16=r3, @ANYRES64=r0, @ANYRES32=r1, @ANYRESHEX=r1], 0x81, 0x14f5, &(0x7f0000000c00)="$eJzs3AlwVUX2MPA+3X0hxIjPiCyBPn0uPDFAExERWURAFhERERER2URAxIiIiIAKAdlEDIgIiCwRkSUgILLEEJF93/fNyCBGREQ2ARHor3D8DzN/5/935pv5Pqom51fVlT6595zXnZPKu/dWvXzffXidZnVrNiEi8S+BP39JEULECCEGCyFuEEIEQogK8RXirxzPpyDlX3sR9u/1aPq1XgG7lrj/uRv3P3fj/udu3P/cjfufu3H/czfuf+7G/WcsN9syo8iNPHLv4Of/uRm///8HySk7/ut1ZW/u8U+kcP9zN+7/f5y8/8zJ3P/cjfufu3H/czfu/3++Gv/LMe5/7sb9Zyw3u9bPn3lc23Gtf/8YY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjOUO5/1VWgjxX/NrvS7GGGOMMcYYY4z9+/i813oFjDHGGGOMMcYY+38PhBRKaBGIPCKviBH5RKy4TsSJ60V+cYOIiBtFvLhJFBA3i4KikCgsiogEUVQUE0agsIJEKIqLEiIqbhElxa0iUZQSpUUZ4URZkSRuE+XE7aK8uENUEHeKiuIuUUlUFlVEVXG3qCbuEdVFDVFT3Ctqidqijqgr7hP1xP2ivnhANBAPiobiIdFIPCwai0dEE/GoaCoeE83E46K5eEK0EC1FK9FatPm/yn9FvCpeE71FH5Ei+op+4nXRXwwQA8UgMVi8IYaIN8VQ8ZZIFcPEcPG2GCHeESPFu2KUGC3GiPfEWPG+GCfGiwliokgTH4hJ4kMxWXwkpoipYpqYLtLFDDFTfCxmidlijvhEzBWfinlivlggFooM8ZnIFItElvhcLBZfiCViqVgmlosVYqVYJVaLNWKtWCfWiw1io9gkNostYqvYJraLHWKn2CV2iz1ir9gn9osD4kuRLb76J/PP/bf8HiBAgAQJGjTkgTwQAzEQC7EQB3GQH/JDBCIQD/FQAApAQSgIhaEwJEACFINigIBAQFAcikMUolASSkIiJEJpKA0OHCRBEpSD26E8lIcKUAEqQkWoBJWhMlSFqlANqkF1qA41oSbUglpQB+rAfXAf3A/1oT40gAbQEBpCI2gEjaExNIEm0BSaQjNoBs2hObSAFtAKWkEbaANtoS20g3bQATpAR+gInaATJEMydIbO0AW6QFfoCt2gG3SH7tADekJPeAVegdfgNegDQvSFftAP+kN/GAiDYBC8AUPgTXgT3oJUGAbD4W14G96BkXAWRsFoGANjoJp8H8bBeCA5EdIgDSbBJJgMk2EKTIWpMB3SYQbMhJkwC2bDbPgE5sKn8CnMh/mwEDIgAzJhEWRBFiyGc7AElsIyWA4rYCWsgNWwBlbDOlgP62AjbITNsBm2wlbYDtthJ+yE3bAb9sJe2A/7IRWyIRsOwkE4BIfgMByGHMiBI3AEjsJROAbH4DgchxNwEk7BSTgDZ+AsnIPzcB4uwAW4CC8lfNt0d6m1qUJeoaWWeWQeGSNjZKyMlXEyTuaX+WVERmS8jJcFZAFZUBaUhWVhmSATZDFZTKJESTKUxWVxGZVRWVKWlIkyUZaWpaWTTibJJFlOlpPlZXlZQd4pK8q7ZCVZWbZ3VWVVWU12cNVlDVlT1pS1ZG1ZR9aVdWU9WU/Wl/VlA9lANpQNZSP5sGws+8JAeFRe6UwzOQyay+HQQraUrWRr+Q48KdvKkdBOtpcd5NNyNIyCTrKtS5bPyc5yHHSRL8jx8KLsJidCd/my7CF7yl7yFfmqbOd6yz5yCvSV/eR06C8HyIFykJwFteWVjtWRb8lUOUwOl2/LhfCOHCnflaPkaDlGvifHyvflODleTpATZZr8QE6SH8rJ8iM5RU6V0+R0mS5nyJnyYzlLzpZz5CdyrvxUzpPz5QK5UGbIz2SmXCSz5OdysfxCLpFL5TK5XK6QK+UquVqukWvlOrlebpAb5Sa5WW6RW+U2uV3ukDvlLrlb7pF75T65Xx6QX8ps+ZU8KP8kD8mv5WH5jcyR38oj8jt5VH4vj8kf5HH5ozwhT8pT8rQ8I3+SZ+U5eV7+LC/IX+RFeUlell4KBUoqpbQKVB6VV8WofCpWXafi1PUqv7pBRdSNKl7dpAqom1VBVUgVVkVUgiqqiimjUFlFKlTFVQkVVbeokupWlahKqdKqjHKqrEpSt6ly6nZVXt2hKqg7VUV1l6qkKqsqqqq6W1VT96jqqoaqqe5VtVRtVUfVVfepeup+VV89oBqoB1VD9ZBqpB5WjdUjqol6VDVVj6lm6nHVXD2hWqiWqpVqrdqoJ1Vb9ZRqp9qrDupp1VE9ozqpZ1Wyek51Vs+rLuoF1VW9qLqpl1R39bLqoXqqXuqSuqy86q36qBTVV/VTr6v+aoAaqAapweoNNUS9qYaqt1SqGqaGq7fVCPWOGqneVaPUaDVGvafGqvfVODVeTVATVZr6QE1SH6rJ6iM1RU1V09R0la5mqIG/VZrzD+R/+Hfyh/766pvVFrVVbVPb1Q61U+1Su9UetUftU/vUAXVAZatsdVAdVIfUIXVYHVY5KkcdUUfUUXVUHVPH1HF1XJ1QJ9XP6rQ6o35SZ9U5dU79rC6oC+ribz8DoUFLrbTWgc6j8+oYnU/H6ut0nL5e59c36Ii+Ucfrm3QBfbMuqAvpwrqITtBFdTFtNGqrSYe6uC6ho/oWXVLfqhN1KV1al9FOl9VJ+rZ/Of+P1tdGt9FtdVvdTrfTHXQH3VF31J10J52sk3Vn3Vl30V10V91Vd9PddHfdXffQPXQv3Uu/ql/VvXVvnaJTdD/9uu6vB+iBepAerN/QQ/QQPVQP1ak6VQ/Xw/UIPUKP1CP1KD1Kj9Fj9Fg9Vo/T4/QEPUGn6TQ9SU/Sk/VkPUVP0dP0NJ2u0/VMPVPP0rP0HD1Hz9Vz9Tw9Ty/QC3SGztCZOlNn6Sy9WC/WS/RSvVQv18v1Sr1Sr9ar9Vq9Vq/X6/VGvVEv0Vv0Fr1Nb9M79A69S+/Se/QevU/v0wf0AZ2ts/VBfVAf0of0YX1Y5+gcfUQf0Uf1UX1MH9PH9XF9Qp/Qp/QpfUaf0Wf1WX1en9cX9AV9UV/Ul/XlK5d9gQxkoAMd5AnyBDFBTBAbxAZxQVyQP8gfRIJIEB/EBwWCm4OCQaGgcFAkSAiKBsUCE2BgAwrCoHhQIogGtwQlg1uDxKBUUDooE7igbJAU3BaUC24Pygd3BBWCO4OKwV1BpaByUCWoGtwdVAvuCaoHNYKawb1BraB2UCeoG9wX1AvuD+oHDwQNggeDhsFDQaPg4aBx8EjQJHg0aBo8FjQLHg+aB08ELYKWQaugddDm31rf+7OFnnK9TR+TYvqafuZ1098MMAPNIDPYvGGGmDfNUPOWSTXDzHDzthlh3jEjzbtmlBltxpj3zNjdMWacGW8mmIkmzXxgJpkPzWTzkZlippppZrpJNzPMTPOxmWVmmznmEzPXfGrmmflmgVloMsxnJtMsMlnmc7PYfGGWmKVmmVluVpiVZpVZbdaYtWadWW82mI1mk9lstpitZpvZbnaYnWaX2W32mL1mn9lvDpgvTbb5yhw0fzKHzNfmsPnG5JhvzRHznTlqvjfHzA/muPnRnDAnzSlz2pwxP5mz5pw5b342F8wv5qK5ZC4bf+Xi/srbO2rUmAfzYAzGYCzGYhzGYX7MjxGMYDzGYwEsgAWxIBbGwpiACVgMi+EVhITFsThGMYolsSQmYiKWxtLo0GESJmE5LIflsTxWwApYEStiJayEVbAK3o134z14D9bAGngv3ou1sTbWxbpYD+thfayPDbABNsSG2AgbYWNsjE2wCTbFptgMm2FzbI4tsAW2wlbYBttgW2yL7bAddsAO2BE7YifshMmYjJ2xM3bBLtgVu2I37IbdsTv2wB7YC3vhq/gq9sbemIIp2A/7YX/sjwNxIA7GwTgEh+BQHIqpmIrDcTiOwBE4EkfiKByNY/A9HIvv4zgcjxNwIqZhGk7CSTgZJ+MUnILTcBqmYzrOxJk4C2fhHJyDc3EuzsN5uAAXYAZmYCZmYhZm4WJcjEuwIy7DZbgCV+AqXIVrcA2uw3W4ATfgJtyEW3ALbsNtuAN34C7chXtwD+7DfXgAD2A2ZuNBPIiH8BAexsOYgzl4BI/gUTyKx/AYHsfjeAJP4Ck8hWfwDJ7Fs3gez+MF/AUv4iW8jB5jrBSx9jobZ6+3+e0NNsbms38dF7ZFbIItaotZYwvaQn8To7U20ZaypW0Z62xZm2Rv+11cyVa2VWxVe7etZu+x1X8X17P32/r2AdvAPmjr2vv+Jm5oH7KN7OO2sX3CNrEtbVPb2jazj9vm9gnbwra0rWxr29E+YzvZZ22yfc52ts//Ls60i+wau9aus+vtPrvfnrc/26P2e3vB/mJ72z52sH3DDrFv2qH2LZtqh/0uHmPfs2Pt+3acHW8n2Im/i6fZ6TbdzrAz7cd2lp39uzjDfmbn2iw7z863C+zCX+Mra8qyn9vF9gu7xC61y+xyu8KutKvs6r+sdbndaDfZzXaP3Wu32e12h91pd9ndv8ZX9nHAfmmz7Vf2iP3OHrJf28P2mM2x3/4aX9nfMfuDPW5/tCfsSXvKnrZn7E/2rD336/6v7P20vWQvW28FAUlSpCmgPJSXYigfxdJ1FEfXU366gSJ0I8XTTVSAbqaCVIgKUxFKoKJUjAwhWSIKqTiVoCjdQiXpVkqkUlSaypCjspREt1E5up3K0x1Uge6kinQXVaLKVIWq0t1Uje6h6lSDatK9VItqUx2qS/dRPbqf6tMD1IAepIb0EDWih6kxPUJN6FFqSo9RM3qcmtMT1IJaUitqTW3oSWpLT1E7ak8d6GnqSM9QJ3qWkuk56kzPUxd6gbrSi9SNXqLu9DL1oJ7UC078+cMP1IdSqC/1o9epPw2ggTSIBtMbNITepKH0FqXSMBpOb9MIeodG0rs0ikbTGHqPxtL7NI7G0wSaSGn0AU2iD2kyfURTaCpNo+mUTjNoJn1Ms2g2zaFPaC59SvNoPi2ghZRBn1EmLaIs+pwW0xe0hJbSMlpOK2glraLVtIbW0jpaTxtoI22izbSFttI22k47aCftot20h/bSPtpPB+hLyqav6CD9iQ7R13SYvqEc+paO0Hd0lL6nY/QDHacf6QSdpFN0ms7QT3SWztF5+pku0C90kS7RZfIkQghlqEIdBmGeMG8YE+YLY8Prwrjw+jB/eEMYCW8M48ObwgLhzWHBsFBYOCwSJoRFw2KhCTG0IYVhWDwsEUbDW8KS4a1hYlgqLB2WCV1YNkwKbwvLhbeH5cM7wgrhnWHF8K6wUlg5fPzBquHdYbXwnrB6WCOsGd4b1gprh3XCuuF9Yb3w/rB++EDYIHwwLB8+FDYKHw4bh4+ETcJHw6bhY2Gz8PGwefhE2CJsGbYKW4dtwifDtuFTYbuwfdghfDrsGD4TdgqfDZPD58LO4fN/eDwl7Bv2C18PXw+9f0AtiC6MZkQ/i2ZGF0Wzop9HF0e/iC6JLo0uiy6ProiujK6Kro6uia6Nrouuj26Iboxuim6Oel83r3DgpFNOu8DlcXldjMvnYt11Ls5d7/K7G1zE3eji3U2ugLvZFXSFXGFXxCW4oq6YMw6ddeRCV9yVcFF3iyvpbnWJrpQr7co458q6JNfatXFtXFv3lGvn2rsO7mn3tHvGPeOedc+651xn97zr4l5wXd2Lrpt7yb3kXnY9XE/Xy73iXnWvud6uj0txKa6f6+f6u/5uoBvoBrvBbogb4oa6oS7Vpbrhbrgb4Ua4kW6kG+VGuTFujBvrxrpxbpyb4Ca4NJfmJrlJbrKb7Ka4KW6am+bSXbqb6Wa6WW6Wm+PmuLmJc908N88tcAtchstwmS7TZbkst9gtdkvcErfMLXMr3Aq3yq1ya9wat86tcxvcBrfJbXJb3Ba3zW1zO9wOt8vtcnvcHrfP7XMH3AGX7bLdQXfQHXKH3GH3jctx37oj7jt31H3vjrkf3HH3ozvhTrpT7rQ7435y6rfnnRfcL+6iu+QuO+/SIh9EJkU+jEyOfBSZEpkamRaZHkmPzIjMjHwcmRWZHZkT+SQyN/JpZF5kfmRBZGEkI/JZJDOyKJIV+TyyOPJFZElkaWRZZHlkRWRlxPui20Jf3JfwUX+LL+lv9Ym+lC/ty3jny/okf5sv52/35f0dvoK/01f0d/lKvrKv4p/wLXxL38q39m38k76tf8q38+19B/+07+if8Z38sz7ZP+c7++d9F/+C7+pf9N38S767f9n38D19L/+Kf9W/5nv7Pj7F9/X9/Ou+vx/gB/pBfrB/ww/xb/qh/i2f6of54f5tP8K/40f6d/0oP9qP8e/5sf59P86P9xP8RJ/mP/CT/Id+sv/IT/FT/TQ/3af7GX6m/9jP8rP9HP+Jn+s/9fP8fL/AL/QZ/jOf6Rf5LP+5X+y/8Ev8Ur/ML/cr/Eq/yq/2a/xav86v9xv8Rr/Jb/Zb/Fa/zW/3O/xOv8vv9nv8Xr/P7/cH/Jc+23/lD/o/+UP+a3/Yf+Nz/Lf+iP/OH/Xf+2P+B3/c/+hP+JP+lD/tz/if/Fl/zp/3P/sL/hd/0V/yl/kza4wxxhhj/xD1B8f7/p3vyd/GFf2EENdvL5Lz32tuKPjn+QCZ0DEihHiuT/dH/2vUqpWSkvLbuUuUCErMF0JErubnEX+J9VLRQTwjkkV7Ue7vrm+A7HmB/qB+9E4hYv8qJ0Zcja/Wv/1/qP/k02MyK4bn4/+X+vOFSCxxNSefuBpfrV/+f6hfqO0frD/f12lCtPurnDhxNb5aP0k8JZ4XyX9zJmOMMcYYY4wx9mcDZJWuf3T/fOX+PEFfzckrrsZ/dH/OGGOMMcYYY4yxa+/Fnr2efTI5uX1XnvCEJzz5y+Ra/2VijDHGGGOM/btdvei/1ithjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcZyr/8f/07sWu+RMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYu9b+TwAAAP//4ok7tg==") mount$bind(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x81899, 0x0) chroot(&(0x7f0000000300)='./file0/file0\x00') lstat(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000380)) 32.810444915s ago: executing program 32 (id=526): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000980)={0x0, 0x0, 0x0}, &(0x7f00000009c0)=0xc) syz_mount_image$exfat(&(0x7f0000000a00), &(0x7f0000000a40)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x20000848, &(0x7f0000000b40)=ANY=[@ANYBLOB='iocharset=ascii,discard,dmask=00000000000000000000007,uid=', @ANYRESHEX=r2, @ANYBLOB="00646d61c6d62d303030303030303030303030303135322c696f433161720300000069736f380000000000", @ANYRES16=r3, @ANYRES64=r0, @ANYRES32=r1, @ANYRESHEX=r1], 0x81, 0x14f5, &(0x7f0000000c00)="$eJzs3AlwVUX2MPA+3X0hxIjPiCyBPn0uPDFAExERWURAFhERERER2URAxIiIiIAKAdlEDIgIiCwRkSUgILLEEJF93/fNyCBGREQ2ARHor3D8DzN/5/935pv5Pqom51fVlT6595zXnZPKu/dWvXzffXidZnVrNiEi8S+BP39JEULECCEGCyFuEEIEQogK8RXirxzPpyDlX3sR9u/1aPq1XgG7lrj/uRv3P3fj/udu3P/cjfufu3H/czfuf+7G/WcsN9syo8iNPHLv4Of/uRm///8HySk7/ut1ZW/u8U+kcP9zN+7/f5y8/8zJ3P/cjfufu3H/czfu/3++Gv/LMe5/7sb9Zyw3u9bPn3lc23Gtf/8YY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjOUO5/1VWgjxX/NrvS7GGGOMMcYYY4z9+/i813oFjDHGGGOMMcYY+38PhBRKaBGIPCKviBH5RKy4TsSJ60V+cYOIiBtFvLhJFBA3i4KikCgsiogEUVQUE0agsIJEKIqLEiIqbhElxa0iUZQSpUUZ4URZkSRuE+XE7aK8uENUEHeKiuIuUUlUFlVEVXG3qCbuEdVFDVFT3Ctqidqijqgr7hP1xP2ivnhANBAPiobiIdFIPCwai0dEE/GoaCoeE83E46K5eEK0EC1FK9FatPm/yn9FvCpeE71FH5Ei+op+4nXRXwwQA8UgMVi8IYaIN8VQ8ZZIFcPEcPG2GCHeESPFu2KUGC3GiPfEWPG+GCfGiwliokgTH4hJ4kMxWXwkpoipYpqYLtLFDDFTfCxmidlijvhEzBWfinlivlggFooM8ZnIFItElvhcLBZfiCViqVgmlosVYqVYJVaLNWKtWCfWiw1io9gkNostYqvYJraLHWKn2CV2iz1ir9gn9osD4kuRLb76J/PP/bf8HiBAgAQJGjTkgTwQAzEQC7EQB3GQH/JDBCIQD/FQAApAQSgIhaEwJEACFINigIBAQFAcikMUolASSkIiJEJpKA0OHCRBEpSD26E8lIcKUAEqQkWoBJWhMlSFqlANqkF1qA41oSbUglpQB+rAfXAf3A/1oT40gAbQEBpCI2gEjaExNIEm0BSaQjNoBs2hObSAFtAKWkEbaANtoS20g3bQATpAR+gInaATJEMydIbO0AW6QFfoCt2gG3SH7tADekJPeAVegdfgNegDQvSFftAP+kN/GAiDYBC8AUPgTXgT3oJUGAbD4W14G96BkXAWRsFoGANjoJp8H8bBeCA5EdIgDSbBJJgMk2EKTIWpMB3SYQbMhJkwC2bDbPgE5sKn8CnMh/mwEDIgAzJhEWRBFiyGc7AElsIyWA4rYCWsgNWwBlbDOlgP62AjbITNsBm2wlbYDtthJ+yE3bAb9sJe2A/7IRWyIRsOwkE4BIfgMByGHMiBI3AEjsJROAbH4DgchxNwEk7BSTgDZ+AsnIPzcB4uwAW4CC8lfNt0d6m1qUJeoaWWeWQeGSNjZKyMlXEyTuaX+WVERmS8jJcFZAFZUBaUhWVhmSATZDFZTKJESTKUxWVxGZVRWVKWlIkyUZaWpaWTTibJJFlOlpPlZXlZQd4pK8q7ZCVZWbZ3VWVVWU12cNVlDVlT1pS1ZG1ZR9aVdWU9WU/Wl/VlA9lANpQNZSP5sGws+8JAeFRe6UwzOQyay+HQQraUrWRr+Q48KdvKkdBOtpcd5NNyNIyCTrKtS5bPyc5yHHSRL8jx8KLsJidCd/my7CF7yl7yFfmqbOd6yz5yCvSV/eR06C8HyIFykJwFteWVjtWRb8lUOUwOl2/LhfCOHCnflaPkaDlGvifHyvflODleTpATZZr8QE6SH8rJ8iM5RU6V0+R0mS5nyJnyYzlLzpZz5CdyrvxUzpPz5QK5UGbIz2SmXCSz5OdysfxCLpFL5TK5XK6QK+UquVqukWvlOrlebpAb5Sa5WW6RW+U2uV3ukDvlLrlb7pF75T65Xx6QX8ps+ZU8KP8kD8mv5WH5jcyR38oj8jt5VH4vj8kf5HH5ozwhT8pT8rQ8I3+SZ+U5eV7+LC/IX+RFeUlell4KBUoqpbQKVB6VV8WofCpWXafi1PUqv7pBRdSNKl7dpAqom1VBVUgVVkVUgiqqiimjUFlFKlTFVQkVVbeokupWlahKqdKqjHKqrEpSt6ly6nZVXt2hKqg7VUV1l6qkKqsqqqq6W1VT96jqqoaqqe5VtVRtVUfVVfepeup+VV89oBqoB1VD9ZBqpB5WjdUjqol6VDVVj6lm6nHVXD2hWqiWqpVqrdqoJ1Vb9ZRqp9qrDupp1VE9ozqpZ1Wyek51Vs+rLuoF1VW9qLqpl1R39bLqoXqqXuqSuqy86q36qBTVV/VTr6v+aoAaqAapweoNNUS9qYaqt1SqGqaGq7fVCPWOGqneVaPUaDVGvafGqvfVODVeTVATVZr6QE1SH6rJ6iM1RU1V09R0la5mqIG/VZrzD+R/+Hfyh/766pvVFrVVbVPb1Q61U+1Su9UetUftU/vUAXVAZatsdVAdVIfUIXVYHVY5KkcdUUfUUXVUHVPH1HF1XJ1QJ9XP6rQ6o35SZ9U5dU79rC6oC+ribz8DoUFLrbTWgc6j8+oYnU/H6ut0nL5e59c36Ii+Ucfrm3QBfbMuqAvpwrqITtBFdTFtNGqrSYe6uC6ho/oWXVLfqhN1KV1al9FOl9VJ+rZ/Of+P1tdGt9FtdVvdTrfTHXQH3VF31J10J52sk3Vn3Vl30V10V91Vd9PddHfdXffQPXQv3Uu/ql/VvXVvnaJTdD/9uu6vB+iBepAerN/QQ/QQPVQP1ak6VQ/Xw/UIPUKP1CP1KD1Kj9Fj9Fg9Vo/T4/QEPUGn6TQ9SU/Sk/VkPUVP0dP0NJ2u0/VMPVPP0rP0HD1Hz9Vz9Tw9Ty/QC3SGztCZOlNn6Sy9WC/WS/RSvVQv18v1Sr1Sr9ar9Vq9Vq/X6/VGvVEv0Vv0Fr1Nb9M79A69S+/Se/QevU/v0wf0AZ2ts/VBfVAf0of0YX1Y5+gcfUQf0Uf1UX1MH9PH9XF9Qp/Qp/QpfUaf0Wf1WX1en9cX9AV9UV/Ul/XlK5d9gQxkoAMd5AnyBDFBTBAbxAZxQVyQP8gfRIJIEB/EBwWCm4OCQaGgcFAkSAiKBsUCE2BgAwrCoHhQIogGtwQlg1uDxKBUUDooE7igbJAU3BaUC24Pygd3BBWCO4OKwV1BpaByUCWoGtwdVAvuCaoHNYKawb1BraB2UCeoG9wX1AvuD+oHDwQNggeDhsFDQaPg4aBx8EjQJHg0aBo8FjQLHg+aB08ELYKWQaugddDm31rf+7OFnnK9TR+TYvqafuZ1098MMAPNIDPYvGGGmDfNUPOWSTXDzHDzthlh3jEjzbtmlBltxpj3zNjdMWacGW8mmIkmzXxgJpkPzWTzkZlippppZrpJNzPMTPOxmWVmmznmEzPXfGrmmflmgVloMsxnJtMsMlnmc7PYfGGWmKVmmVluVpiVZpVZbdaYtWadWW82mI1mk9lstpitZpvZbnaYnWaX2W32mL1mn9lvDpgvTbb5yhw0fzKHzNfmsPnG5JhvzRHznTlqvjfHzA/muPnRnDAnzSlz2pwxP5mz5pw5b342F8wv5qK5ZC4bf+Xi/srbO2rUmAfzYAzGYCzGYhzGYX7MjxGMYDzGYwEsgAWxIBbGwpiACVgMi+EVhITFsThGMYolsSQmYiKWxtLo0GESJmE5LIflsTxWwApYEStiJayEVbAK3o134z14D9bAGngv3ou1sTbWxbpYD+thfayPDbABNsSG2AgbYWNsjE2wCTbFptgMm2FzbI4tsAW2wlbYBttgW2yL7bAddsAO2BE7YifshMmYjJ2xM3bBLtgVu2I37IbdsTv2wB7YC3vhq/gq9sbemIIp2A/7YX/sjwNxIA7GwTgEh+BQHIqpmIrDcTiOwBE4EkfiKByNY/A9HIvv4zgcjxNwIqZhGk7CSTgZJ+MUnILTcBqmYzrOxJk4C2fhHJyDc3EuzsN5uAAXYAZmYCZmYhZm4WJcjEuwIy7DZbgCV+AqXIVrcA2uw3W4ATfgJtyEW3ALbsNtuAN34C7chXtwD+7DfXgAD2A2ZuNBPIiH8BAexsOYgzl4BI/gUTyKx/AYHsfjeAJP4Ck8hWfwDJ7Fs3gez+MF/AUv4iW8jB5jrBSx9jobZ6+3+e0NNsbms38dF7ZFbIItaotZYwvaQn8To7U20ZaypW0Z62xZm2Rv+11cyVa2VWxVe7etZu+x1X8X17P32/r2AdvAPmjr2vv+Jm5oH7KN7OO2sX3CNrEtbVPb2jazj9vm9gnbwra0rWxr29E+YzvZZ22yfc52ts//Ls60i+wau9aus+vtPrvfnrc/26P2e3vB/mJ72z52sH3DDrFv2qH2LZtqh/0uHmPfs2Pt+3acHW8n2Im/i6fZ6TbdzrAz7cd2lp39uzjDfmbn2iw7z863C+zCX+Mra8qyn9vF9gu7xC61y+xyu8KutKvs6r+sdbndaDfZzXaP3Wu32e12h91pd9ndv8ZX9nHAfmmz7Vf2iP3OHrJf28P2mM2x3/4aX9nfMfuDPW5/tCfsSXvKnrZn7E/2rD336/6v7P20vWQvW28FAUlSpCmgPJSXYigfxdJ1FEfXU366gSJ0I8XTTVSAbqaCVIgKUxFKoKJUjAwhWSIKqTiVoCjdQiXpVkqkUlSaypCjspREt1E5up3K0x1Uge6kinQXVaLKVIWq0t1Uje6h6lSDatK9VItqUx2qS/dRPbqf6tMD1IAepIb0EDWih6kxPUJN6FFqSo9RM3qcmtMT1IJaUitqTW3oSWpLT1E7ak8d6GnqSM9QJ3qWkuk56kzPUxd6gbrSi9SNXqLu9DL1oJ7UC078+cMP1IdSqC/1o9epPw2ggTSIBtMbNITepKH0FqXSMBpOb9MIeodG0rs0ikbTGHqPxtL7NI7G0wSaSGn0AU2iD2kyfURTaCpNo+mUTjNoJn1Ms2g2zaFPaC59SvNoPi2ghZRBn1EmLaIs+pwW0xe0hJbSMlpOK2glraLVtIbW0jpaTxtoI22izbSFttI22k47aCftot20h/bSPtpPB+hLyqav6CD9iQ7R13SYvqEc+paO0Hd0lL6nY/QDHacf6QSdpFN0ms7QT3SWztF5+pku0C90kS7RZfIkQghlqEIdBmGeMG8YE+YLY8Prwrjw+jB/eEMYCW8M48ObwgLhzWHBsFBYOCwSJoRFw2KhCTG0IYVhWDwsEUbDW8KS4a1hYlgqLB2WCV1YNkwKbwvLhbeH5cM7wgrhnWHF8K6wUlg5fPzBquHdYbXwnrB6WCOsGd4b1gprh3XCuuF9Yb3w/rB++EDYIHwwLB8+FDYKHw4bh4+ETcJHw6bhY2Gz8PGwefhE2CJsGbYKW4dtwifDtuFTYbuwfdghfDrsGD4TdgqfDZPD58LO4fN/eDwl7Bv2C18PXw+9f0AtiC6MZkQ/i2ZGF0Wzop9HF0e/iC6JLo0uiy6ProiujK6Kro6uia6Nrouuj26Iboxuim6Oel83r3DgpFNOu8DlcXldjMvnYt11Ls5d7/K7G1zE3eji3U2ugLvZFXSFXGFXxCW4oq6YMw6ddeRCV9yVcFF3iyvpbnWJrpQr7co458q6JNfatXFtXFv3lGvn2rsO7mn3tHvGPeOedc+651xn97zr4l5wXd2Lrpt7yb3kXnY9XE/Xy73iXnWvud6uj0txKa6f6+f6u/5uoBvoBrvBbogb4oa6oS7Vpbrhbrgb4Ua4kW6kG+VGuTFujBvrxrpxbpyb4Ca4NJfmJrlJbrKb7Ka4KW6am+bSXbqb6Wa6WW6Wm+PmuLmJc908N88tcAtchstwmS7TZbkst9gtdkvcErfMLXMr3Aq3yq1ya9wat86tcxvcBrfJbXJb3Ba3zW1zO9wOt8vtcnvcHrfP7XMH3AGX7bLdQXfQHXKH3GH3jctx37oj7jt31H3vjrkf3HH3ozvhTrpT7rQ7435y6rfnnRfcL+6iu+QuO+/SIh9EJkU+jEyOfBSZEpkamRaZHkmPzIjMjHwcmRWZHZkT+SQyN/JpZF5kfmRBZGEkI/JZJDOyKJIV+TyyOPJFZElkaWRZZHlkRWRlxPui20Jf3JfwUX+LL+lv9Ym+lC/ty3jny/okf5sv52/35f0dvoK/01f0d/lKvrKv4p/wLXxL38q39m38k76tf8q38+19B/+07+if8Z38sz7ZP+c7++d9F/+C7+pf9N38S767f9n38D19L/+Kf9W/5nv7Pj7F9/X9/Ou+vx/gB/pBfrB/ww/xb/qh/i2f6of54f5tP8K/40f6d/0oP9qP8e/5sf59P86P9xP8RJ/mP/CT/Id+sv/IT/FT/TQ/3af7GX6m/9jP8rP9HP+Jn+s/9fP8fL/AL/QZ/jOf6Rf5LP+5X+y/8Ev8Ur/ML/cr/Eq/yq/2a/xav86v9xv8Rr/Jb/Zb/Fa/zW/3O/xOv8vv9nv8Xr/P7/cH/Jc+23/lD/o/+UP+a3/Yf+Nz/Lf+iP/OH/Xf+2P+B3/c/+hP+JP+lD/tz/if/Fl/zp/3P/sL/hd/0V/yl/kza4wxxhhj/xD1B8f7/p3vyd/GFf2EENdvL5Lz32tuKPjn+QCZ0DEihHiuT/dH/2vUqpWSkvLbuUuUCErMF0JErubnEX+J9VLRQTwjkkV7Ue7vrm+A7HmB/qB+9E4hYv8qJ0Zcja/Wv/1/qP/k02MyK4bn4/+X+vOFSCxxNSefuBpfrV/+f6hfqO0frD/f12lCtPurnDhxNb5aP0k8JZ4XyX9zJmOMMcYYY4wx9mcDZJWuf3T/fOX+PEFfzckrrsZ/dH/OGGOMMcYYY4yxa+/Fnr2efTI5uX1XnvCEJzz5y+Ra/2VijDHGGGOM/btdvei/1ithjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcZyr/8f/07sWu+RMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYu9b+TwAAAP//4ok7tg==") mount$bind(&(0x7f0000000280)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x81899, 0x0) chroot(&(0x7f0000000300)='./file0/file0\x00') lstat(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000380)) 30.159575128s ago: executing program 5 (id=575): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x8031, 0xffffffffffffffff, 0x76ebe000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000100)={{&(0x7f000047a000/0x3000)=nil, 0x3000}, 0x1}) 29.764387509s ago: executing program 5 (id=577): socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r0, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) io_destroy(r1) 29.465726919s ago: executing program 5 (id=583): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) lstat(0x0, &(0x7f0000000400)) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[0x3]}, 0x8) 27.535226828s ago: executing program 1 (id=603): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x24, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}}}, 0x24}}, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000780)) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000001980)=0x1) 27.535049018s ago: executing program 1 (id=604): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x800, 0x101403) ioctl$BLKALIGNOFF(r0, 0x127a, 0x0) 27.507729441s ago: executing program 1 (id=605): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newtfilter={0x4c, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x1, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1}]}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@newtfilter={0x4c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x1, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1}]}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000b00)=@deltfilter={0x4c, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x1, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1}]}}]}, 0x4c}}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0xee6b280}, 0x0) 26.921993811s ago: executing program 1 (id=608): r0 = syz_mount_image$exfat(&(0x7f00000008c0), &(0x7f0000000900)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x5818458, &(0x7f0000000940)=ANY=[], 0x1, 0x153d, &(0x7f0000002180)="$eJzs3AucjdX6OPDnWWu9DEm7SS7DWut52WmwXJLkkiSXJEmOHMktITRJkoPEuEuahJDrJLkMIblMY9K43y+5J0nSJElIaJL1/0xH/zo5//qf36/fr3Oa5/v5vJ+9nv3uZ+21PPvyrtee94ueo+o2r1erKRHBfwv+/SYRAGIAYDgAXAMAAQBUiq0Um70/j8TE/96TsN/XAyl/9AjYH4nrn7Nx/XM2rn/OxvXP2bj+ORvXP2fj+udsXH/GcrIdc4tcy1vO3fj8/5+d+pX7+Pv/TySz7JRPNpW9vte/kML1z9m4/jkb1z9n4/rnbFz/nI3r/6ci/tUErn/OxvVnLCf7r5875v87+DNsf/TrjzHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcZYznDB/0QBwI+3jDHGGGOMMcYY+/PwuX9qZ/k/ciSMMcYYY4wxxhj7n4MgQIKCAHJBboiBPJAXroJ8cDXkh2sgAtdCLFwHBeB6KAiFoDAUgTgoCsVAgwELBCEUhxIQhRugJNwI8VAKSkMZcFAWykF5qAA3QUW4GSrBLVAZboUqUBWqQXW4DWrA7VAT7oBacCfUhjpQF+rBXVAf7oYGcA80hHuhEdwHjeF+aAJ/gabwADSDv0JzeBBawEPQElpBa2gDbf9L+c9AX3gW+kF/SIQBMBAGwWAYAkNhGAyH52AEPA8j4QVIghdhFLwEo2EMjIWXYRyMhwnwCkyESTAZpsBUmAbJ8CpMh9dgBrwOM2EWzIY5kAJzYR68AfNhASyEN2ERvAWLYQkshWWQCm9DGiyHdHgHVsC7kAErYRWshjWwFtbBetgAG2ETbIYtsBW2wXbYAe/BTtgFu2EP7IV9sB/ehwPwARyED+EQfHRFPv5q/vlf5PdCQECBAhUqzIW5MAZjMC/mxXyYD/NjfoxgBGMxFgtgASyIBbEwFsY4jMNiWAwNGiQkLI7FMYpRLIklMR7jsTSWRocOy2E5rIA3YUWsiJWwElbGylgFq2JVrI7VsQbWwJpYE2thLayNtbEu1sW78C68GxtgA2yIDbERNsLG2BibYBNsik2xGTbD5tgcW2ALbIktsTW2xrbYFtthO2yP7bEjdsRO2Am7YBdMwATsil2xG3bD7tgde2AP7Ik9sRf2xt74DD6Dz+Kz2B9riwE4EAfiYByMQ3EYDsPncAQ+j8/jC5iEL+IofAlfwjE4Fs/hOByPE3AC1hCTcDJOQRLTMBmTcTpOxxk4A2fiLJyFczAF5+I8nIfzcQEuwDdxEb6Fb+ESXILLMBVTMQ2XYzqm4wo8jxm4ElfhalyDa3ENrscNuB434WbchFtxK27H7fgevoe7cBfuwT24DxUAvo8f4AeYhIfwEB7Gw3gEj+BRPIqZmInH8Bgex+N4Ak/gSTyJp/A0nsHTeBbP4jk8jxfwAmZhFl7Ep+M+a7av1MYkEELEAIASuUQuESNiRF6RV+QT+UR+kV9ERETEilhRQBQQBUVBUVgUFnEiThQTxYQRRpAIRXFRXERFVJQUJUW8iBelRWnhhBPlRDlRQVQQFUVFUUncIiqLW0UVUVV0cNVFdVFDdHQ1xR2ilqglaos6oq6oJ+qJ+qK+aCAaiIaioWgkGonG4n7RRAzAofiAyK5M8+yhilHYUrQSrUUbMQYfFu3EWGwvOoiO4lExHsdhF9HOJYjHRVcxGbuJJ8UUfEr0ENOwp/ib6CV6iz7iGdFXtHf9RH8xEweIgWIODhZDxFAxTMzHOiK7YnXFCyJJvChGiZfEMhwjxoqXxTgxXkwQr4iJYpKYLKaIqWKaSBaviuniNTFDvC5millitpgjUsRcMU+8IeaLBWKheFMsEm+JxWKJWCqWiVTxtkgTy0W6eEesEO+KDLFSrBKrxRqxVqwT68UGsVFsEpvFFrFVbBPbxQ7xntgpdondYo/YK/aJ/eJ9cUB8IA6KD8Uh8ZE4LD4WR8Qn4qj4VGSKz8Qx8bk4Lr4QJ8SX4qT4SpwSp8UZ8bU4K74R58R5cUF8K7LEd+Ki+F5cEl6ARCmklEoGMpfMLWNkHplXXiXzyatlfnmNjMhrZay8ThaQ18uCspAsLIvIOFlUFpNaGmklyVAWlyVkVN4gSzZBAFlKlpZlpJNlZTlZXlaQN8mK8mZZSd4iK8tbZRVZVVaT1eVtsoa8XdaUd8ha8k5ZW9aRdWU9eZesL++WDeQ9sqG8VzaS98nG8n7ZRP5FNpUPyGbyr7K5fFC2CB6SLWUr2Vq2kW3lw7KdfES2lx1kR/mo7CQ7yy7yMZkgH5dd5ROym3xSdpdPyR7yadlT/k32kr1lH/m9vCS97Cf7y0Q5QA6Ug+RgOUQOlcPkcPmcHCGflyPlCzJJvihHyZfkaDlGjpUvy3FyvPT+FTlRTpKT5RQ5VU6TyfJVOV2+JmfI1+VMOUvOlnNkipwrh17uaeEv8ifIK/Nf+yf5I3949u1yh3xP7pS75G65R+6V++R+uV8ekAfkQXlQHpKH5GF5WB6RR+RReVRmykx5TB6Tx+VxeUKekCflSXlKnpbfyq/lWfmNPCfPy/PyW5kls+TFy/8GoFAJJZVSgcqlcqsYlUflVVepfOpqlV9doyLqWhWrrlMF1PWqoCqkCqsiKk4VVcWUVkZZRSpUxVUJFVU34OUDClValVFOlVXlVPl/JV+VVDeqeFXqH/J/a3xtVVvVTrVT7VV71VF1VJ1UJ9VFdVEJKkF1VV1VN9VNdVfdVQ/VQ/VUAQD0Un1UH9VX9VX9VD+VqBLVQDVIDVZD1FA1TA1Xz6kRaoQaqUaqJJWkRqlRarQarcaqsWqcGqcmqAlqopqoJqvJaqqaqpJVspqupqsZaoaaqWaq2Wq2SlEpap6ap+ar+WqhWqgWqUVqsVqslqqlKlWlqjSVptJVulqhVqgMtVKtVKvVarVWrVXr1Xq1UW1Um9VmtVVtVRlqh9qhdqqdarfarfaqvWq/2q8OqAPqoDqoDqlD6rA6rI6oI+qoOqoyVaY6po6p4+q4OqFOqJPqpDqlTqkz6ow6q86qc+qcuqAuqCyVpS6qi+qSupR92BeIQAQqUEGuIFcQE8QEeYO8Qb4gX5A/yB9EgkgQG8QGBYLrg4JBoaBwUCSIC4oGxQIdmMAGFIRB8aBEEA1uCEoGNwbxQamgdFAmcEHZoFxQPqgQ3BRUDG4OKgW3BJWDW4MqQdWgWlA9uC2oEdwe1AzuCGoFdwa1gzpB3aBecFdQP7g7aBDcEzQM7g0aBfcFjYP7gybBXy41+PtrK2gePBi0CB4KWgatgtZBm6Dt79N/0DR4IGgWeH+u0COun+6vE/UAPVAP0oP1ED1UD9PD9XN6hH5ej9Qv6CT9oh6lX9Kj9Rg9Vr+sx+nxeoJ+RU/Uk/RkPUVP1dN0sn5VT9ev6Rn6dT1Tz9Kz9RydoufqefoNPV8v0Av1m3qRfksv1kv0Ur1Mp+q3dZpertP1O3qFfldn6JV6lV6t1+i1ep1erzfojXqT3qy36K16m96ud+j39E69S+/We/RevU/v1+/rA/oDfVB/qA/pj/Rh/bE+oj/RR/WnOlN/po/pz/Vx/YU+ob/UJ/VX+pQ+rc/or/VZ/Y0+p8/rC/pbnaW/0xf19/qS9tkH99lf70YZZXKZXCbGxJi8Jq/JZ/KZ/Ca/iZiIiTWxpoApYAqagqawKWziTJwpZoqZbGTIFDfFTdRETUlT0sSbeFPalDbOOFPOlDMVTAVT0VQ0lUwlU9lUNlVMFVPNVDO3mdvM7eZ2c4e5w9xp7jR1TB1Tz9Qz9U1908A0MA1NQ9PINDKNTWPTxDQxTU1T08w0M81Nc9PCtDAtTUvT2rQ2bU1b0860M+1Ne9PRdDSdTCfTxXQxCSbBdDVdTTfTzXQ33U0P08P0ND1NL9PL9DF9TF/T1/Qz/UyiSTQDzUAz2Aw2Q81QM9wMNyPMCDPSjDRJJsmM8mBGm9FmrBlrxpnxZoJ5xUw0k8xkM8VMNdNMskk20810M8PMMDPNTDPbzDYpJsXMM/PMfDPfLDQLzSKzyCw2i81Ss9SkmlSTZtJMukk3K8wKk2EyzCqzyqwxa8w6s85sMBvMJrPJbDFbzDazzewwO8xOs9PsNrvNXrPX7Df7zQFzwBw0B80hc8gcNoc9Apij5qjJNJnmmDlmjpvj5oQ5YU6ak+aUOWXOmDPmrDlrzplz5oK5YLLMd+ai+d5cMt7E2Dw2r73K5rNX2/z2GvvLuLAtYuNsUVvMalvQFvqH2Fhr420pW/rHJaYtb+Ozj9tsGetsWVvOlrdVbFVbzVa3t9ka9nZb84q4vr3bNrD32IafelvP3vVTbO+NAXufbWwftE3sQ7apbWWb2Ta2uX3QtrAP2Za2lW1t29hOtrPtYh+zCfZx29U+cUWcZpfbDXaj3WQ32wP2A3vBfmuP2y9slv3O9rP97XD7nB1hn7cj7Qs2yb54RTzBvmIn2kl2sp1ip9ppV8Sz7RybYufaefYNO98uuCJOtW/bRTbdLrZL7FK77Ic4e0zp9h27wr5rM+xKu8qutmvsWrvOrv+/Y11tt9ptdrvdb9+3O+0uu9vusXvtvh/i7HkctB/aQ/Yje8x+bo/YT+xRe8Jm2s9+iLPnd8J+aU/ar+wpe9qesV/bs/Ybe86ez56/z5771/Z7e8l6C4QkSJKigHJRboqhPJSXrqJ8dDXlp2soQtdSLF1HBeh6KkiFqDAVoTgqSsVIkyFLRCEVpxIUpRuoJN1I8VSKSlMZclSWylF5qkA3UUW6mSrRLVSZbqUqVJWqUXW6jWrQ7VST7qBadCfVpjpUl+rRXVSf7qYGdA8lbriXGtF91Jjupyb0F2pKD1Az+is1pwepBT1ELakVtaY21JYepnb0CLWnDtSRHqVO1Jm60GOUQI9TV3qCutGT1J2eoh70NPWkv1Ev6k196BnqS89SP+pPiTSABtIgGkxDaCgNo+H0HI2g52kkvUBJ9CKNopdoNI0hgJdpHI2nCfQKTaRJNJmm0FSaRsn0Kk2n12gGvU4zaRbNpjmUQnNpHr1B82kBLaQ3aRG9RYtpCS2lZZRKb1MaLad0eodW0LuUQStpFa2mNbSW1tF62kAbaRNtpi20lbbRdtpB79FO2kW7aQ/tpX20n96nA5Tn8hvuIzpMH9MR+oSO0qeUSZ/RMfqcjtMXdIK+pJP0FZ2i03SGvqaz9A2do/N0gb6lLPqOLtL3dIk8QYihCGWowiDMFeYOY8I8Yd7wqjBfeHWYP7wmjITXhrHhdWGB8PqwYFgoLBwWCePComGxUIcmtCGFYVg8LBFGwxvCkuGNYXxYKiwdlgldWDYsF5YPK4Q3hRXDm8NK4S1h5fDWsEpYNXzw3urhbWGN8PawZnhHWCu8M6wd1gnrhvXCu8L64d1hg/CesGF4b1gxvC9sHN4fwuW/V2kW/jVsHj4YtggfCluGrcLWYZuwbfhw2C58JGwfdgg7ho+GncLOYZfwsTAhfDzsGj7xm/sTwwHhwHBQOCj0/h65NLosmhp9O5oWXR5Nj74TXRF9N5oRXRldFV0dXRNdG10XXR/dEN0Y3RTdHN0S3RrdFt0e9b5ebnDohJNOucDlcrldjMvj8rqrXD53tcvvrnERd62Ldde5Au56V9AVcoVdERfnirpiTjvjrCMXuuKuhAIAV9Ld6OJdKVfalXHOlXXlXBvX1rV17dwjrr3r4Dq6R92jrrPr7B5zj7nHXVf3hOvmnnTd3VOuh3vaPe3+5nq53q6Pe8b1dc+6fq6/S3SJbqAb6Aa7wW6oG+qGu+FuhBvhRrqRLskluVFulBvtRruxbqwb58a5CW6Cm+gmusluspvqprpkl+ymu+luhpvhso+tZ7vZLsWluHlunpvv5ruFbqFbFL/ILXaL3VK31KW6VJfm0ly6S3cr3AqX4TLcKrfKrXFr3Dq3zm1wG9wmt8ltcVvcNrfN7XA73E630+12u91et9ftd/vdAXfAHXQH3SF3yB12h90Rd8QddZ+6TPeZO+Y+d8fdF+6E+9KddF+5U+60O+O+dmfdN+6cO+8uuG9dlvvOXXTfu0vOu+TIq5HpkdciMyKvR2ZGZkVmR+ZEUiJzI/Mib0TmRxZEFkbejCyKvBVZHFkSWRpZFkmNvB1JiyyPpEfeiayIvBvJiKyMrIqsjqyJrFXgi+4MfXFfwkf9Db6kv9HH+1K+tC/jnS/ry/nyvoK/yVf0N/tK/hZf2d/qq/iqvpp/yLf0rXxr38a39Q/7dv4R39538B39o76T7+y7+Md8gn/cd/VP+G7+Sd/dP+V7+Kd/+KVWL9/b9/HP+L7+Wd/P9/eJfoAf6Af5wX6IH+qH+eH+OT/CP+9H+hd8kn/Rj/Iv+dF+jB/rX/bj/Hg/wb/iJ/pJfrKf4qf6aT7Zv+qn+9f8DP+6n+ln+dl+jk/xc/08/4af7xf4hf5Nv8i/5Rf7JX6pX+ZT/ds+zS/36f4dv8K/6zP8Sr/Kr/Zr/Fq/zq/3G/xGv8lv9lv8Vr/Nb/c7/Ht+p9/ld/s9fq/f5/f79/0B/4E/6D/0h/xH/rD/2B/xn/ij/lOf6T/zx/zn/rj/wp/wX/qT/it/yp/2Z/zX/qz/xp/z5/0F/63P8t/5i/57f8n7f+nXa3V+r9PnjDHGGGP/YQb9xv4B/+S+7OWIuNz+znt/9a4imT/fLwFgS8G/t4eIuE4RAHi8f88Hftxq105MTLz82AwJQYklABD5xRNcjldCR+gMCdABKlw5kCzvveidRb/Rf/QWgLw/S4uBn+Kf+v/4n85/iHj40QlplcMLsb/S/xKA+BI/5WSvwn+MV0LHHy6n0AEq/j/6L9TuN8af55NkgPY/y8kHAO3z/HL85caUB4CEf3gkY4wxxhhjjDH2d0NEte6/tX7OXp/H/eyigLnhp/hX1+eMMcYYY4wxxhj7t/BU7z6PPZyQ0KE7N/5TGwD/FsP4z2rEXH79/y4dXvWHT+efNLz/7Xd351/p5//r4wP/Rz+cGGOMMcYYY7+rny8jf5TnjxwQY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDGWA/3vXKCOMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYy9n+TwAAAP//xpExGA==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x101042, 0x15) pwrite64(r1, &(0x7f0000000640)='2', 0xfdef, 0xc00) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x20, 0x0, 0x8000) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0185879, &(0x7f0000003740)={@desc={0x1, 0x0, @desc4}}) 26.785213965s ago: executing program 1 (id=610): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./bus\x00', 0x1208002, &(0x7f00000002c0)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@nomblk_io_submit}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f0000000ac0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r0 = openat(0xffffffffffffff9c, &(0x7f00000010c0)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8, 0x6, 0x12, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 26.729799661s ago: executing program 5 (id=611): syz_mount_image$ext4(&(0x7f0000000800)='ext4\x00', &(0x7f0000000840)='./bus\x00', 0x100041c, &(0x7f0000000880), 0x1, 0x616, &(0x7f00000013c0)="$eJzs3c9vVNUeAPDvnWlLh8JrIS/vPd5CmhgDidLSAoYYF7A1psEfcePGSgsSCjRtjRZNKAluTIwbY0xcuRD/CyWydaUbXbhxZUiIGpYmjrkzc/vzTn/RzkXu55MMc+499/acy/Tbc+bMOXcCKK3B9J9KxKGImE4i+pOFxbyuaGUONo978Mf759NHEvX6K78lkbT2Zccnree+1sm9EfH9t0kcrK4td3b++uXxqanJmdb28NyV6eHZ+evHLl0Zvzh5cfLq6LOjp0+dPHV65Pi2ruvG2l1pdd7p/3Ds9S8//zMZ+ernsSTOxAutA5dfx04ZjMHG/0myNqvv9E4XVpBq6/ekuuwik64ia8RWZK9fd0T8N/qjGksvXn988FKhlQN2VT2JqAMllYh/KKmsH5C9t1/9PrhSSK8E6IT7Z5sDAGvjv6s5Nhi9jbGBvQ+SWD6sk0TE9kbmVtoXEd/dHbt14e7YrZn9uzMOB+RbuBkR/1sW/z1ZTtKI/4HojYFG/FdWxH/aLzjXek73v7z6B3dvrvzVQ8XiHzqnGf+9Oe3/UvxHm/h/Y1n8v7nN8geXkm/VVsR/bbuXBAAAAAAAAKV152xEPJM3/6eyOP8ncub/9EXEmR0of3DV9trP/yv3dqAYIMf9sxHP587/rUS1Oft3oNr6nH9/Yz5Ad3Lh0tTk8Yj4V0Qcje496fbIOmUc++jgZ+3yBlvz/7JHWn76vHRE5V7XnpXnTIzPjT/sdQMR929G/D93/m+y2P4nOe1/+vdgepNlHHzq9rl2eRvHP7Bb6l9EHMlt/5du6JCsf3+O4UZ/YDjrFaz1xHsff92u/O3Gv1tMwMNL2/+968f/QLL8fj2zWy/jxHxXvV3edvv/PcmrjbsKZcsV3h2fm5sZiaglL1bTvSv2j269zvA4yuIhi5c0/o8+uf74X17/vxYRC6t+dvL7yjXFmf/81fdLu/ro/0Nx0vif2FL73zaRLETkZo3eHvimXfmba/9PNtr6o609xv+g6dMsTHtW7s8J0K68rE7XFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeB5WI2BdJZWgxXakMDUX0RcS/Y29l6trs3NMXrr19dSLNa3z/fyX7pt/+5naSff//wLLt0VXbJyLiQER8Uq01tofOX5uaKPriAQAAAAAAAAAAAAAAAAAA4BHR12b9f+rXatG1A3ZdV9EVAAqTE/8/FFEPoPO0/1Be4h/KayvxX9vFegCdp/2H8hL/UF7iH8pL/EN5iX8AAAAAAHisHDh856ckIhaeqzUeqZ5WXnehNQN2W6XoCgCFyb3FjzU+UAqm/kB5eY8PJBvk97Y9aaMz252cmj6/8ckAAAAAAAAAAAAAQObIIev/oays/4fyyl3/D5RCtv7/cMH1ADpv2+/x267pBf6J1lvJ3z7cN7H+HwAAAAAAAAAAAADYEbPz1y+PT01NznQu8WPrS79yj6lFRIfrkyVeK6LQYhP1ev1G46V4ROqz9USy8EhUo5nIpsJv/qze/CjYnUS21m9zZxX0BwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFjj7wAAAP//13kb9A==") syz_mount_image$fuse(0x0, &(0x7f0000000f40)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000f80)='./bus\x00', &(0x7f0000000fc0), 0x8, &(0x7f0000001000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000001040)='./bus\x00') symlink(&(0x7f0000001080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f00000011c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') open(&(0x7f00000012c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x14f040, 0xa2) 26.729685221s ago: executing program 1 (id=612): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000001180)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001240)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x1}]}]}, 0xfc}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0xfa) sendto$inet6(r2, 0x0, 0xfffffffffffffd2f, 0x0, &(0x7f0000000e80)={0xa, 0x0, 0x0, @mcast2}, 0x1c) 26.64148524s ago: executing program 33 (id=612): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000001180)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001240)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x1}]}]}, 0xfc}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0xfa) sendto$inet6(r2, 0x0, 0xfffffffffffffd2f, 0x0, &(0x7f0000000e80)={0xa, 0x0, 0x0, @mcast2}, 0x1c) 26.63870355s ago: executing program 5 (id=615): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x8, 0x7, 0xe, 0x0, 0x5, 0x81, 0x3, 0x2, 0x3, 0xf9, 0x3, 0x40, 0x0, 0xfffe000, 0xe, 0x4, 0xa, 0x9, 0x0, '\x00', 0x81, 0x7}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 26.531421731s ago: executing program 5 (id=618): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="82585c", 0x3}], 0x1}}], 0x1, 0x4404c880) sendto$inet6(r0, &(0x7f0000000240)="f780090096", 0x5, 0x3b00, 0x0, 0x0) 26.481528816s ago: executing program 34 (id=618): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="82585c", 0x3}], 0x1}}], 0x1, 0x4404c880) sendto$inet6(r0, &(0x7f0000000240)="f780090096", 0x5, 0x3b00, 0x0, 0x0) 3.450571445s ago: executing program 6 (id=1016): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141b42, 0x8) splice(r0, 0x0, r2, 0x0, 0x402000784853bb, 0x0) fcntl$setpipe(r1, 0x407, 0x2010001) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0xffffffffffffffff}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0xffffffffffffffff}, 0x0, 0x0) write$P9_RLOPEN(r1, &(0x7f0000000180)={0x18, 0xd, 0x2, {{0x30, 0x3, 0x7}, 0xe}}, 0x18) 3.189842892s ago: executing program 7 (id=1019): syz_mount_image$fuse(0x0, &(0x7f0000000180)='./bus\x00', 0x3820420, 0x0, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x8042, 0x34) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x8, &(0x7f00000002c0)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000007c0)='./file0/file1\x00', 0x40, 0x83) fsync(r0) 3.172857513s ago: executing program 7 (id=1021): pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000180)) fcntl$setpipe(r1, 0x407, 0x0) read$FUSE(r0, &(0x7f0000001b80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2) write$FUSE_ENTRY(r1, &(0x7f0000003bc0)={0x90, 0x0, 0x0, {0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, {0x2, 0xb3b, 0x0, 0x0, 0x20000000000007f, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, r3, r4, 0x3, 0x5}}}, 0x90) 3.024276569s ago: executing program 7 (id=1026): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) syz_clone(0x500, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000180)={0x1, 0x0, [{}]}) 2.443188729s ago: executing program 6 (id=1028): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000440)="120000001200e7ef007b00000000000000a1", 0x12, 0x880, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540), &(0x7f0000000580)='./file0\x00', 0x800000, &(0x7f0000001200)=ANY=[@ANYBLOB="616c6c6f775f7574696d653d30303030303030303030303030303030303136323134372c756e695f786c6174653d302c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e6e742c696f636861727365743d6d61637475726b6973682c6e6f6e756d7461696c3d302c696f636861727365743d6b6f69382d72752c756e695f786c6174653d302c696f636861727365743d757466382c6572726f72733d636f6e74696e75652c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e39352c7379735f696d6d757461626c6500007466383d302c00ef7cf9c9e427ab131e48bcb8e8584feb067a2a04bfb53d8acd1a7464c88ceadeb81c1a0a30069011756aa4b047305d230985f1517f13617faa8a8ef798318c0f939dfef1d31c5b266caf9084e4e7cfde9ba9b1007b9c8f019de569c2c65df0fb1106c53f5ed1d67eb004830e465f1da48dfeca72541be2cfc1ae0fd7dd06a1119074aa25561765f678fa139276a5e1f014a4d913ed7e95e6f8e08e70f545dcb1e22102f460b9a944604469f45c4a950919a8cc48f0c9f09c972b639d01e1da6fbde3753f82286b3a0f3157d03502f3cad14f97d803a912d36677e0c9d9bd34983a71d5f5eeac6f1e3c03065350d8b41aef668369d0c2c082e9"], 0x1, 0x373, &(0x7f0000001400)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==") mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) recvfrom$inet(r0, 0x0, 0x40, 0xbd64470d3e2c0e2a, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10) 2.382585265s ago: executing program 6 (id=1029): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r0) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x0, 0x2, 0x3}}, 0x26) 2.364184896s ago: executing program 6 (id=1031): syz_mount_image$f2fs(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x1000800, &(0x7f0000000440)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c6261636b67726f756e645f67633d6f6e2c6e6f757365725f78617474722c6e6f71756f74612c64697361626c655f726f6c6c5f666f72776172642c67635f6d657267652c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c646973636172645f756e69743d73656374696f6e2c636865636b706f696e743d64697361626c652c6e6f696e6c696e655f64656e7472792c00ec6da92d1c80a6c720380e3c2c55bf27596d2776ce408c4bb19b149757508e1c7e919c6c2047023baa412d14fa75c8cac6e5f103e13ea52708af0a7c5da8af4ecb6612"], 0x2, 0x5524, &(0x7f0000001300)="$eJzs3L9vG3UUAPDnpGnTH5QIMbD1pAopkWqrTpsKtgCt+CFSRQUGJnBsx3Jr+6LYcUImBkbEwH+CQGJi5G9gYGZDDCA2JJDvzqUpFCHFjZvk85HO7+7rr9+9rxWd9O4iB3BqLSS//1qKy3E+ImYj4lJEtl+KiLnxpNU8vBQRVyJi5pGtVIw/HDgbERci4vIoeZ6zVLz15bXh1ZVf3vntux/Onbn41bc/Tm/VwLS9HBHdrXx/t5vHtJXH+8V4bdjOYvfmsIj5G90HxXGax93mRpZhtzaeV8vijVY+P93a6Y/iZqdWH8VWezMb3+rlJ+wPW+M82Qfu17az40ZzI4vtfprF1n5e195+fm3b7w/yPI0i3ydZ+hgMxjEfb+418/VsPchivTcoxvO8aaO5N4rDIhani3raaWR1bBzmm362vdvu7ewlw+Z2v532kpVK9ZVK9Va5up02moPmzXKt27h1M1lsdUbTyoNmrbvaStNWp1mpp92lZLFVr5er1WTxdnOjXesl1WrlRuV6eWWp2LuWvHn3g6TTSBZH8fV2b2fQ7vSTzXQ7yT+xlCxXbry6lFytJu+trSfr9+7cWVt//6PbH959be3tN4pJ/ygrWVy+vrxcrl4vL1eXTtH6PyuKnuD64VBK0y4A4Pj5r/7/4WVV/w9M2BP7/9EF6FD9//a9iKff/4f+fyKOVf/7zPT/83FS1g+Hov8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADi1fpr7+q1sZyE/vliMP1cMvVAclyJiJiL+/BezcfZAztkiz9wT5s89VsP3pcgyjM5xrtguRMRqsf3x/NP+FgAAAODk+ubTK1/k3Xr+sjDtgjhK+U2bmUsfTyjffETMLfw8oWwzo5cXJ5Qs+/s+E3sTypbdwJqfULL8ltuZSWX7X2YPhPlHQikPM0daDgAAcCQOdgJH24UAAABwlD6fdgFMRynGjzLHz4Kz/7z/+4Hg+QNHAAAAwDFUmnYBAAAAwMQ9/hw/6//9/h8AAACcbPnv/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8xc7946gNRHEAfjYYyD8FRelzlXRwjBwhZcqIA+QSHCAFuUK6VJyBdDlChCPsCQu7FKwY26vV90nGeGT/eIOgmBlpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADo0u9qs/zx9cO3W3P29bV+RcTD1jy9AQAAAC7ZVZtl82beXr9K7W9S07t0XUREeXHkXtejmJxljlJOdXf/99P7q3s1/IxoEg6fMU3Hy4j4mI6/b7v+FgAAAOD52q7Wi3a03r7Mhy6IPrWTNuXrT5nyioio5n8ypZWHvPc5kibp9z2OLzni0sRWzDKFtVNu41xpV2n+7sdZu9nJqWhP5cXHjkVm6zsAANCj0dmp31EIAAAAffo8dAHkdt3yXBH/lzKPS4HTs+dfPCYNAAAAeIqKoQsAAAAAOteM/3va/6+2/x8AAAAMo93/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC7tqs1yu1ovbs3Z17fJ0xsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPjH/ryjQAiEQRjsXd+ZzP0PKw2amppUgfDxNwYDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb373l/8TU+NMMvfaWHoeSdZOja1TY+/cOPrD+Po1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf785ICIRAEUTBn/O+k739YSdAziBABDY8qatEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAX/e6X/xNT40wyd9pYOh5J1q4aW1eNvQeNowfj7d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABc79+8bNxUHAPzZPl9pAXEEdEMQAokBFnq9lpZuiAEUMfAnIEXptYRe+dFmoFWFuIUNZe6CYEQICRS2/g+dWylL2DLcECRmkM92zvkhcUBkX5LPR3p+Xzsnv++zpShfP+cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKI3fncZJtunkcVwce7xzfyXrn+zrMw/XNxezlsVRnUkfDy9Xd6Juc4kAAABwoo2qO0lZ34cQttKNpayPO5P6Py0/k9X83z+bx2U9v7/uL/uy9s/ab79uv7g7UCcfJzvp9dXh4MLBvFpHPtNj4rl/+Hl+YaL82UsyuSHxB6MXxunkekbfPnr0XnsSnqkjWwDgvzhf9kVQ/j2U9f0mEwPg1GhVCu+y/k86zeYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIfxKDxdxlEIYbE1jTNPdu6vHNY/XN9cLNuVBw/Ww9fTc2anSEMI11eHgwu1zma+3bl77+bycDi4XX/wSgihqdHfKaZ/86MZPhxCI9dHcERBXNzsecnneAQN/lICAOBESouW1fVb6cZSdixaCOGvH/bW/69X4jBj/b/98ZXH1bGq9X+/thnOv97arc97d+7ee3P11vKNwY3Bp29d7L/dv3T18uWrvcmzkp4nJgAAAPw/7aJV6/944eD6/7lKHGas/7/4rv9VdaxE/X+o6aJf05kAAACcbs+/+ucf0SHHo3Y7fLm8tna7n2939y/m2wZS/dfOFK1a/ycLTWcFAAAA1GE8ivas/1+rxGHG9f9nfnzp5+o5kxDC2WL9//zKZ8Nr9U1nrtXx78RNzxEAAIBmnS1adf0/nbz/H+++8hCHEN54LY+LrwGcqf5P3v/mp+pY1ff/L9U3xbkUd/PrMem7IbS6TWcEAADASfZU0bJi//d0Y+mTX8592Pb+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDd/g4AAP//MY062g==") write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f00000002c0)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x2, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x9, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f000000be00)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f000000be40), 0x208e24b) fdatasync(r0) 2.349040648s ago: executing program 7 (id=1033): syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x180040c, &(0x7f0000000140)={[{@nogrpid}, {@dioread_nolock}, {@resgid}, {}, {@test_dummy_encryption_v1}]}, 0x1, 0x616, &(0x7f0000000340)="$eJzs3c9vVNUeAPDvnWlLh8JrIS/vPd5CmhgDidLSAoYYF7A1psEfcePGSgsSCjRtjRZNKAluTIwbY0xcuRD/CyWydaUbXbhxZUiIGpYmjrkzc/vzTn/RzkXu55MMc+499/acy/Tbc+bMOXcCKK3B9J9KxKGImE4i+pOFxbyuaGUONo978Mf759NHEvX6K78lkbT2Zccnree+1sm9EfH9t0kcrK4td3b++uXxqanJmdb28NyV6eHZ+evHLl0Zvzh5cfLq6LOjp0+dPHV65Pi2ruvG2l1pdd7p/3Ds9S8//zMZ+ernsSTOxAutA5dfx04ZjMHG/0myNqvv9E4XVpBq6/ekuuwik64ia8RWZK9fd0T8N/qjGksvXn988FKhlQN2VT2JqAMllYh/KKmsH5C9t1/9PrhSSK8E6IT7Z5sDAGvjv6s5Nhi9jbGBvQ+SWD6sk0TE9kbmVtoXEd/dHbt14e7YrZn9uzMOB+RbuBkR/1sW/z1ZTtKI/4HojYFG/FdWxH/aLzjXek73v7z6B3dvrvzVQ8XiHzqnGf+9Oe3/UvxHm/h/Y1n8v7nN8geXkm/VVsR/bbuXBAAAAAAAAKV152xEPJM3/6eyOP8ncub/9EXEmR0of3DV9trP/yv3dqAYIMf9sxHP587/rUS1Oft3oNr6nH9/Yz5Ad3Lh0tTk8Yj4V0Qcje496fbIOmUc++jgZ+3yBlvz/7JHWn76vHRE5V7XnpXnTIzPjT/sdQMR929G/D93/m+y2P4nOe1/+vdgepNlHHzq9rl2eRvHP7Bb6l9EHMlt/5du6JCsf3+O4UZ/YDjrFaz1xHsff92u/O3Gv1tMwMNL2/+968f/QLL8fj2zWy/jxHxXvV3edvv/PcmrjbsKZcsV3h2fm5sZiaglL1bTvSv2j269zvA4yuIhi5c0/o8+uf74X17/vxYRC6t+dvL7yjXFmf/81fdLu/ro/0Nx0vif2FL73zaRLETkZo3eHvimXfmba/9PNtr6o609xv+g6dMsTHtW7s8J0K68rE7XFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeB5WI2BdJZWgxXakMDUX0RcS/Y29l6trs3NMXrr19dSLNa3z/fyX7pt/+5naSff//wLLt0VXbJyLiQER8Uq01tofOX5uaKPriAQAAAAAAAAAAAAAAAAAA4BHR12b9f+rXatG1A3ZdV9EVAAqTE/8/FFEPoPO0/1Be4h/KayvxX9vFegCdp/2H8hL/UF7iH8pL/EN5iX8AAAAAAHisHDh856ckIhaeqzUeqZ5WXnehNQN2W6XoCgCFyb3FjzU+UAqm/kB5eY8PJBvk97Y9aaMz252cmj6/8ckAAAAAAAAAAAAAQObIIev/oays/4fyyl3/D5RCtv7/cMH1ADpv2+/x267pBf6J1lvJ3z7cN7H+HwAAAAAAAAAAAADYEbPz1y+PT01NznQu8WPrS79yj6lFRIfrkyVeK6LQYhP1ev1G46V4ROqz9USy8EhUo5nIpsJv/qze/CjYnUS21m9zZxX0BwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFjj7wAAAP//13kb9A==") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') symlink(&(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') open(&(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x14f040, 0xa2) 2.131776931s ago: executing program 7 (id=1034): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) syz_mount_image$fuse(0x0, &(0x7f0000000600)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0x1, 0x12) 1.879165427s ago: executing program 7 (id=1036): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xfbb, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xffbffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92f6, 0x1000, 0x2, 0x146, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x4, 0x1, 0x2, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0x2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x3, 0x6, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x13, 0x20000000000000dc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.852234629s ago: executing program 35 (id=1036): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xfbb, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xffbffffe, 0x257, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92f6, 0x1000, 0x2, 0x146, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x4, 0x1, 0x2, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0x2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x3, 0x6, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x13, 0x20000000000000dc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.789488116s ago: executing program 0 (id=1042): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, 0x0}], 0x1, 0x60, &(0x7f00000001c0)=[@cr4={0x1, 0x40002}], 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.629023272s ago: executing program 0 (id=1043): syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x3010018, &(0x7f0000000380), 0x5, 0x4d0, &(0x7f0000011c00)="$eJzs3V9oVuUfAPDveffH/eb8bb9fUeLVSjBD3JyvSwQDvRKkhDQoqIuGezen71TchLaL6A+UUYHeeJMEdVEQXqyr6ibCi6gIuvAmKLwoiBxMyyK8CBbn/bOme7c5pzu6Ph84nOc55z3n+b7v43ne83w97A3gX6s9InZERF1EbIqI1sr2XGWJF8tL+rpCfuxAuiQxObnvchJJROzOjx2oniuprFdWTtAUEee+iGiun9nu0MjooZ5isXCsUu8cHjzaOTQyunFgsKe/0F84nO/ams/nu7flu2/Ze/3tr4OnPrm66/XTl3795qfzH59NYke0VPZNfx+3Snu0T30m09UnEY/e6sYy1pR1ACzY2cdPvZV1DADA0kvv8f8fEQ+W7v9boy7KN+sHx5+90hpX+mY7ru3Pdy4uZZwAAADAzZuM1tiermtqmHUPAAAAcPfIRURLJLmOyrMALZHLdXSUn+G9N5pzxSNDwxv6jhw/3BulZ2XboiHXN1AsVJ8VbouGJK13lcr/1DdfV89HxP8i4kTrf0r1jv1Hir1ZJz8AAABgmWuJuPDMK5/ev3KW+X/qh9asowQAAAAWI53/r7rQXPpTXX+Y5wMAAMCylM7/r7x66asw/wcAAIBlqzr/n/odLoXbWKj+ANqdEo+CwnyFjAcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqGFyMolJAAAAYFnLOv8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDdZXd+7EB1Wao2x3ctVUvMZmJnRLSV+79QWcp76qOptG6Khoho/j2J+mnHJRFRt8i2O9ZFtMeG706+8MtH6RKVf4eLPC13ibEfs46A261+jn2NW5YwEO44a57IOgKy9O2JrCMgS+cnso6ALO3dl3UEZGnPI1lHQJbevpx1BHy+MyI21cr/5WJ1aV3OAl2f/6mbZ253I74+E9EeHT9P3zYz/5MbX2QzzGFiZ8T2iCjMyP/lqi9pq6vUVpVShQ1J30CxsCki/hsR66NhRVrvmqON3avP1cz0vHlf2v/H91Tzf+mStl/NBVbiGK9fce1xvT3DPYt935RNvBSxpr5W/ydT+d9klvzvihtrIj1ssNaOq1+m/f/GZ3P3P7fT5LsRD9W8/pOp16SlzuHBo51DI6MbBwZ7+gv9hcP5rq35fL57W767szQedFZHhZk+fPn9mt/0D+wvjf8j+j876fXfPHf/l8b/oZHRQz3FYuHY0MLbeG3d6Zrf4R+cTvu/8dzNjP+NyZOlABsr257vGR4+1hXRmDw2c/vmhce8XFU/j+rnlfb/+rW1v/+r93/l8T83Y/y/p7LOlf8LcVYPv3ex5vbvT6b9n3/K9Z+dtP9757n+k2uu/4UXnlu7d32ttp+O0v3fmfmv/y2lYKoncf83vxvtoKzjBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6f4OAAD//1/T7bc=") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000012100)='./file0\x00', 0x0, 0x0) getdents(r0, 0x0, 0x58) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x82, &(0x7f0000000140)=ANY=[@ANYBLOB='test_dummy_encryption=v1,checkpoint=disable,noacl,fsync_mode=strict,jqfmt=vfsold,noquota,fsync_mode=posix,usrjquota=ext4\x00,resuid=', @ANYRES64, @ANYRES16], 0x1, 0x105c5, &(0x7f0000000480)="$eJzs3E9rHPUfB/DPNr/+/dVapH/05IAIWXCXbJIGBZGoLVowJfjn4Ek3u5tl292dkN2ksScP7UkfgldBpDcfg5c+jeJB8CR4qyg7M6mJBlGzYdPm9YLhPfPd73z2O5sh8NkJCeDIOp/88nMpzsXpiJiKiLMR2X6p2DKLeTwfES9GxLEdW6kYfzxwIiLORMS5UfG8Zql4aeHXh4++fuH66198+7Bc+/GbryZ31cCkvRwRvbUofjvk0naeN9fyrG92suzNbxaZv9C7VRyned5urfSyrG/Pq2c5187np2sbg1GuduuNUbY7q9n4Wj9/w8Fme7tOdsLN+vqpUTZbK9l4Z5Bm2b6Tr2uryDuDYV6nWdT7LCsfw+F25uOtrVZ+PWu3smz0h8V4XjdttrZGuVlk8XbRSLvNbB0r//ljPvTe6/Q3tpLN1vqgk/aTK9Xaq9XaQqW2njZbw9Z8pd5rLswn0+3uaFpl2Kr3Fttp2u62qo20V06m241GpVZLpq+2Vjr1flKrVeeqM5Ur5WLvleSdGx8l3WYyPcq3Ov2NYac7SFbT9SQ/o5zMVudeKycv1ZIPlpaT5fevXVta/vCTqx/feHPp+tvFpL8sK5menZmdrdRmKrO1suvfj9L+TueocwMB/Gv6f2AS/uj/I2738jxE/X92rP8/eI/73zh2JPtf/T/sgxsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODI+uH4d+9mO+fz4/8X488UQ89FxOWIuBQRFyPitz1MxYldNS9ERKnY32v+8T+t4ftSZBVG55wstjMRsVhsj5496E8BAAAAnl73H9y9t7O1fuPvp0/tOvr8YNbEQTi212Dxpc2pcb1J9pXP/8ZV7UJWbGtM1S5ulxyLSxFx/PxPY6p2efQDOvvpmKr9I1O74tSOKOWx5w0DAAA82XZ3AmPr3gAAADh0vpz0ApiM7Hlt8bf4xbPgk3kUDwRP7zoCAAAAnkClSS8AAAAAOHBZ/+///wEAAMDT7f6Du/cmvQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPidnXvHTSOI4wD8B7KBvBQU8bgKVZSSgkPkCClT2pJ9G3ecwRLiHLjzESyw2B1jL4aKZUH4+6RlHsBPAxLFzLADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAl+4hm47v5je3h+YsV6+uV3vEVcS+pwAAAICjWWTTcV7pFu1vqf9H6voVEcOIGEREP3ZP31vxuZTZi4hGqu96fbY1hvuIPGH9nna6vkbEn3Q9/Tz2twAAAACXaz4bTSJa62r+8HtT4wNIizadqvLyJZ9PVaX18rD/FaX1XyIrMYiIrPtYUdowIprf/6ZWLb+/VqnovCkaRdGsYxQAAEC9yjOBymZvAAAAnJ1/px4Ap5Hv16b/4qe94HZRpA3BL6UWAAAAcL6277bfaNQ7DgAAAOAE8vn/u/P/0qqA8/8AAADgMhTn/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBMi2w6ns9Gk0NzlqvDVPNpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4Zn/OUSiEwSiM3rxR9xTc/7LkQmxtbc6B/HxkKAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADcGWvldcW7cXSMdefbMZP8utv490Fj63FjT/KZT/4EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAONmfsxMMgSAIg/0fXmBIi/mHJQ0agwhVsPCxwzwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAW32ul+8dv8aR5N/fxpRkH0nmjhpLR421C42tC+PpawAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICTHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7M89SgNBAIbhb1cXXbAQPYL94s8ZbKxEj+APCAt7Bg/ghWxSpV1ykeQKSZEJpEsVtsjzNO83TDMDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp2l94P5q/3CWpE798nu7PM91mtR/4/h8kaRJ9b9aDJfb+T6bv5Z5k7e7Nkmb6rgfAQCYSLdrGd8//dd96UPpY+lTafcx9J9TPhoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANiwc8eqTUVhAIBPkiZanRytIIKDLjY2sRohi0OhuyDoFtpYiqlKmqEtXfoEopOrr2A3fQVfQHDQgoNDBwUXQZQkN+kJBkkR7g31++C/988dzj0nQ+C//7kBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADiWw71wdpDnQghzM0d51/uvuyvjzm+ffZgbxJc7by7GY3aHKIYQHq63mtdTXMu029zeedRotZptiUQiGSZZ/zIBAHDSFJPo1vWfivvL3Wu5egi/Xo3W/1eiPPyl/v/88vyFQfzceteJ7xXX/wuprXD6lTsbT8ub2zvX1jcaa8215uNqtbJ4c/HG7VuVcu9ZSdkTEwAAAP5NKYm4/s/X/+z/n4nyMGH9f2/pwf34XgX1/1hHTb+sZwIAAPB/O3fp+7fcmOu5UilsNTqd9kL/OPxc6R8zmOqxnUoirv8L9axnBQAAAKThcC830v9fjfIwYf9//vXuQTxmIYQwm/T/51eetFbTW85US+N14qzXCAAAQLZmk4j7/8Xe/v/8cMtDPoRw9XI/T/4GcKL6/+OLuyMvrcf7/6vpLXEq5Wv976N3roUwU8t6RgAAAJxkp5PoFvsHxf3l9o/nSyX7/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfrNjxygNBFEYgDe7Wa3EgJVaeQHRzipgIYiNhxAFwROIIB5AbC29g6V3SK1gY2GZwhvIm91RSROw2FXyfTB5jzBkXiZN/gUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJhruv/dV/Eyavqyfe/54+ok6stMDe/365uxoh90OfQ/NNjrewIAAAAWQZXzfVEUb/XjYdRynPJ/nfdE5n9Yafqc52dzf65Pd68bOf9fH29dfh00as6JDz07vzjd6ewb/n2rc3cM082nZy9V+kHKo5u1aZ3uc3A7mRwspXa5i2kBgN/YzrVt8v+hqLt9DgbAwhi2q/iR/6txvzMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdOEzAAD///9bXNA=") syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000010a80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000010b80)) renameat2(0xffffffffffffff9c, &(0x7f0000010c00)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000010c40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2) 1.619166833s ago: executing program 6 (id=1044): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 1.364340279s ago: executing program 3 (id=1046): syz_mount_image$erofs(&(0x7f0000000080), &(0x7f00000003c0)='./file0\x00', 0x18000c6, &(0x7f0000000400)=ANY=[@ANYRES16=0x0, @ANYRES16], 0x0, 0x17d, &(0x7f0000000440)="$eJzsmLFP+kAUx7/vyg/yMy6uLg4SxcHSFjUuxLA5mogaNwlUghYx0EGYdPH/cHZwdvOPMM7qYFwY3Uxqej3oQQR10MT4PsPj+7h313evyXcoGIb5szw+vNyvFe+EAWASaaTU/89GXCO0+tfb83Jraj1/OfeUv041robPIwBB8PnnJwDcFAz4Kg+Cwd1p9VuE6OstCCwovQOCqfQeBLaVdkHYVfpA042w3jT3a55rlhteJRRWGOwwOGHIDffXPSNUtP5IW2+1O4clz3Ob3yg+ml+3IJDX+tPfV282ljY/GwK20jkQNpVeRao3m2gk2v2nE/H5xg/fnwULFr9NxP4UXBDmNX9KaP6R9evH2Va7s1irl6pu1T1ynNyKtWRZy05WGlEUx/jff+lPE9r5/0bUJimJk5LvN+0o9nMniu85rpD+J5CZjfLQ+5Mju4nWSe0jqTLGmHKGYRiGYRiGYRiGYRiGYZgvMAOSX0EldIo4GcDZkNVvAQAA///an3MA") mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000640)='./bus\x00', &(0x7f0000000680), 0x0, &(0x7f00000006c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000700)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000001980)='./file1\x00', 0x101042, 0x15) 1.293816487s ago: executing program 3 (id=1047): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000bc0), r1) getsockname$packet(r1, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000c40)=0x40) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=@newlink={0x3c, 0x10, 0x501, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}]}, 0x3c}}, 0x40848c0) sendmsg$nl_route(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000e80)=@newlink={0x2c, 0x10, 0x401, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x52e50, 0x1a001}, [@IFLA_CARRIER={0x5, 0x21, 0x84}, @IFLA_IFALIASn={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x20004000) 1.073522319s ago: executing program 6 (id=1048): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x10, 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 1.035652233s ago: executing program 3 (id=1049): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x10001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000500), 0x8042, 0x0) sendfile(r0, r0, 0x0, 0xfff2) 995.429918ms ago: executing program 3 (id=1050): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x2710, @local}, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x88bbcfd08703268b, @host}, 0x10) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f00000000c0)={0x28, 0x0, 0x8703268b, @local}, 0x10) 945.685122ms ago: executing program 3 (id=1060): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x11, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0100000004000000040000000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0xd, &(0x7f0000000b00)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @generic={0x7a, 0xa, 0x0, 0xffb8, 0xfffffffe}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000bc0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000c40)='\x00'/14, 0x0, 0xfeff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 813.821556ms ago: executing program 4 (id=1052): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x1, 0xfffffffa, 0x0, 0xd, "0062007d82000000000000002240f7ffffff00"}) r1 = syz_open_pts(r0, 0x100) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000100)=0x7f) 780.389119ms ago: executing program 3 (id=1053): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000006c0)={0x24, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000740), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, 0x0) ioctl$HIDIOCGUSAGES(r1, 0xd01c4813, 0x0) 687.458109ms ago: executing program 8 (id=1037): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) read(r0, &(0x7f0000000680)=""/4096, 0x1000) syz_io_uring_setup(0x131, &(0x7f0000000600)={0x0, 0x2d45, 0x1080, 0x400000}, &(0x7f0000ffe000), 0x0, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000001000/0x3000)=nil, 0x1000}) 523.353596ms ago: executing program 4 (id=1054): r0 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0x1ad2, 0x4) bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) sendto$packet(r0, &(0x7f00000002c0)="fb57975e267951722b395d37bac8", 0xe, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x2000) 502.767858ms ago: executing program 4 (id=1055): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000) getsockname$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000016c0)=@newlink={0x4c, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x1114}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast1}]}}}]}, 0x4c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x401, 0x4000000, 0x0, {0x0, 0x0, 0x0, r2, 0x100, 0x802c}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast1}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40001}, 0x20004090) 434.544525ms ago: executing program 4 (id=1056): syz_mount_image$erofs(&(0x7f0000000c00), &(0x7f0000002200)='./file0\x00', 0x1000801, &(0x7f0000002240)=ANY=[@ANYRES16=0x0, @ANYRESDEC=0x0, @ANYBLOB="78cd4e86f938b6bc06e6fad108c083e67531db667e030110e889413d713533a483788422c57d5796c063a23edf08b84967c808da7626e8a7fac0374f5148421ab5d8eb33565986215290195d7b55ada270264944ec790f3e7c1cefbb5dc7bed827e24b47d33cbb0c46d7e98a8dfd13708dd5ecacd833ca11f6ab1b06e544ee93719ddf3526"], 0x0, 0x1da, &(0x7f0000002300)="$eJzsmD+r01AYxp9zkpt7bxHBRdBFwYIV2jRJVVwc6icQWv9tFhtLNW2lzdAWHIqLix/Dr+DQycHNzVUHFQQHO4mTw5GTnCbHtkZTEYr3/UFPnvPvPXnfhKcQEARxZPn44dv7Z9euNMsAjqGIfTX+2UjXcG39uwMl3j5/1T/+eP5TMCP/+SaAl3UDoeoLIYQ+X1TXJniib4DjgtK3wGArfRccN5X2wXBH6QeaHhwqEfj2vUHQvt8NfEc2rmw82dRW728xY2gDkKmLlRxHk+nDVhD4w1WxJ5bnrE3lFb+pn7moc1zV6ief1+2nT2ayv6yNo9XPBYerdA0MjWVNsA/bttOSaPmfNtP4xp/kvwviRCVrTTl7+/etTz/1VT36bbZbqrC7UsP/UDBt5FAKBiAZObmYv17f9SnXETBz3djZf5sylGevTb0p/F3kzHc19U9pL+c1fzJhJv5RDXuPqqPJtNLttTp+x+97Xu2yc9FxLnnVyIjiNsP/DiJ/Kmjx936x1mIWxq0wHLpjIBy6Sd+LW81xGy8GX6I9PPI/jtK5OIZ8VazYKjfC1I9HV6lKW/wrEgRBEARBEARBEARBEARBbOIMWPQVVAjB1AfRTXjXo9U/AgAA///YUVl2") syz_mount_image$fuse(0x0, &(0x7f0000002500)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002540)='./file1\x00', 0x1c0) mount$overlay(0x0, &(0x7f0000002580)='./bus\x00', &(0x7f00000025c0), 0x0, &(0x7f0000002600)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000002640)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', 0x0, 0xd5) 399.084009ms ago: executing program 4 (id=1057): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000140)={[{@dioread_lock}, {@debug}]}, 0x1, 0x246, &(0x7f0000000240)="$eJzs3T9oM2UcB/DvXRJf+75BXnURxD8gIloor5vg8rooFKQUEUGFioiL0gq1xa1xcnHQWaWTSxE3q6N0KS6K4FS1Q10ELQ4WBx0iybVS24ja1Jz0Ph+43l3vee73HLnvkyyXBGisq0muJ2klmU7SSVIcb3B3tVw93F2f2l5I+v0nfiqG7ar9ylG/K0l6SR5KslUWeamdrG4+s/fLzmP3vbnSuff9zaenJnqRh/b3dh8/eG/ujY9mH1z94qsf5opcT/dP13X+ihH/axfJLf9Fsf+Jol33CPgn5l/78OtB7m9Ncs8w/52UqV68t5Zv2OrkgXf/qu/bP355+yTHCpy/fr8zeA/s9YHGKZN0U5QzSartspyZqT7Df9O6XL68tPzq9ItLK4sv1D1TAeelm+w++smlj6+cyP/3rSr/wMU1yP+T8xvfDrYPWnWPBpiIO6rVIP/Tz63dH/mHxpF/aC75h+aSf2gu+Yfmkn9oLvmHC6xztNEbeVj+obnkH5pL/qG5jucfAGiW/qW6n0AG6lL3/AMAAAAAAAAAAAAAAAAAAJy2PrW9cLRMquZn7yT7jyRpj6rfGv4ecXLj8O/ln4tBsz8UVbexPHvXmCcY0wc1P31903f11v/8znrrry0mvdeTXGu3T99/xeH9d3Y3/83xzvNjFviXihP7Dz812fon/bZRb/3ZneTTwfxzbdT8U+a24Xr0/NM9/hXLZ/TKr2OeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIn5PQAA//8PK23M") r0 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./file1\x00', 0x42042, 0x38) r1 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./file1\x00', 0x101042, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) pwrite64(r1, &(0x7f0000000c00)='2', 0xfdef, 0xfecc) fallocate(r0, 0x10, 0x10c00, 0x8000) 278.448171ms ago: executing program 0 (id=1058): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 254.751074ms ago: executing program 4 (id=1059): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x40) write(r0, &(0x7f0000000180)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000012, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x6, 0x7ff00003}]}) 218.646208ms ago: executing program 0 (id=1061): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="b8000000190001000000000000000300e00000020000000000000000000000000000000000000000000000000000003bbcd68600000000000a00200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0800000000000000100000000000000002000000010000000000000000000000ff0f00000000000073b4ffffffffffffffffffffffffffff0000000000000000000000001000000000000000000000200200000000000000fffffffffffffffffe"], 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x3, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 53.970734ms ago: executing program 0 (id=1062): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8403, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00000000c0)=0x6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/2, 0x2}, 0x20) 0s ago: executing program 0 (id=1063): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000180)='./file0\x00', 0x200008, &(0x7f0000000080)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYRESOCT], 0x1, 0x392, &(0x7f0000001000)="$eJzs3T1vW2UUAOATt/mExBkQEiDEq24sVhL+QCPUSohIoFCj0gFxS5xixY0j2wpyhaADEiv/gL1iZENC/IEMsLOxZWHsUNXIX6mdul+kyaXq80jRPfZ7jvO+tnx1FuscXv3x5s52s7SdtaJwMUUhIgp3I5Z7Ud/U4FroxTMx6na8W7z619uffHbtw/WNjUubKV1ev/LeWkpp6Z3fvv7m5wu/t1759JelX2fjYPnzw3/W/j54/eCNw/tXvqo2U7WZduutlKXr9Xoru16rpK1qc6eU0se1StaspOpus9IYW9+u1ff22inb3Vpc2GtUms2U7bbTTqWdWvXUarRTdiOr7qZSqZQWF4InKd/Z3MzW+/HcY/IuntWGOAWNxnrW/Q7PPrRSvpPLhgCAXJ20/595qv7/WmGk/5+LR/b/06H/fy6mny5ttP//zy/C/1y3/58ZfH/H6f8BAAAAAAAAAAAAAOBFcLfTKXY6neLw2hn+SHjwOOftccoe+vyP/eW9P07XyA/35iJqP+yX98v9a399fTuqUYtKrEQx7nVvC0P9+PIHG5dWUs9yLN78rld/4Y+I8rnx+tUoxvLk+tV+fTqqj+51OhZG69fii3htcv3axPqZWPlppL4Uxfjzy6hHLbZ6t7cH9d+upvT+RxvH6md7eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8HEpp6K3oz73fL0fMx/5gfn/pQcLy+Hz8fv3RfP2VKMa9yfP5VybO5z8fb57P9+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNRs39rJarVK46yC4cz/3jMzw+DRVVP99NvHluZjPHn2Sa9zwqDwTFXzg0NOWLrf6XR6wY3vn/tW5872ozxJMB0Rj8npDN7Ak/+vVyNi9Jlz4zmzEXGqJ13qBoX83/BnDvK4GwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEC+joZ+dx9M5b0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8tJs39rJarVK4xSDvM8IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwIvk3AAD//8s8Cyw=") r2 = openat(r1, &(0x7f00000006c0)='./file2\x00', 0x80000, 0x40) mmap(&(0x7f0000521000/0x3000)=nil, 0x3000, 0x0, 0x10012, r2, 0x1000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) kernel console output (not intermixed with test programs): Compute Engine, BIOS Google 10/07/2026 [ 48.382553][ T1491] Call Trace: [ 48.385877][ T1491] [ 48.388852][ T1491] __dump_stack+0x21/0x24 [ 48.393226][ T1491] dump_stack_lvl+0x110/0x170 [ 48.397938][ T1491] ? __cfi_dump_stack_lvl+0x8/0x8 [ 48.403013][ T1491] dump_stack+0x15/0x24 [ 48.407209][ T1491] should_fail_ex+0x3bf/0x510 [ 48.411932][ T1491] ? __seq_open_private+0x7b/0x1b0 [ 48.417107][ T1491] __should_failslab+0xac/0xf0 [ 48.421965][ T1491] should_failslab+0x9/0x20 [ 48.426544][ T1491] kmem_cache_alloc+0x3b/0x320 [ 48.431369][ T1491] ? __kmalloc+0xb4/0x1e0 [ 48.435740][ T1491] __seq_open_private+0x7b/0x1b0 [ 48.440733][ T1491] seq_open_private+0x23/0x40 [ 48.445459][ T1491] proc_seq_open+0x94/0xd0 [ 48.449943][ T1491] proc_reg_open+0x27d/0x5e0 [ 48.454598][ T1491] do_dentry_open+0x885/0x11f0 [ 48.459419][ T1491] ? __cfi_proc_reg_open+0x10/0x10 [ 48.464590][ T1491] vfs_open+0x73/0x80 [ 48.468655][ T1491] path_openat+0x2699/0x2f30 [ 48.473311][ T1491] ? do_filp_open+0x420/0x420 [ 48.478047][ T1491] do_filp_open+0x1ee/0x420 [ 48.482595][ T1491] ? __cfi_do_filp_open+0x10/0x10 [ 48.487669][ T1491] ? __cfi_kfree_link+0x10/0x10 [ 48.492574][ T1491] ? alloc_fd+0x4c1/0x570 [ 48.496962][ T1491] do_sys_openat2+0x15e/0x820 [ 48.501699][ T1491] ? __se_sys_futex+0x136/0x310 [ 48.506627][ T1491] ? do_sys_open+0xe0/0xe0 [ 48.511109][ T1491] ? __this_cpu_preempt_check+0x13/0x20 [ 48.516720][ T1491] ? xfd_validate_state+0x70/0x150 [ 48.521910][ T1491] __x64_sys_openat+0x136/0x160 [ 48.526840][ T1491] x64_sys_call+0x783/0x9a0 [ 48.531400][ T1491] do_syscall_64+0x4c/0xa0 [ 48.535880][ T1491] ? clear_bhb_loop+0x30/0x80 [ 48.540627][ T1491] ? clear_bhb_loop+0x30/0x80 [ 48.545362][ T1491] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 48.551302][ T1491] RIP: 0033:0x7fb79995fd8e [ 48.555765][ T1491] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 48.575506][ T1491] RSP: 002b:00007fb79a90aec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 48.583970][ T1491] RAX: ffffffffffffffda RBX: 00007fb79a90b6c0 RCX: 00007fb79995fd8e [ 48.591983][ T1491] RDX: 0000000000000002 RSI: 00007fb79a90af90 RDI: ffffffffffffff9c [ 48.600004][ T1491] RBP: 00007fb799a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 48.608016][ T1491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.616031][ T1491] R13: 00007fb799c26038 R14: 00007fb799c25fa0 R15: 00007ffd43427758 [ 48.624049][ T1491] [ 48.634792][ T289] EXT4-fs (loop0): unmounting filesystem. [ 48.671176][ T290] EXT4-fs (loop2): unmounting filesystem. [ 48.805423][ T1506] loop1: detected capacity change from 0 to 256 [ 48.830642][ T1506] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 48.946964][ T1485] EXT4-fs (loop3): re-mounted. Quota mode: none. [ 48.958858][ T1485] EXT4-fs (loop3): re-mounted. Quota mode: none. [ 48.976987][ T1523] loop1: detected capacity change from 0 to 1024 [ 48.987057][ T288] EXT4-fs (loop3): unmounting filesystem. [ 49.000561][ T1523] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a016c118, mo2=0002] [ 49.010364][ T1523] System zones: 0-1, 3-12 [ 49.015782][ T1523] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 49.165615][ T60] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 49.364900][ T60] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 49.379476][ T60] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 49.409062][ T60] usb 1-1: New USB device found, idVendor=08b7, idProduct=ec00, bcdDevice= 0.00 [ 49.437675][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 49.462180][ T60] usb 1-1: SerialNumber: syz [ 49.638781][ T1542] loop2: detected capacity change from 0 to 40427 [ 49.656757][ T1542] F2FS-fs (loop2): invalid crc value [ 49.675670][ T1542] F2FS-fs (loop2): Found nat_bits in checkpoint [ 49.686820][ T60] usb 1-1: 0:2 : does not exist [ 49.705955][ T60] usb 1-1: USB disconnect, device number 2 [ 49.778516][ T1542] F2FS-fs (loop2): Start checkpoint disabled! [ 49.800573][ T1542] F2FS-fs (loop2): f2fs_disable_checkpoint() finish, err:0 [ 49.820388][ T1542] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 49.932375][ T287] EXT4-fs (loop1): unmounting filesystem. [ 49.940496][ T1542] syz.2.451: attempt to access beyond end of device [ 49.940496][ T1542] loop2: rw=2049, sector=45096, nr_sectors = 32 limit=40427 [ 50.027577][ T1540] loop3: detected capacity change from 0 to 131072 [ 50.049439][ T8] kworker/u4:0: attempt to access beyond end of device [ 50.049439][ T8] loop2: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 50.084710][ T1540] F2FS-fs (loop3): Found nat_bits in checkpoint [ 50.208610][ T1540] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 50.228819][ T1562] loop4: detected capacity change from 0 to 512 [ 50.268242][ T1562] EXT4-fs (loop4): Test dummy encryption mode enabled [ 50.285111][ T1562] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 50.308398][ T1568] loop2: detected capacity change from 0 to 1024 [ 50.322589][ T1562] EXT4-fs error (device loop4): ext4_orphan_get:1431: comm syz.4.458: bad orphan inode 131083 [ 50.336957][ T1568] EXT4-fs: Ignoring removed bh option [ 50.348609][ T1568] EXT4-fs: Ignoring removed bh option [ 50.362187][ T1562] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 50.433648][ T1568] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 50.456862][ T291] EXT4-fs (loop4): unmounting filesystem. [ 50.753385][ T1555] loop1: detected capacity change from 0 to 131072 [ 50.770395][ T1555] F2FS-fs (loop1): Wrong NAT boundary, start(2560) end(5) blocks(1024) [ 50.781474][ T1555] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 50.789981][ T1568] EXT4-fs (loop2): re-mounted. Quota mode: none. [ 50.797600][ T1568] EXT4-fs (loop2): re-mounted. Quota mode: none. [ 50.812527][ T290] EXT4-fs (loop2): unmounting filesystem. [ 50.827566][ T1578] netlink: 20 bytes leftover after parsing attributes in process `syz.3.471'. [ 50.837234][ T1555] F2FS-fs (loop1): Found nat_bits in checkpoint [ 50.872822][ T1578] netlink: 20 bytes leftover after parsing attributes in process `syz.3.471'. [ 50.890217][ T1576] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 50.900471][ T1576] ext4 filesystem being mounted at /88/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.927575][ T1590] device ipip0 entered promiscuous mode [ 50.956328][ T1555] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 50.959651][ T1593] FAULT_INJECTION: forcing a failure. [ 50.959651][ T1593] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 50.974173][ T1555] F2FS-fs (loop1): Mounted with checkpoint version = 753bd00b [ 50.977415][ T1593] CPU: 0 PID: 1593 Comm: syz.0.464 Tainted: G W syzkaller #0 [ 50.992736][ T1593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 51.002826][ T1593] Call Trace: [ 51.006164][ T1593] [ 51.009120][ T1593] __dump_stack+0x21/0x24 [ 51.013488][ T1593] dump_stack_lvl+0x110/0x170 [ 51.018193][ T1593] ? __cfi_dump_stack_lvl+0x8/0x8 [ 51.023364][ T1593] ? exc_page_fault+0x5e/0xb0 [ 51.028519][ T1593] dump_stack+0x15/0x24 [ 51.032754][ T1593] should_fail_ex+0x3bf/0x510 [ 51.037471][ T1593] should_fail+0xb/0x10 [ 51.041658][ T1593] should_fail_usercopy+0x1a/0x20 [ 51.046721][ T1593] strncpy_from_user+0x24/0x2c0 [ 51.051868][ T1593] ? bpf_xdp_frags_increase_tail+0x1e2/0x360 [ 51.057970][ T1593] strncpy_from_user_nofault+0x73/0x150 [ 51.063553][ T1593] bpf_probe_read_user_str+0x2a/0x70 [ 51.068869][ T1593] ? 0xffffffffa00021e4 [ 51.073091][ T1593] bpf_prog_06f22831d6c68d16+0x3d/0x3f [ 51.078567][ T1593] bpf_dispatcher_xdp_func+0x25/0x30 [ 51.083899][ T1593] bpf_test_run+0x415/0x940 [ 51.088438][ T1593] ? dst_hold+0xc0/0xc0 [ 51.092612][ T1593] bpf_prog_test_run_xdp+0x72c/0xf80 [ 51.097921][ T1593] ? __cfi_bpf_prog_test_run_xdp+0x10/0x10 [ 51.103753][ T1593] ? __kasan_check_write+0x14/0x20 [ 51.108880][ T1593] ? __cfi_bpf_prog_test_run_xdp+0x10/0x10 [ 51.114701][ T1593] bpf_prog_test_run+0x3b4/0x5c0 [ 51.119663][ T1593] ? bpf_prog_query+0x270/0x270 [ 51.124532][ T1593] ? selinux_bpf+0xce/0xf0 [ 51.128974][ T1593] ? security_bpf+0x93/0xb0 [ 51.133504][ T1593] __sys_bpf+0x5ee/0x850 [ 51.137769][ T1593] ? bpf_link_show_fdinfo+0x330/0x330 [ 51.143161][ T1593] ? fpregs_restore_userregs+0x128/0x260 [ 51.148814][ T1593] __x64_sys_bpf+0x7c/0x90 [ 51.153289][ T1593] x64_sys_call+0x488/0x9a0 [ 51.157837][ T1593] do_syscall_64+0x4c/0xa0 [ 51.162271][ T1593] ? clear_bhb_loop+0x30/0x80 [ 51.166968][ T1593] ? clear_bhb_loop+0x30/0x80 [ 51.171675][ T1593] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 51.177596][ T1593] RIP: 0033:0x7f37a699f559 [ 51.182025][ T1593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.201647][ T1593] RSP: 002b:00007f37a78ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 51.210084][ T1593] RAX: ffffffffffffffda RBX: 00007f37a6c25fa0 RCX: 00007f37a699f559 [ 51.218066][ T1593] RDX: 0000000000000050 RSI: 0000200000000900 RDI: 000000000000000a [ 51.226132][ T1593] RBP: 00007f37a6a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 51.234146][ T1593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 51.242130][ T1593] R13: 00007f37a6c26038 R14: 00007f37a6c25fa0 R15: 00007fff88021bf8 [ 51.250123][ T1593] [ 51.260406][ T291] EXT4-fs (loop4): unmounting filesystem. [ 51.286026][ T28] kauditd_printk_skb: 7 callbacks suppressed [ 51.286042][ T28] audit: type=1400 audit(1793234224.453:324): avc: denied { mount } for pid=1598 comm="syz.3.478" name="/" dev="loop3" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 51.338268][ T28] audit: type=1400 audit(1793234224.503:325): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 51.396713][ T1601] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a016c118, mo2=0002] [ 51.413168][ T1601] System zones: 0-1, 3-12 [ 51.419925][ T1601] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 51.455865][ T1609] user requested TSC rate below hardware speed [ 51.465357][ T1609] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3393688969 (54299023504 ns) > initial count (49421972784 ns). Using initial count to start timer. [ 51.608302][ T28] audit: type=1400 audit(1793234224.773:326): avc: denied { bind } for pid=1611 comm="syz.1.466" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 51.629862][ T1612] netlink: 'syz.1.466': attribute type 11 has an invalid length. [ 51.653747][ T348] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 51.693134][ T1618] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 51.828615][ T1628] erofs: (device loop2): mounted with root inode @ nid 36. [ 51.843805][ T348] usb 1-1: Using ep0 maxpacket: 16 [ 51.846087][ T28] audit: type=1400 audit(1793234225.013:327): avc: denied { name_bind } for pid=1625 comm="syz.3.481" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 51.851228][ T348] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.897169][ T348] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x67, skipping [ 51.901997][ T28] audit: type=1400 audit(1793234225.053:328): avc: denied { watch } for pid=1626 comm="syz.2.480" path="/106/file0/file0" dev="loop2" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 51.908962][ T348] usb 1-1: config 1 interface 1 has no altsetting 1 [ 51.953602][ T348] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 51.963039][ T348] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.998958][ T348] usb 1-1: Product: syz [ 52.003194][ T348] usb 1-1: Manufacturer: syz [ 52.010162][ T348] usb 1-1: SerialNumber: syz [ 52.018684][ T1635] EXT4-fs (loop2): Test dummy encryption mode enabled [ 52.043087][ T1635] EXT4-fs error (device loop2): ext4_orphan_get:1405: inode #15: comm syz.2.484: inode has both inline data and extents flags [ 52.073581][ T1640] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. [ 52.085092][ T1635] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.484: couldn't read orphan inode 15 (err -117) [ 52.100853][ T1635] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 52.132567][ T1642] ip_tables: iptables: counters copy to user failed while replacing table [ 52.163460][ T1644] netlink: 8 bytes leftover after parsing attributes in process `syz.1.489'. [ 52.191066][ T290] EXT4-fs (loop2): unmounting filesystem. [ 52.217781][ T1644] Zero length message leads to an empty skb [ 52.234408][ T1606] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 52.257658][ T1606] EXT4-fs (loop0): 1 truncate cleaned up [ 52.263430][ T1606] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 52.281481][ T291] EXT4-fs (loop4): unmounting filesystem. [ 52.301244][ T348] usb 1-1: selecting invalid altsetting 1 [ 52.309393][ T348] cdc_ncm 1-1:1.0: bind() failure [ 52.324242][ T348] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 52.347106][ T1651] ext4 filesystem being mounted at /109/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 52.358598][ T1655] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 52.362090][ T348] cdc_ncm 1-1:1.1: bind() failure [ 52.414651][ T348] usb 1-1: USB disconnect, device number 3 [ 52.478504][ T1671] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 2147483653 (only 8 groups) [ 52.679213][ T28] audit: type=1400 audit(1793234225.843:329): avc: denied { write } for pid=1679 comm="syz.2.503" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 52.806250][ T1700] set_capacity_and_notify: 9 callbacks suppressed [ 52.806271][ T1700] loop3: detected capacity change from 0 to 512 [ 52.827444][ T1700] EXT4-fs (loop3): Test dummy encryption mode enabled [ 52.834399][ T1700] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 52.846693][ T1700] EXT4-fs (loop3): 1 truncate cleaned up [ 52.869499][ T1703] loop2: detected capacity change from 0 to 512 [ 52.884487][ T1703] EXT4-fs (loop2): Test dummy encryption mode enabled [ 52.898658][ T28] audit: type=1400 audit(1793234226.063:330): avc: denied { relabelfrom } for pid=1704 comm="syz.3.512" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 52.918919][ T28] audit: type=1400 audit(1793234226.063:331): avc: denied { relabelto } for pid=1704 comm="syz.3.512" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 52.940234][ T1703] EXT4-fs error (device loop2): ext4_orphan_get:1405: inode #15: comm syz.2.511: inode has both inline data and extents flags [ 52.957896][ T1703] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.511: couldn't read orphan inode 15 (err -117) [ 53.034262][ T1713] binder: 1712:1713 ioctl c0306201 200000000140 returned -22 [ 53.046390][ T28] audit: type=1400 audit(1793234226.213:332): avc: denied { write } for pid=1714 comm="syz.3.516" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 53.076081][ T28] audit: type=1400 audit(1793234226.243:333): avc: denied { read } for pid=1716 comm="syz.2.517" name="file0" dev="tmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 53.133265][ T1724] netlink: 104 bytes leftover after parsing attributes in process `syz.2.520'. [ 53.169076][ T1732] loop2: detected capacity change from 0 to 512 [ 53.176140][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 53.183949][ T1732] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 53.204994][ T1732] EXT4-fs (loop2): 1 truncate cleaned up [ 53.294438][ T290] syz-executor (290) used greatest stack depth: 21280 bytes left [ 53.382381][ T1743] netlink: 4 bytes leftover after parsing attributes in process `syz.1.531'. [ 53.494274][ T1746] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.501419][ T1746] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.508561][ T1755] loop1: detected capacity change from 0 to 1024 [ 53.515844][ T1755] EXT4-fs: Ignoring removed orlov option [ 53.519413][ T1746] device bridge_slave_0 entered promiscuous mode [ 53.537929][ T1746] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.545358][ T1746] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.559984][ T1746] device bridge_slave_1 entered promiscuous mode [ 53.584881][ T1759] loop4: detected capacity change from 0 to 512 [ 53.601897][ T1759] EXT4-fs error (device loop4): ext4_orphan_get:1405: inode #15: comm syz.4.537: iget: bad i_size value: 38620345925642 [ 53.616299][ T1759] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.537: couldn't read orphan inode 15 (err -117) [ 53.632527][ T1759] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm syz.4.537: bg 0: block 5: invalid block bitmap [ 53.695612][ T1746] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.702717][ T1746] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.710069][ T1746] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.717154][ T1746] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.740467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.748282][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.755816][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.766805][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.775146][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.782202][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.793061][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.801682][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.808771][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.827356][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 53.839297][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 53.856885][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 53.869063][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 53.877368][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 53.885466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 53.894012][ T1746] device veth0_vlan entered promiscuous mode [ 53.894028][ T348] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 53.911819][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 53.922960][ T1746] device veth1_macvtap entered promiscuous mode [ 53.936516][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 53.947832][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.104937][ T348] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 54.116072][ T348] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 54.129195][ T348] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.00 [ 54.138307][ T348] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.147671][ T348] usb 2-1: config 0 descriptor?? [ 54.152961][ T1765] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 54.193722][ T60] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 54.375604][ T60] usb 5-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 54.384796][ T60] usb 5-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 54.392907][ T60] usb 5-1: Product: syz [ 54.398295][ T60] usb 5-1: config 0 descriptor?? [ 54.404663][ T60] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 54.412673][ T60] usb 5-1: Detected FT232H [ 54.563410][ T348] keytouch 0003:0926:3333.0002: fixing up Keytouch IEC report descriptor [ 54.573405][ T348] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0002/input/input5 [ 54.656748][ T348] keytouch 0003:0926:3333.0002: input,hidraw0: USB HID v0.20 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 54.763393][ T60] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 54.771755][ T60] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 54.779139][ T60] ftdi_sio 5-1:0.0: GPIO initialisation failed: -71 [ 54.786887][ T60] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 54.791615][ T1765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.801933][ T60] usb 5-1: USB disconnect, device number 4 [ 54.810218][ T60] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 54.813795][ T1765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.828463][ T60] ftdi_sio 5-1:0.0: device disconnected [ 55.002635][ T1801] ip_tables: iptables: counters copy to user failed while replacing table [ 55.064687][ T1806] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 2147483653 (only 8 groups) [ 55.107925][ T1808] netlink: 'syz.3.551': attribute type 11 has an invalid length. [ 55.243749][ T1025] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 55.243797][ T530] Bluetooth: hci0: command 0x1003 tx timeout [ 55.328877][ T1826] loop0: detected capacity change from 0 to 512 [ 55.338713][ T1826] EXT4-fs (loop0): Test dummy encryption mode enabled [ 55.350767][ T1826] EXT4-fs error (device loop0): ext4_orphan_get:1405: inode #15: comm syz.0.557: inode has both inline data and extents flags [ 55.364817][ T1826] EXT4-fs error (device loop0): ext4_orphan_get:1410: comm syz.0.557: couldn't read orphan inode 15 (err -117) [ 55.443826][ T415] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 55.452363][ T1833] loop0: detected capacity change from 0 to 512 [ 55.476689][ T1833] EXT4-fs error (device loop0): ext4_orphan_get:1405: inode #15: comm syz.0.558: iget: bad i_size value: 38620345925642 [ 55.490661][ T1833] EXT4-fs error (device loop0): ext4_orphan_get:1410: comm syz.0.558: couldn't read orphan inode 15 (err -117) [ 55.507234][ T1833] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.558: bg 0: block 5: invalid block bitmap [ 55.546471][ T1837] loop0: detected capacity change from 0 to 1024 [ 55.567361][ T1837] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a016c118, mo2=0002] [ 55.575682][ T1837] System zones: 0-1, 3-12 [ 55.592336][ T1841] binder: 1840:1841 ioctl c0306201 200000000140 returned -22 [ 55.632121][ T348] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 55.635782][ T415] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 55.650827][ T415] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.659167][ T348] hid-generic 0000:0000:0000.0003: hidraw1: HID v0.00 Device [syz1] on syz0 [ 55.661935][ T415] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 55.681177][ T415] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 55.705987][ T415] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 55.724482][ T415] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 55.732676][ T415] usb 4-1: Manufacturer: syz [ 55.744589][ T415] usb 4-1: config 0 descriptor?? [ 55.863793][ T348] usb 2-1: reset full-speed USB device number 3 using dummy_hcd [ 55.956835][ T1861] netlink: 4 bytes leftover after parsing attributes in process `syz.5.572'. [ 56.001299][ T1865] xt_hashlimit: size too large, truncated to 1048576 [ 56.169848][ T415] appleir 0003:05AC:8243.0004: unknown main item tag 0x0 [ 56.180538][ T415] appleir 0003:05AC:8243.0004: No inputs registered, leaving [ 56.195933][ T415] appleir 0003:05AC:8243.0004: hiddev96,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 56.436117][ T60] usb 4-1: USB disconnect, device number 3 [ 56.450263][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 56.450280][ T28] audit: type=1400 audit(1793234229.613:346): avc: denied { mounton } for pid=1877 comm="syz.4.578" path="/proc/255/cgroup" dev="proc" ino=25660 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 56.550491][ T1886] loop1: detected capacity change from 0 to 256 [ 56.562804][ T1888] process 'syz.0.580' launched './file1' with NULL argv: empty string added [ 56.572208][ T28] audit: type=1400 audit(1793234229.733:347): avc: denied { transition } for pid=1882 comm="syz.0.580" path="/104/file1" dev="tmpfs" ino=574 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 56.608566][ T1886] exFAT-fs (loop1): failed to load upcase table (idx : 0x00012153, chksum : 0xc3dffc2e, utbl_chksum : 0xe619d30d) [ 56.629142][ T28] audit: type=1400 audit(1793234229.733:348): avc: denied { entrypoint } for pid=1882 comm="syz.0.580" path="/104/file1" dev="tmpfs" ino=574 scontext=system_u:object_r:hugetlbfs_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 56.652964][ T28] audit: type=1400 audit(1793234229.733:349): avc: denied { share } for pid=1882 comm="syz.0.580" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 56.704205][ T19] usb 2-1: USB disconnect, device number 3 [ 56.718140][ T1892] input: syz0 as /devices/virtual/input/input6 [ 56.719595][ T28] audit: type=1400 audit(1793234229.733:350): avc: denied { noatsecure } for pid=1882 comm="syz.0.580" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 56.748899][ T28] audit: type=1400 audit(1793234229.843:351): avc: denied { remove_name } for pid=1885 comm="syz.1.581" name="file1" dev="loop1" ino=1048674 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 56.778580][ T28] audit: type=1400 audit(1793234229.843:352): avc: denied { unlink } for pid=1885 comm="syz.1.581" name="file1" dev="loop1" ino=1048674 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 56.810061][ T28] audit: type=1400 audit(1793234229.883:353): avc: denied { read } for pid=1891 comm="syz.1.582" name="uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 56.834344][ T28] audit: type=1400 audit(1793234229.883:354): avc: denied { open } for pid=1891 comm="syz.1.582" path="/dev/uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 56.857913][ T28] audit: type=1400 audit(1793234229.883:355): avc: denied { ioctl } for pid=1891 comm="syz.1.582" path="/dev/uinput" dev="devtmpfs" ino=262 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 56.947300][ T1896] loop1: detected capacity change from 0 to 1024 [ 57.003170][ T1896] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e000c01c, mo2=0002] [ 57.032289][ T1896] System zones: 0-1, 3-36 [ 57.053627][ T1896] EXT4-fs error (device loop1): ext4_orphan_get:1431: comm syz.1.585: bad orphan inode 134217728 [ 57.104059][ T1902] exfat: Deprecated parameter 'namecase' [ 57.110016][ T1896] EXT4-fs (loop1): re-mounted. Quota mode: writeback. [ 57.145491][ T1902] exFAT-fs (loop3): failed to load upcase table (idx : 0x000124d2, chksum : 0x8bf59041, utbl_chksum : 0xe619d30d) [ 57.245106][ C1] I/O error, dev loop3, sector 160 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.245312][ C0] I/O error, dev loop3, sector 162 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.254905][ C1] I/O error, dev loop3, sector 161 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.264519][ C0] I/O error, dev loop3, sector 163 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.274536][ C1] I/O error, dev loop3, sector 160 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 57.283816][ C0] I/O error, dev loop3, sector 164 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.302801][ C0] I/O error, dev loop3, sector 165 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.312504][ C0] I/O error, dev loop3, sector 166 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.322212][ C0] I/O error, dev loop3, sector 167 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.352347][ C0] I/O error, dev loop3, sector 160 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 57.381140][ T8] loop: Write error at byte offset 9223372036854775807, length 512. [ 57.393700][ C0] Buffer I/O error on dev loop3, logical block 0, lost sync page write [ 57.403547][ T288] tipc: Resetting bearer [ 57.411769][ T288] tipc: Disabling bearer [ 57.430914][ T1906] EXT4-fs: Ignoring removed orlov option [ 57.484427][ T292] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 57.493340][ T43] tipc: Left network mode [ 57.663890][ T1916] ip_tables: iptables: counters copy to user failed while replacing table [ 57.684856][ T292] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.703747][ T292] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 57.733693][ T292] usb 2-1: config 1 interface 0 has no altsetting 0 [ 57.759927][ T292] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 57.787321][ T292] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.813710][ T292] usb 2-1: Product: syz [ 57.818009][ T292] usb 2-1: Manufacturer: syz [ 57.822642][ T292] usb 2-1: SerialNumber: syz [ 57.848838][ T292] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 57.863794][ T292] cdc_ncm 2-1:1.1: bind() failure [ 57.993842][ T1927] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.000974][ T1927] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.016319][ T1927] device bridge_slave_0 entered promiscuous mode [ 58.024794][ T1927] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.031869][ T1927] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.041231][ T1927] device bridge_slave_1 entered promiscuous mode [ 58.054533][ T348] usb 2-1: USB disconnect, device number 4 [ 58.122793][ T43] device bridge_slave_1 left promiscuous mode [ 58.133821][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.146265][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 58.164301][ T43] device veth1_macvtap left promiscuous mode [ 58.170400][ T43] device veth0_vlan left promiscuous mode [ 58.436525][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 58.452394][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.470028][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.489149][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.503957][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.511072][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.519750][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.529544][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.538045][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.545128][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.569913][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 58.594136][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.606392][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.625325][ T1945] netlink: 8 bytes leftover after parsing attributes in process `syz.0.602'. [ 58.664599][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 58.681321][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 58.698114][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 58.707128][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 58.715232][ T1949] netlink: 8 bytes leftover after parsing attributes in process `syz.1.605'. [ 58.726279][ T1949] netlink: 8 bytes leftover after parsing attributes in process `syz.1.605'. [ 58.736478][ T1927] device veth0_vlan entered promiscuous mode [ 58.750318][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 58.760399][ T1927] device veth1_macvtap entered promiscuous mode [ 58.777387][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 58.792692][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.851667][ T1955] FAULT_INJECTION: forcing a failure. [ 58.851667][ T1955] name failslab, interval 1, probability 0, space 0, times 0 [ 58.865564][ T1955] CPU: 0 PID: 1955 Comm: syz.3.607 Tainted: G W syzkaller #0 [ 58.874397][ T1955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 58.884491][ T1955] Call Trace: [ 58.887797][ T1955] [ 58.890750][ T1955] __dump_stack+0x21/0x24 [ 58.895117][ T1955] dump_stack_lvl+0x110/0x170 [ 58.899833][ T1955] ? __cfi_dump_stack_lvl+0x8/0x8 [ 58.905063][ T1955] ? kfree_skbmem+0x10c/0x180 [ 58.909789][ T1955] dump_stack+0x15/0x24 [ 58.914160][ T1955] should_fail_ex+0x3bf/0x510 [ 58.918876][ T1955] ? skb_clone+0x1e8/0x380 [ 58.923336][ T1955] __should_failslab+0xac/0xf0 [ 58.928140][ T1955] should_failslab+0x9/0x20 [ 58.932690][ T1955] kmem_cache_alloc+0x3b/0x320 [ 58.937495][ T1955] skb_clone+0x1e8/0x380 [ 58.941784][ T1955] bpf_clone_redirect+0x16a/0x4a0 [ 58.946882][ T1955] bpf_prog_208b094576c80b22+0x56/0x5b [ 58.952374][ T1955] ? kasan_set_track+0x60/0x70 [ 58.957176][ T1955] ? kasan_set_track+0x4b/0x70 [ 58.961966][ T1955] ? kasan_save_alloc_info+0x1f/0x30 [ 58.967272][ T1955] ? __kasan_slab_alloc+0x72/0x80 [ 58.972329][ T1955] ? slab_post_alloc_hook+0x4f/0x2d0 [ 58.973766][ T60] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 58.977655][ T1955] ? kmem_cache_alloc+0x166/0x320 [ 58.977691][ T1955] ? build_skb+0x2a/0x220 [ 58.994519][ T1955] ? bpf_prog_test_run_skb+0x38e/0x18a0 [ 59.000113][ T1955] ? bpf_prog_test_run+0x3b4/0x5c0 [ 59.005278][ T1955] ? __sys_bpf+0x5ee/0x850 [ 59.009746][ T1955] ? __x64_sys_bpf+0x7c/0x90 [ 59.014361][ T1955] ? x64_sys_call+0x488/0x9a0 [ 59.019072][ T1955] ? do_syscall_64+0x4c/0xa0 [ 59.023687][ T1955] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 59.029805][ T1955] ? __kasan_check_read+0x11/0x20 [ 59.034861][ T1955] ? bpf_test_timer_continue+0x147/0x4a0 [ 59.040528][ T1955] bpf_test_run+0x35f/0x940 [ 59.045084][ T1955] ? dst_hold+0xc0/0xc0 [ 59.049284][ T1955] ? __cfi_eth_type_trans+0x10/0x10 [ 59.054520][ T1955] ? __kasan_check_write+0x14/0x20 [ 59.059667][ T1955] bpf_prog_test_run_skb+0xd64/0x18a0 [ 59.065091][ T1955] ? __cfi_bpf_prog_test_run_skb+0x10/0x10 [ 59.070940][ T1955] bpf_prog_test_run+0x3b4/0x5c0 [ 59.075957][ T1955] ? bpf_prog_query+0x270/0x270 [ 59.080845][ T1955] ? selinux_bpf+0xce/0xf0 [ 59.085382][ T1955] ? security_bpf+0x93/0xb0 [ 59.089953][ T1955] __sys_bpf+0x5ee/0x850 [ 59.094219][ T1955] ? bpf_link_show_fdinfo+0x330/0x330 [ 59.099644][ T1955] ? fpregs_restore_userregs+0x128/0x260 [ 59.105307][ T1955] __x64_sys_bpf+0x7c/0x90 [ 59.109755][ T1955] x64_sys_call+0x488/0x9a0 [ 59.114345][ T1955] do_syscall_64+0x4c/0xa0 [ 59.118798][ T1955] ? clear_bhb_loop+0x30/0x80 [ 59.123508][ T1955] ? clear_bhb_loop+0x30/0x80 [ 59.128231][ T1955] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 59.134167][ T1955] RIP: 0033:0x7f418679f559 [ 59.138616][ T1955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.158264][ T1955] RSP: 002b:00007f41876d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 59.166746][ T1955] RAX: ffffffffffffffda RBX: 00007f4186a25fa0 RCX: 00007f418679f559 [ 59.174772][ T1955] RDX: 0000000000000050 RSI: 00002000000042c0 RDI: 000000000000000a [ 59.175282][ T60] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 59.182768][ T1955] RBP: 00007f4186836b20 R08: 0000000000000000 R09: 0000000000000000 [ 59.182786][ T1955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.208869][ T1955] R13: 00007f4186a26038 R14: 00007f4186a25fa0 R15: 00007ffe469419f8 [ 59.213495][ T60] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 59.216896][ T1955] [ 59.242462][ T1957] set_capacity_and_notify: 3 callbacks suppressed [ 59.242484][ T1957] loop1: detected capacity change from 0 to 256 [ 59.266786][ T60] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 59.286137][ T60] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.314152][ T60] usb 1-1: Product: syz [ 59.318422][ T60] usb 1-1: Manufacturer: syz [ 59.323071][ T60] usb 1-1: SerialNumber: syz [ 59.421394][ T1963] loop5: detected capacity change from 0 to 1024 [ 59.449851][ T1963] EXT4-fs error (device loop5): ext4_orphan_get:1431: comm syz.5.611: bad orphan inode 134217728 [ 59.488463][ T1746] EXT4-fs error (device loop5): ext4_iget_extra_inode:4765: inode #15: comm syz-executor: corrupted in-inode xattr [ 59.500948][ T1746] EXT4-fs error (device loop5): ext4_iget_extra_inode:4765: inode #15: comm syz-executor: corrupted in-inode xattr [ 59.686501][ T1972] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.703749][ T1972] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.721456][ T1972] device bridge_slave_0 entered promiscuous mode [ 59.734732][ T1972] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.735209][ T1971] loop3: detected capacity change from 0 to 40427 [ 59.749041][ T1972] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.759487][ T292] usb 1-1: USB disconnect, device number 4 [ 59.766376][ T1971] F2FS-fs (loop3): invalid crc value [ 59.769767][ T1972] device bridge_slave_1 entered promiscuous mode [ 59.783019][ T1971] F2FS-fs (loop3): Found nat_bits in checkpoint [ 59.854585][ T1972] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.861720][ T1972] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.869080][ T1972] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.876152][ T1972] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.892763][ T1971] F2FS-fs (loop3): Start checkpoint disabled! [ 59.900029][ T1971] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0 [ 59.913886][ T1971] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 59.965022][ T1978] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.972196][ T1978] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.979784][ T1978] device bridge_slave_0 entered promiscuous mode [ 59.992714][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.000509][ T420] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.007875][ T420] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.024331][ T1978] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.031508][ T1978] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.039316][ T1978] device bridge_slave_1 entered promiscuous mode [ 60.049287][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.059070][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.066189][ T420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.074558][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.082805][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.089893][ T420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.100904][ T1983] syz.3.617: attempt to access beyond end of device [ 60.100904][ T1983] loop3: rw=2049, sector=77824, nr_sectors = 4096 limit=40427 [ 60.116504][ T10] device bridge_slave_1 left promiscuous mode [ 60.123153][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.133054][ T10] device bridge_slave_0 left promiscuous mode [ 60.133400][ T1983] syz.3.617: attempt to access beyond end of device [ 60.133400][ T1983] loop3: rw=2049, sector=49152, nr_sectors = 3208 limit=40427 [ 60.147382][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.171652][ T10] device veth1_macvtap left promiscuous mode [ 60.180727][ T10] device veth0_vlan left promiscuous mode [ 60.203995][ T1129] Bluetooth: hci0: command 0x1003 tx timeout [ 60.210055][ T1025] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 60.327490][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.342620][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.388229][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.388229][ T43] loop3: rw=1, sector=52360, nr_sectors = 888 limit=40427 [ 60.391102][ T1998] loop0: detected capacity change from 0 to 512 [ 60.417194][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.426872][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.443282][ T2000] tipc: Enabling of bearer rejected, already enabled [ 60.453177][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.453177][ T43] loop3: rw=1, sector=73728, nr_sectors = 4096 limit=40427 [ 60.493857][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.493857][ T43] loop3: rw=1, sector=81920, nr_sectors = 4096 limit=40427 [ 60.500615][ T1998] ext4 filesystem being mounted at /113/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 60.512191][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.512191][ T43] loop3: rw=1, sector=86016, nr_sectors = 8 limit=40427 [ 60.518448][ T2000] tipc: Disabling bearer [ 60.537080][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.537080][ T43] loop3: rw=1, sector=86024, nr_sectors = 8 limit=40427 [ 60.551635][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.551635][ T43] loop3: rw=1, sector=86032, nr_sectors = 8 limit=40427 [ 60.558779][ T1998] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 60.573603][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.573603][ T43] loop3: rw=1, sector=86040, nr_sectors = 8 limit=40427 [ 60.593871][ T43] kworker/u4:2: attempt to access beyond end of device [ 60.593871][ T43] loop3: rw=1, sector=86048, nr_sectors = 8 limit=40427 [ 60.608290][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 60.621109][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.629458][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.637089][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.645356][ T1998] EXT4-fs (loop0): Remounting filesystem read-only [ 60.648727][ T1972] device veth0_vlan entered promiscuous mode [ 60.711718][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 60.720906][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.737435][ T1972] device veth1_macvtap entered promiscuous mode [ 60.757056][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.764993][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 60.774154][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 60.791668][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.799297][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.807234][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 60.816085][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 60.825472][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.834126][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.842384][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.849463][ T420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.857352][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 60.865854][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.874305][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.881361][ T420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.898420][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 60.906518][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.925633][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.945735][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.968625][ T1978] device veth0_vlan entered promiscuous mode [ 60.986423][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.000512][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 61.024199][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 61.045299][ T2010] device veth2 entered promiscuous mode [ 61.067778][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.077707][ T1978] device veth1_macvtap entered promiscuous mode [ 61.090090][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.099226][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.109335][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.152772][ T2019] loop3: detected capacity change from 0 to 512 [ 61.172831][ T2025] loop6: detected capacity change from 0 to 1024 [ 61.183955][ T2019] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 61.225861][ T2019] EXT4-fs (loop3): 1 truncate cleaned up [ 61.240275][ T2025] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a016c118, mo2=0002] [ 61.254044][ T2025] System zones: 0-1, 3-12 [ 61.301574][ T2041] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 61.335875][ T327] hid-generic 0005:046D:C082.0005: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 61.386916][ T2044] fido_id[2044]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 61.427040][ T2051] device veth2 entered promiscuous mode [ 61.503756][ T327] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 61.684873][ T327] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 61.697598][ T327] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 61.706920][ T327] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.715055][ T327] usb 5-1: Product: syz [ 61.719395][ T327] usb 5-1: Manufacturer: syz [ 61.724220][ T327] usb 5-1: SerialNumber: syz [ 62.080104][ T2066] using random self ethernet address [ 62.085565][ T2066] using random host ethernet address [ 62.123357][ T2075] device ip6_vti0 entered promiscuous mode [ 62.326764][ T2093] loop6: detected capacity change from 0 to 256 [ 62.342929][ T28] kauditd_printk_skb: 15 callbacks suppressed [ 62.342945][ T28] audit: type=1400 audit(1793234235.503:371): avc: denied { remount } for pid=2092 comm="syz.6.660" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 62.740134][ T327] cdc_ncm 5-1:1.0: SET_NTB_FORMAT failed [ 62.764982][ T327] cdc_ncm 5-1:1.0: bind() failure [ 62.771186][ T327] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 62.778085][ T327] cdc_ncm 5-1:1.1: bind() failure [ 62.784325][ T327] usb 5-1: USB disconnect, device number 5 [ 63.071703][ T2099] loop3: detected capacity change from 0 to 16 [ 63.088698][ T2103] loop7: detected capacity change from 0 to 1024 [ 63.104810][ T2099] erofs: (device loop3): mounted with root inode @ nid 36. [ 63.125710][ T28] audit: type=1400 audit(1793234236.293:372): avc: denied { create } for pid=2095 comm="syz.3.663" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 63.172096][ T2103] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a016c118, mo2=0002] [ 63.180655][ T28] audit: type=1400 audit(1793234236.333:373): avc: denied { unlink } for pid=1927 comm="syz-executor" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 63.189652][ T2105] loop6: detected capacity change from 0 to 512 [ 63.230802][ T2103] System zones: 0-1, 3-12 [ 63.242057][ T2105] EXT4-fs: Ignoring removed nobh option [ 63.274809][ T2105] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #11: comm syz.6.664: invalid indirect mapped block 256 (level 2) [ 63.316714][ T2105] EXT4-fs (loop6): 2 truncates cleaned up [ 63.323586][ T2121] using random self ethernet address [ 63.349940][ T2121] using random host ethernet address [ 63.356515][ T2105] x_tables: duplicate underflow at hook 3 [ 63.369753][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 63.404208][ T2123] ext4 filesystem being mounted at /19/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 63.432696][ T28] audit: type=1400 audit(1793234236.593:374): avc: denied { ioctl } for pid=2122 comm="syz.3.672" path="/19/mnt/bus" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 63.464291][ T28] audit: type=1400 audit(1793234236.633:375): avc: denied { setattr } for pid=2122 comm="syz.3.672" name="bus" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 63.536873][ T2140] EXT4-fs: Ignoring removed mblk_io_submit option [ 63.565319][ T2140] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 63.596145][ T2140] EXT4-fs error (device loop3): ext4_iget_extra_inode:4765: inode #15: comm syz.3.678: corrupted in-inode xattr [ 63.612437][ T2140] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.678: couldn't read orphan inode 15 (err -117) [ 63.651215][ T2155] netlink: 27 bytes leftover after parsing attributes in process `syz.6.686'. [ 63.749504][ T28] audit: type=1400 audit(1793234236.913:376): avc: denied { read write } for pid=2164 comm="syz.4.690" name="mtrr" dev="proc" ino=4026532003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 63.817138][ T28] audit: type=1400 audit(1793234236.943:377): avc: denied { open } for pid=2164 comm="syz.4.690" path="/135/proc/mtrr" dev="proc" ino=4026532003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 63.839348][ T2169] EXT4-fs: Ignoring removed oldalloc option [ 63.888764][ T2169] ext4 filesystem being mounted at /129/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 63.945600][ T2169] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.691: bg 0: block 112: padding at end of block bitmap is not set [ 63.984547][ T43] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: comm kworker/u4:2: lblock 0 mapped to illegal pblock 0 (length 1) [ 64.014612][ T43] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 64.032456][ T2182] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 64.040427][ T43] EXT4-fs (loop0): This should not happen!! Data will be lost [ 64.040427][ T43] [ 64.062622][ T2182] System zones: 1-12 [ 64.087449][ T2182] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.696: missing EA_INODE flag [ 64.099624][ T2182] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.696: error while reading EA inode 12 err=-117 [ 64.123788][ T327] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 64.133027][ T2182] EXT4-fs (loop3): 1 orphan inode deleted [ 64.151322][ T28] audit: type=1400 audit(1793234237.313:378): avc: denied { map } for pid=2181 comm="syz.3.696" path="/24/file0/file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 64.231141][ T2202] netlink: 'syz.6.702': attribute type 1 has an invalid length. [ 64.313758][ T327] usb 5-1: Using ep0 maxpacket: 16 [ 64.320187][ T327] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 64.350508][ T327] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 64.381646][ T327] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 64.412404][ T327] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 64.437319][ T2223] set_capacity_and_notify: 4 callbacks suppressed [ 64.437339][ T2223] loop0: detected capacity change from 0 to 1024 [ 64.450523][ T327] usb 5-1: config 0 interface 0 has no altsetting 0 [ 64.457736][ T327] usb 5-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 64.476027][ T327] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 64.494669][ T327] usb 5-1: config 0 descriptor?? [ 64.505205][ T2223] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a016c118, mo2=0002] [ 64.529028][ T2223] System zones: 0-1, 3-12 [ 64.541251][ T2223] EXT4-fs mount: 43 callbacks suppressed [ 64.541269][ T2223] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 64.911586][ T327] logitech-djreceiver 0003:046D:C53A.0006: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.4-1/input0 [ 65.373547][ T2266] syz.7.726 (2266): drop_caches: 2 [ 65.389741][ T2267] syz.7.726 (2267): drop_caches: 2 [ 65.402493][ T289] EXT4-fs (loop0): unmounting filesystem. [ 65.442809][ T2270] loop0: detected capacity change from 0 to 2048 [ 65.451050][ T2272] netlink: 'syz.3.728': attribute type 1 has an invalid length. [ 65.476350][ T2270] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 65.485127][ T2270] ext4 filesystem being mounted at /137/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 65.506646][ T289] EXT4-fs (loop0): unmounting filesystem. [ 65.566091][ T28] audit: type=1400 audit(1793234238.733:379): avc: denied { setopt } for pid=2286 comm="syz.3.742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 65.670137][ T2298] sock: sock_timestamping_bind_phc: sock not bind to device [ 65.679361][ T39] usb 5-1: USB disconnect, device number 6 [ 65.925693][ T2310] loop7: detected capacity change from 0 to 40427 [ 65.933644][ T2310] F2FS-fs (loop7): invalid crc value [ 65.946619][ T2310] F2FS-fs (loop7): Found nat_bits in checkpoint [ 65.982804][ T2310] F2FS-fs (loop7): Start checkpoint disabled! [ 65.989846][ T2310] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 65.997486][ T2310] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 66.029842][ T2319] loop6: detected capacity change from 0 to 512 [ 66.059298][ T2319] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 66.067618][ T2319] System zones: 1-12 [ 66.072358][ T2319] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: inode #12: comm syz.6.746: missing EA_INODE flag [ 66.084352][ T2319] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.746: error while reading EA inode 12 err=-117 [ 66.097786][ T2319] EXT4-fs (loop6): 1 orphan inode deleted [ 66.103555][ T2319] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 66.124981][ T2321] bio_check_eod: 2023 callbacks suppressed [ 66.125002][ T2321] syz.7.741: attempt to access beyond end of device [ 66.125002][ T2321] loop7: rw=2049, sector=77824, nr_sectors = 4096 limit=40427 [ 66.145851][ T1972] EXT4-fs (loop6): unmounting filesystem. [ 66.157270][ T2321] syz.7.741: attempt to access beyond end of device [ 66.157270][ T2321] loop7: rw=2049, sector=49152, nr_sectors = 2144 limit=40427 [ 66.176883][ T2321] syz.7.741: attempt to access beyond end of device [ 66.176883][ T2321] loop7: rw=2049, sector=51296, nr_sectors = 1352 limit=40427 [ 66.271389][ T28] audit: type=1400 audit(1793234239.433:380): avc: denied { bind } for pid=2327 comm="syz.4.749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 66.335825][ T2330] loop4: detected capacity change from 0 to 8192 [ 66.411456][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.411456][ T420] loop7: rw=1, sector=52648, nr_sectors = 600 limit=40427 [ 66.462838][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.462838][ T420] loop7: rw=1, sector=73728, nr_sectors = 4096 limit=40427 [ 66.513054][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.513054][ T420] loop7: rw=1, sector=81920, nr_sectors = 4096 limit=40427 [ 66.528593][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.528593][ T420] loop7: rw=1, sector=86016, nr_sectors = 8 limit=40427 [ 66.543099][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.543099][ T420] loop7: rw=1, sector=86024, nr_sectors = 8 limit=40427 [ 66.559056][ T2350] netlink: 4 bytes leftover after parsing attributes in process `syz.6.759'. [ 66.567636][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.567636][ T420] loop7: rw=1, sector=86032, nr_sectors = 8 limit=40427 [ 66.582553][ T420] kworker/u4:4: attempt to access beyond end of device [ 66.582553][ T420] loop7: rw=1, sector=86040, nr_sectors = 8 limit=40427 [ 66.614196][ T2356] input: syz0 as /devices/virtual/input/input7 [ 66.686608][ T2365] loop6: detected capacity change from 0 to 256 [ 66.741392][ T2367] FAULT_INJECTION: forcing a failure. [ 66.741392][ T2367] name failslab, interval 1, probability 0, space 0, times 0 [ 66.768304][ T2367] CPU: 1 PID: 2367 Comm: syz.3.765 Tainted: G W syzkaller #0 [ 66.777226][ T2367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 66.787317][ T2367] Call Trace: [ 66.790631][ T2367] [ 66.793584][ T2367] __dump_stack+0x21/0x24 [ 66.797953][ T2367] dump_stack_lvl+0x110/0x170 [ 66.802681][ T2367] ? __cfi_dump_stack_lvl+0x8/0x8 [ 66.807739][ T2367] dump_stack+0x15/0x24 [ 66.811923][ T2367] should_fail_ex+0x3bf/0x510 [ 66.816644][ T2367] __should_failslab+0xac/0xf0 [ 66.821457][ T2367] should_failslab+0x9/0x20 [ 66.826004][ T2367] __kmem_cache_alloc_node+0x3d/0x2d0 [ 66.831418][ T2367] ? bitmap_zalloc+0x2c/0x40 [ 66.836119][ T2367] ? bitmap_zalloc+0x2c/0x40 [ 66.840757][ T2367] __kmalloc+0xa4/0x1e0 [ 66.844945][ T2367] bitmap_zalloc+0x2c/0x40 [ 66.849393][ T2367] binder_open+0x15b/0xe90 [ 66.853832][ T2367] ? __cfi_selinux_file_open+0x10/0x10 [ 66.859323][ T2367] ? __cfi_binder_open+0x10/0x10 [ 66.864284][ T2367] ? __kasan_check_read+0x11/0x20 [ 66.869323][ T2367] ? fsnotify_perm+0x269/0x5b0 [ 66.874111][ T2367] do_dentry_open+0x885/0x11f0 [ 66.878899][ T2367] ? __cfi_binder_open+0x10/0x10 [ 66.883849][ T2367] vfs_open+0x73/0x80 [ 66.887850][ T2367] path_openat+0x2699/0x2f30 [ 66.892468][ T2367] ? slab_post_alloc_hook+0x4f/0x2d0 [ 66.897780][ T2367] ? kmem_cache_alloc+0x166/0x320 [ 66.902827][ T2367] ? getname_flags+0xba/0x510 [ 66.907523][ T2367] ? do_sys_openat2+0xeb/0x820 [ 66.912309][ T2367] ? do_filp_open+0x420/0x420 [ 66.917008][ T2367] do_filp_open+0x1ee/0x420 [ 66.921526][ T2367] ? __cfi_do_filp_open+0x10/0x10 [ 66.926569][ T2367] ? alloc_fd+0x4c1/0x570 [ 66.930916][ T2367] do_sys_openat2+0x15e/0x820 [ 66.935617][ T2367] ? __se_sys_futex+0x136/0x310 [ 66.940482][ T2367] ? do_sys_open+0xe0/0xe0 [ 66.944919][ T2367] ? __this_cpu_preempt_check+0x13/0x20 [ 66.950493][ T2367] ? xfd_validate_state+0x70/0x150 [ 66.955634][ T2367] __x64_sys_openat+0x136/0x160 [ 66.960511][ T2367] x64_sys_call+0x783/0x9a0 [ 66.965027][ T2367] do_syscall_64+0x4c/0xa0 [ 66.969458][ T2367] ? clear_bhb_loop+0x30/0x80 [ 66.974151][ T2367] ? clear_bhb_loop+0x30/0x80 [ 66.978847][ T2367] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 66.984760][ T2367] RIP: 0033:0x7f418679f559 [ 66.989212][ T2367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 67.008855][ T2367] RSP: 002b:00007f41876d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 67.017289][ T2367] RAX: ffffffffffffffda RBX: 00007f4186a25fa0 RCX: 00007f418679f559 [ 67.025281][ T2367] RDX: 0000000000000000 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 67.033265][ T2367] RBP: 00007f4186836b20 R08: 0000000000000000 R09: 0000000000000000 [ 67.041253][ T2367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 67.049246][ T2367] R13: 00007f4186a26038 R14: 00007f4186a25fa0 R15: 00007ffe469419f8 [ 67.057252][ T2367] [ 67.120714][ T2361] loop0: detected capacity change from 0 to 40427 [ 67.139405][ T2361] F2FS-fs (loop0): invalid crc value [ 67.154571][ T2361] F2FS-fs (loop0): Found nat_bits in checkpoint [ 67.204488][ T2374] binder: 2373:2374 ioctl c0306201 2000000004c0 returned -14 [ 67.214359][ T2361] F2FS-fs (loop0): Start checkpoint disabled! [ 67.223283][ T2361] F2FS-fs (loop0): f2fs_disable_checkpoint() finish, err:0 [ 67.244954][ T2361] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 67.258043][ T2377] loop3: detected capacity change from 0 to 512 [ 67.294413][ T2377] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: comm syz.3.768: inode #1: comm syz.3.768: iget: illegal inode # [ 67.314253][ T2377] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.768: error while reading EA inode 1 err=-117 [ 67.345091][ T2377] EXT4-fs (loop3): 1 orphan inode deleted [ 67.351051][ T2377] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 67.374647][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 67.374662][ T28] audit: type=1400 audit(1793234240.543:384): avc: denied { setattr } for pid=2376 comm="syz.3.768" name="file0" dev="loop3" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 67.406234][ T1927] EXT4-fs (loop3): unmounting filesystem. [ 67.465355][ T28] audit: type=1400 audit(1793234240.613:385): avc: denied { read write } for pid=2389 comm="syz.3.770" name="dm0" dev="tmpfs" ino=243 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 67.556224][ T28] audit: type=1400 audit(1793234240.613:386): avc: denied { open } for pid=2389 comm="syz.3.770" path="/39/dm0" dev="tmpfs" ino=243 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 67.606132][ T28] audit: type=1400 audit(1793234240.623:387): avc: denied { unmount } for pid=1972 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 67.649095][ T2404] loop3: detected capacity change from 0 to 1024 [ 67.714933][ T2404] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 67.748565][ T2404] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 67.799084][ T2404] EXT4-fs error (device loop3): ext4_map_blocks:747: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 3) [ 67.835521][ T2408] loop6: detected capacity change from 0 to 1024 [ 67.846539][ T2404] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 67.884087][ T2404] EXT4-fs (loop3): This should not happen!! Data will be lost [ 67.884087][ T2404] [ 67.900269][ T2408] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 67.913801][ T2408] ext4 filesystem being mounted at /41/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 67.925933][ T2411] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 67.944036][ T2411] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 67.960037][ T28] audit: type=1400 audit(1793234241.123:388): avc: denied { execute } for pid=2407 comm="syz.6.777" path="/41/file1/file1" dev="loop6" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 67.985040][ T2408] EXT4-fs error (device loop6): ext4_map_blocks:747: inode #15: block 3: comm syz.6.777: lblock 3 mapped to illegal pblock 3 (length 3) [ 68.011923][ T2403] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.033984][ T2408] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 68.052532][ T2411] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.073559][ T2408] EXT4-fs (loop6): This should not happen!! Data will be lost [ 68.073559][ T2408] [ 68.093926][ T2403] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.113887][ T2412] EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.777: bg 0: block 112: padding at end of block bitmap is not set [ 68.138576][ T2403] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.153081][ T2412] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 44 with max blocks 4 with error 28 [ 68.182059][ T2412] EXT4-fs (loop6): This should not happen!! Data will be lost [ 68.182059][ T2412] [ 68.195385][ T2412] EXT4-fs (loop6): Total free blocks count 0 [ 68.202724][ T2412] EXT4-fs (loop6): Free/Dirty block details [ 68.209011][ T2412] EXT4-fs (loop6): free_blocks=0 [ 68.214321][ T2412] EXT4-fs (loop6): dirty_blocks=64 [ 68.219523][ T2412] EXT4-fs (loop6): Block reservation details [ 68.222263][ T2403] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.257682][ T2412] syz.6.777 (2412) used greatest stack depth: 20768 bytes left [ 68.274004][ T326] EXT4-fs error (device loop6): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:3: lblock 8 mapped to illegal pblock 8 (length 8) [ 68.294025][ T2411] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.317798][ T2403] EXT4-fs error (device loop3): ext4_map_blocks:637: inode #15: block 3: comm syz.3.775: lblock 3 mapped to illegal pblock 3 (length 1) [ 68.375980][ T2417] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 68.404663][ T39] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 68.426413][ T39] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 68.450382][ T2417] exFAT-fs (loop6): Medium has reported failures. Some data may be lost. [ 68.472552][ T1927] EXT4-fs (loop3): unmounting filesystem. [ 68.479402][ T2417] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000ff98, chksum : 0x84a6b859, utbl_chksum : 0xe619d30d) [ 68.602691][ T2428] xt_hashlimit: size too large, truncated to 1048576 [ 68.665993][ T2429] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x8652664a, utbl_chksum : 0xe619d30d) [ 69.076347][ T28] audit: type=1400 audit(1793234242.243:389): avc: denied { mounton } for pid=2447 comm="syz.0.792" path="/150/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 69.319805][ T2453] F2FS-fs (loop4): Corrupted extension count (64 + 1 > 64) [ 69.328341][ T2453] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 69.348604][ T2453] F2FS-fs (loop4): Image doesn't support compression [ 69.355943][ T2453] F2FS-fs (loop4): Image doesn't support compression [ 69.363414][ T2453] F2FS-fs (loop4): invalid crc value [ 69.369630][ T2453] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 69.423734][ T292] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 69.438594][ T2453] F2FS-fs (loop4): Start checkpoint disabled! [ 69.445366][ T2453] F2FS-fs (loop4): f2fs_disable_checkpoint() finish, err:0 [ 69.453141][ T2453] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 69.460865][ T2453] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 69.476453][ T2473] set_capacity_and_notify: 4 callbacks suppressed [ 69.476470][ T2473] loop7: detected capacity change from 0 to 128 [ 69.507184][ T2453] F2FS-fs (loop4): f2fs_enable_checkpoint() starts, meta: 0, node: 0, data: 0 [ 69.541030][ T2481] loop6: detected capacity change from 0 to 1024 [ 69.547624][ T2453] F2FS-fs (loop4): sync_inode_sb done, dirty_data: 0, 0, skipped write: 0, 0, retry: 3 [ 69.570030][ T2453] F2FS-fs (loop4): f2fs_enable_checkpoint() finishes, writeback:53, sync:0 [ 69.580111][ T2481] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e000c01c, mo2=0002] [ 69.588769][ T2481] System zones: 0-1, 3-36 [ 69.595012][ T2481] EXT4-fs error (device loop6): ext4_orphan_get:1431: comm syz.6.805: bad orphan inode 134217728 [ 69.613784][ T292] usb 1-1: Using ep0 maxpacket: 16 [ 69.620075][ T292] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 69.624824][ T2481] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 69.637397][ T292] usb 1-1: config 0 has no interface number 0 [ 69.651988][ T292] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 69.662213][ T292] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 69.682935][ T292] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 69.692454][ T292] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.716746][ T292] usb 1-1: Product: syz [ 69.720965][ T292] usb 1-1: Manufacturer: syz [ 69.726880][ T2481] EXT4-fs (loop6): re-mounted. Quota mode: writeback. [ 69.735837][ T292] usb 1-1: SerialNumber: syz [ 69.746175][ T292] usb 1-1: config 0 descriptor?? [ 69.751464][ T2455] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 69.758031][ T28] audit: type=1400 audit(1793234242.913:390): avc: denied { mounton } for pid=2493 comm="syz.7.811" path="/32/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 69.769859][ T2455] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 69.824652][ T2501] netlink: 36 bytes leftover after parsing attributes in process `syz.4.807'. [ 69.849385][ T28] audit: type=1400 audit(1793234243.013:391): avc: denied { execute } for pid=2502 comm="syz.4.816" name="file0" dev="tmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 69.874085][ T2505] loop7: detected capacity change from 0 to 256 [ 69.890070][ T28] audit: type=1400 audit(1793234243.013:392): avc: denied { execute_no_trans } for pid=2502 comm="syz.4.816" path="/149/file0" dev="tmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 69.907455][ T2505] exFAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 69.932195][ T2505] exFAT-fs (loop7): Medium has reported failures. Some data may be lost. [ 69.943067][ T2505] exFAT-fs (loop7): failed to load upcase table (idx : 0x0000ff98, chksum : 0x84a6b859, utbl_chksum : 0xe619d30d) [ 69.968017][ T2509] xt_hashlimit: size too large, truncated to 1048576 [ 69.997839][ T2511] loop4: detected capacity change from 0 to 512 [ 70.010849][ T2455] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.040377][ T2455] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 70.083742][ T415] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 70.274806][ T415] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 70.287358][ T415] usb 7-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 70.303812][ T415] usb 7-1: config 1 interface 0 has no altsetting 0 [ 70.312065][ T415] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 70.336889][ T415] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.346540][ T2523] loop4: detected capacity change from 0 to 128 [ 70.358414][ T415] usb 7-1: Product: syz [ 70.362632][ T415] usb 7-1: Manufacturer: syz [ 70.368061][ T415] usb 7-1: SerialNumber: syz [ 70.376621][ T415] cdc_ncm 7-1:1.1: CDC Union missing and no IAD found [ 70.383462][ T415] cdc_ncm 7-1:1.1: bind() failure [ 70.389035][ T325] blk_print_req_error: 11 callbacks suppressed [ 70.389052][ T325] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 70.408415][ T2523] loop4: detected capacity change from 0 to 128 [ 70.413985][ T325] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 70.415276][ T347] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 70.436292][ T325] Buffer I/O error on dev loop4, logical block 0, async page read [ 70.455365][ T2523] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 70.483372][ T2523] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 70.532233][ T43] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 70.567765][ T2525] xt_hashlimit: size too large, truncated to 1048576 [ 70.594338][ T327] usb 7-1: USB disconnect, device number 2 [ 70.634802][ T347] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 70.655147][ T347] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 70.686215][ T347] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 70.703685][ T347] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 70.721991][ T347] usb 4-1: SerialNumber: syz [ 70.781410][ T292] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 70.810440][ T292] asix: probe of 1-1:0.34 failed with error -71 [ 70.820987][ T292] usb 1-1: USB disconnect, device number 5 [ 70.932503][ T347] usb 4-1: 0:2 : does not exist [ 70.954010][ T347] usb 4-1: USB disconnect, device number 4 [ 71.042805][ T2532] loop0: detected capacity change from 0 to 16 [ 71.061360][ T2532] erofs: (device loop0): mounted with root inode @ nid 36. [ 71.072712][ T2532] erofs: (device loop0): erofs_fill_dentries: bogus dirent @ nid 36 [ 71.118336][ T1972] EXT4-fs (loop6): unmounting filesystem. [ 71.267370][ T2541] netlink: 8 bytes leftover after parsing attributes in process `syz.6.839'. [ 71.302080][ T2546] loop4: detected capacity change from 0 to 1024 [ 71.362140][ T2546] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 71.391078][ T2546] ext4 filesystem being mounted at /154/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 71.410085][ T2546] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 3: comm syz.4.829: lblock 3 mapped to illegal pblock 3 (length 3) [ 71.424378][ T2546] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 71.437016][ T2546] EXT4-fs (loop4): This should not happen!! Data will be lost [ 71.437016][ T2546] [ 71.491184][ T2552] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: block 3: comm syz.4.829: lblock 3 mapped to illegal pblock 3 (length 1) [ 71.546048][ T326] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: block 8: comm kworker/u4:3: lblock 8 mapped to illegal pblock 8 (length 8) [ 71.581595][ T326] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 71.600231][ T28] audit: type=1400 audit(1793234244.763:393): avc: denied { mount } for pid=2560 comm="syz.0.836" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 71.633832][ T292] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 71.647039][ T326] EXT4-fs (loop4): This should not happen!! Data will be lost [ 71.647039][ T326] [ 71.679009][ T291] EXT4-fs (loop4): unmounting filesystem. [ 71.778805][ T2571] loop4: detected capacity change from 0 to 128 [ 71.824824][ T292] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 71.844792][ T292] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 71.858663][ T292] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 71.868832][ T292] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 71.892236][ T292] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 71.911553][ T292] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 71.919942][ T292] usb 7-1: Manufacturer: syz [ 71.930029][ T292] usb 7-1: config 0 descriptor?? [ 72.023726][ T348] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 72.143726][ T347] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 72.204859][ T348] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 72.218698][ T348] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 72.228246][ T348] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.236739][ T348] usb 1-1: Product: syz [ 72.241219][ T348] usb 1-1: Manufacturer: syz [ 72.246258][ T348] usb 1-1: SerialNumber: syz [ 72.324853][ T347] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 72.338314][ T292] appleir 0003:05AC:8243.0008: unknown main item tag 0x0 [ 72.353956][ T292] appleir 0003:05AC:8243.0008: No inputs registered, leaving [ 72.361500][ T347] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 72.380161][ T292] appleir 0003:05AC:8243.0008: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 72.395888][ T347] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 72.414968][ T347] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.433154][ T347] usb 5-1: Product: syz [ 72.437613][ T347] usb 5-1: Manufacturer: syz [ 72.442261][ T347] usb 5-1: SerialNumber: syz [ 72.467368][ T347] cdc_mbim 5-1:1.0: skipping garbage [ 72.617192][ T415] usb 7-1: USB disconnect, device number 3 [ 72.645533][ T2590] af_packet: tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 72.666727][ T2573] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 72.742519][ T2600] loop3: detected capacity change from 0 to 128 [ 73.097406][ T2602] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 73.114342][ T1927] EXT4-fs (loop3): unmounting filesystem. [ 73.264049][ T348] cdc_ncm 1-1:1.0: SET_NTB_FORMAT failed [ 73.278471][ T2573] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 73.286562][ T348] cdc_ncm 1-1:1.0: bind() failure [ 73.294607][ T348] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 73.302410][ T348] cdc_ncm 1-1:1.1: bind() failure [ 73.307701][ T347] cdc_mbim 5-1:1.0: setting rx_max = 16384 [ 73.316866][ T348] usb 1-1: USB disconnect, device number 6 [ 73.509169][ T347] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device [ 73.523958][ T347] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, ae:0f:da:c3:8b:bd [ 73.710810][ T39] usb 5-1: USB disconnect, device number 7 [ 73.717350][ T39] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM [ 74.203700][ T347] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 74.335248][ T39] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 74.364033][ T39] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 74.403706][ T347] usb 1-1: Using ep0 maxpacket: 16 [ 74.410123][ T347] usb 1-1: config 2 has an invalid interface number: 199 but max is 0 [ 74.431292][ T347] usb 1-1: config 2 has no interface number 0 [ 74.449662][ T347] usb 1-1: config 2 interface 199 altsetting 13 bulk endpoint 0xD has invalid maxpacket 8 [ 74.473226][ T347] usb 1-1: config 2 interface 199 has no altsetting 0 [ 74.492001][ T347] usb 1-1: New USB device found, idVendor=0421, idProduct=03cd, bcdDevice=8a.bd [ 74.514735][ T347] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.535283][ T347] usb 1-1: Product: syz [ 74.553013][ T347] usb 1-1: Manufacturer: syz [ 74.557807][ T347] usb 1-1: SerialNumber: syz [ 74.573809][ T2642] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 74.581439][ T2657] set_capacity_and_notify: 1 callbacks suppressed [ 74.581458][ T2657] loop4: detected capacity change from 0 to 40427 [ 74.618901][ T2657] F2FS-fs (loop4): invalid crc value [ 74.645227][ T2657] F2FS-fs (loop4): Found nat_bits in checkpoint [ 74.728565][ T2657] F2FS-fs (loop4): Start checkpoint disabled! [ 74.739566][ T2657] F2FS-fs (loop4): f2fs_disable_checkpoint() finish, err:0 [ 74.753354][ T2657] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 74.789350][ T347] usb 1-1: bad CDC descriptors [ 74.804713][ T347] usb 1-1: USB disconnect, device number 7 [ 74.902278][ T2667] bio_check_eod: 4057 callbacks suppressed [ 74.902299][ T2667] syz.4.864: attempt to access beyond end of device [ 74.902299][ T2667] loop4: rw=2049, sector=77824, nr_sectors = 2112 limit=40427 [ 75.006862][ T2667] syz.4.864: attempt to access beyond end of device [ 75.006862][ T2667] loop4: rw=2049, sector=79936, nr_sectors = 1984 limit=40427 [ 75.035607][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 75.035625][ T28] audit: type=1400 audit(1793234248.203:395): avc: denied { link } for pid=2670 comm="syz.6.870" name="#27" dev="tmpfs" ino=337 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 75.074966][ T2671] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 75.102509][ T28] audit: type=1400 audit(1793234248.243:396): avc: denied { rename } for pid=2670 comm="syz.6.870" name="#28" dev="tmpfs" ino=337 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 75.141236][ T2666] loop7: detected capacity change from 0 to 40427 [ 75.148804][ T2667] syz.4.864: attempt to access beyond end of device [ 75.148804][ T2667] loop4: rw=2049, sector=49152, nr_sectors = 2048 limit=40427 [ 75.171334][ T2666] F2FS-fs (loop7): Insane cp_payload (553648128 >= 504) [ 75.183881][ T2666] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock [ 75.206396][ T2666] F2FS-fs (loop7): fault_injection options not supported [ 75.213599][ T2666] F2FS-fs (loop7): fault_type options not supported [ 75.228840][ T2666] F2FS-fs (loop7): invalid crc value [ 75.238071][ T2667] syz.4.864: attempt to access beyond end of device [ 75.238071][ T2667] loop4: rw=2049, sector=51200, nr_sectors = 1256 limit=40427 [ 75.253767][ T2666] F2FS-fs (loop7): Found nat_bits in checkpoint [ 75.310660][ T2666] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0 [ 75.317886][ T2666] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 75.482401][ T2683] loop6: detected capacity change from 0 to 8192 [ 75.504554][ T1978] syz-executor: attempt to access beyond end of device [ 75.504554][ T1978] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 75.608853][ T43] kworker/u4:2: attempt to access beyond end of device [ 75.608853][ T43] loop4: rw=1, sector=52456, nr_sectors = 792 limit=40427 [ 75.684567][ T43] kworker/u4:2: attempt to access beyond end of device [ 75.684567][ T43] loop4: rw=1, sector=73728, nr_sectors = 4096 limit=40427 [ 75.728992][ T43] kworker/u4:2: attempt to access beyond end of device [ 75.728992][ T43] loop4: rw=1, sector=81920, nr_sectors = 4096 limit=40427 [ 75.755223][ T43] kworker/u4:2: attempt to access beyond end of device [ 75.755223][ T43] loop4: rw=1, sector=86016, nr_sectors = 8 limit=40427 [ 75.770256][ T2694] device-mapper: table: 252:2: crypt: Device lookup failed (-ENODEV) [ 75.778474][ T2694] device-mapper: ioctl: error adding target to table [ 75.808427][ T43] kworker/u4:2: attempt to access beyond end of device [ 75.808427][ T43] loop4: rw=1, sector=86024, nr_sectors = 8 limit=40427 [ 75.842071][ T2701] netlink: 24 bytes leftover after parsing attributes in process `syz.7.883'. [ 75.855331][ T2689] loop0: detected capacity change from 0 to 256 [ 75.933767][ T347] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 76.021133][ T2705] loop0: detected capacity change from 0 to 1024 [ 76.047936][ T2705] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 76.110677][ T2705] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 76.134824][ T347] usb 7-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 76.146466][ T2703] loop7: detected capacity change from 0 to 40427 [ 76.154273][ T2703] F2FS-fs (loop7): invalid crc value [ 76.166401][ T2703] F2FS-fs (loop7): Found nat_bits in checkpoint [ 76.181139][ T28] audit: type=1400 audit(1793234249.343:397): avc: denied { bind } for pid=2710 comm="syz.3.886" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 76.183874][ T347] usb 7-1: config 0 interface 0 has no altsetting 0 [ 76.256499][ T2703] F2FS-fs (loop7): Start checkpoint disabled! [ 76.279271][ T2715] loop3: detected capacity change from 0 to 128 [ 76.286185][ T347] usb 7-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 76.287080][ T289] EXT4-fs (loop0): unmounting filesystem. [ 76.303095][ T347] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.323885][ T2715] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 76.345310][ T347] usb 7-1: config 0 descriptor?? [ 76.354477][ T2703] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 76.383048][ T2715] ext4 filesystem being mounted at /67/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 76.393402][ T2703] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 76.446831][ T1927] EXT4-fs (loop3): unmounting filesystem. [ 76.492698][ T2730] loop3: detected capacity change from 0 to 256 [ 76.512382][ T2730] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010321, chksum : 0x3a8a43f6, utbl_chksum : 0xe619d30d) [ 76.539033][ T2703] F2FS-fs (loop7): ino:10, start:0, end:2048, need to trigger GC to reclaim enough free segment when checkpoint is enabled [ 76.551976][ T28] audit: type=1400 audit(1793234249.703:398): avc: denied { map } for pid=2729 comm="syz.3.893" path="/68/file1/file1" dev="loop3" ino=1048746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 76.575252][ T28] audit: type=1400 audit(1793234249.723:399): avc: denied { create } for pid=2702 comm="syz.7.884" name=E91F7189591E9233614B scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=sock_file permissive=1 [ 76.699958][ T28] audit: type=1400 audit(1793234249.863:400): avc: denied { remount } for pid=2742 comm="syz.4.898" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 76.741473][ T28] audit: type=1400 audit(1793234249.893:401): avc: denied { lock } for pid=2742 comm="syz.4.898" path="socket:[30394]" dev="sockfs" ino=30394 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 76.754802][ T347] hid (null): unknown global tag 0xfd [ 76.801610][ T2747] syz.4.901 uses obsolete (PF_INET,SOCK_PACKET) [ 76.822814][ T347] hid (null): report_id 0 is invalid [ 76.842441][ T347] waltop 0003:172F:0501.000A: unexpected long global item [ 76.859098][ T28] audit: type=1400 audit(1793234250.023:402): avc: denied { mounton } for pid=2750 comm="syz.3.902" path="/69/file0" dev="tmpfs" ino=415 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 76.876683][ T347] waltop: probe of 0003:172F:0501.000A failed with error -22 [ 76.918437][ T2757] loop4: detected capacity change from 0 to 16 [ 76.928162][ T2757] erofs: (device loop4): mounted with root inode @ nid 36. [ 76.984613][ T347] usb 7-1: USB disconnect, device number 4 [ 77.061238][ T2768] 9pnet: p9_errstr2errno: server reported unknown error ½p [ 77.608579][ T28] audit: type=1326 audit(1793234250.773:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2810 comm="syz.6.927" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3b5999f559 code=0x0 [ 77.787553][ T2818] ptp ptp0: new virtual clock ptp1 [ 77.793829][ T2818] ptp ptp0: new virtual clock ptp2 [ 77.799802][ T2818] ptp ptp0: new virtual clock ptp3 [ 77.805999][ T2818] ptp ptp0: new virtual clock ptp4 [ 77.811179][ T2818] ptp ptp0: guarantee physical clock free running [ 77.819547][ T2818] ptp ptp0: delete virtual clock ptp4 [ 77.826713][ T2818] ptp ptp0: delete virtual clock ptp3 [ 77.832727][ T2818] ptp ptp0: delete virtual clock ptp2 [ 77.834127][ T348] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 77.846437][ T2818] ptp ptp0: guarantee physical clock free running [ 77.887159][ T2829] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 77.919877][ T2831] loop7: detected capacity change from 0 to 512 [ 77.929591][ T2831] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 78.023790][ T348] usb 5-1: Using ep0 maxpacket: 32 [ 78.030389][ T348] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 78.038944][ T348] usb 5-1: config 0 has no interface number 0 [ 78.043987][ T39] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 78.046857][ T348] usb 5-1: config 0 interface 184 has no altsetting 0 [ 78.061350][ T348] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 78.076794][ T348] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.085254][ T348] usb 5-1: Product: syz [ 78.089598][ T348] usb 5-1: Manufacturer: syz [ 78.094413][ T348] usb 5-1: SerialNumber: syz [ 78.099798][ T348] usb 5-1: config 0 descriptor?? [ 78.105731][ T348] smsc75xx v1.0.0 [ 78.233737][ T39] usb 4-1: Using ep0 maxpacket: 32 [ 78.240192][ T39] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.251238][ T39] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 78.264230][ T39] usb 4-1: config 0 interface 0 has no altsetting 0 [ 78.270943][ T39] usb 4-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 78.280087][ T39] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 78.289116][ T39] usb 4-1: config 0 descriptor?? [ 78.396698][ T28] audit: type=1400 audit(1793234251.563:404): avc: denied { create } for pid=2846 comm="syz.0.940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 78.698908][ T39] input: HID 09da:022b as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:09DA:022B.000B/input/input8 [ 78.711063][ T348] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 78.726041][ T348] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 78.776729][ T39] a4tech 0003:09DA:022B.000B: input,hiddev96,hidraw0: USB HID vff.ff Device [HID 09da:022b] on usb-dummy_hcd.3-1/input0 [ 79.145247][ T348] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 79.170696][ T348] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 79.180718][ T348] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 79.190370][ T348] smsc75xx: probe of 5-1:0.184 failed with error -71 [ 79.198539][ T348] usb 5-1: USB disconnect, device number 8 [ 79.460714][ T60] usb 4-1: USB disconnect, device number 5 [ 79.567926][ T2883] xt_hashlimit: size too large, truncated to 1048576 [ 80.117244][ T2888] loop6: detected capacity change from 0 to 131072 [ 80.124807][ T2888] F2FS-fs (loop6): invalid crc value [ 80.132004][ T2888] F2FS-fs (loop6): Found nat_bits in checkpoint [ 80.168606][ T2888] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 80.213740][ T2905] FAULT_INJECTION: forcing a failure. [ 80.213740][ T2905] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 80.229821][ T2909] netlink: 4 bytes leftover after parsing attributes in process `syz.0.971'. [ 80.242084][ T2905] CPU: 1 PID: 2905 Comm: syz.3.963 Tainted: G W syzkaller #0 [ 80.250896][ T2905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 80.260989][ T2905] Call Trace: [ 80.264297][ T2905] [ 80.267253][ T2905] __dump_stack+0x21/0x24 [ 80.271615][ T2905] dump_stack_lvl+0x110/0x170 [ 80.276350][ T2905] ? __cfi_dump_stack_lvl+0x8/0x8 [ 80.281419][ T2905] dump_stack+0x15/0x24 [ 80.285608][ T2905] should_fail_ex+0x3bf/0x510 [ 80.290344][ T2905] should_fail_alloc_page+0x61/0x90 [ 80.295586][ T2905] prepare_alloc_pages+0x131/0x570 [ 80.300748][ T2905] ? __alloc_pages_bulk+0x9d0/0x9d0 [ 80.306074][ T2905] ? x64_sys_call+0x29e/0x9a0 [ 80.310786][ T2905] ? do_syscall_64+0x4c/0xa0 [ 80.315408][ T2905] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.321518][ T2905] __alloc_pages+0x15b/0x610 [ 80.326167][ T2905] ? __cfi___alloc_pages+0x10/0x10 [ 80.331331][ T2905] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 80.336839][ T2905] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 80.342778][ T2905] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 80.348640][ T2905] __get_free_pages+0xe/0x30 [ 80.353288][ T2905] __pollwait+0x12e/0x3e0 [ 80.357662][ T2905] ? __cfi___pollwait+0x10/0x10 [ 80.362580][ T2905] pipe_poll+0x1a2/0x4f0 [ 80.366861][ T2905] ? __fdget+0x19c/0x220 [ 80.371150][ T2905] ? __cfi_pipe_poll+0x10/0x10 [ 80.375948][ T2905] do_sys_poll+0x8e3/0x11b0 [ 80.380501][ T2905] ? poll_select_finish+0x5d0/0x5d0 [ 80.385749][ T2905] ? release_firmware_map_entry+0x190/0x190 [ 80.391690][ T2905] ? __cfi___pollwait+0x10/0x10 [ 80.396594][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.401330][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.406051][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.410779][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.415500][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.420217][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.424969][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.429696][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.434421][ T2905] ? __cfi_pollwake+0x10/0x10 [ 80.439134][ T2905] ? __cfi_futex_wake+0x10/0x10 [ 80.444021][ T2905] ? proc_fail_nth_write+0x180/0x200 [ 80.449351][ T2905] ? set_user_sigmask+0xca/0x1c0 [ 80.454338][ T2905] ? __cfi_set_user_sigmask+0x10/0x10 [ 80.459754][ T2905] ? __sys_bpf+0x63e/0x850 [ 80.464206][ T2905] __se_sys_ppoll+0x206/0x2a0 [ 80.468925][ T2905] ? __x64_sys_ppoll+0xd0/0xd0 [ 80.473736][ T2905] ? xfd_validate_state+0x70/0x150 [ 80.478981][ T2905] ? __kasan_check_write+0x14/0x20 [ 80.484121][ T2905] ? fpregs_restore_userregs+0x128/0x260 [ 80.489772][ T2905] __x64_sys_ppoll+0xbf/0xd0 [ 80.494385][ T2905] x64_sys_call+0x29e/0x9a0 [ 80.498906][ T2905] do_syscall_64+0x4c/0xa0 [ 80.503341][ T2905] ? clear_bhb_loop+0x30/0x80 [ 80.508037][ T2905] ? clear_bhb_loop+0x30/0x80 [ 80.512740][ T2905] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.518659][ T2905] RIP: 0033:0x7f418679f559 [ 80.523096][ T2905] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.542730][ T2905] RSP: 002b:00007f41876d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 80.551163][ T2905] RAX: ffffffffffffffda RBX: 00007f4186a25fa0 RCX: 00007f418679f559 [ 80.559152][ T2905] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 0000200000000640 [ 80.567144][ T2905] RBP: 00007f4186836b20 R08: 0000000000000030 R09: 0000000000000000 [ 80.575131][ T2905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.583117][ T2905] R13: 00007f4186a26038 R14: 00007f4186a25fa0 R15: 00007ffe469419f8 [ 80.591114][ T2905] [ 80.732810][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 80.732829][ T28] audit: type=1400 audit(1793234253.893:410): avc: denied { ioctl } for pid=2918 comm="syz.0.966" path="/184/dm0" dev="tmpfs" ino=1001 ioctlcmd=0x6e80 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 80.850514][ T2940] loop0: detected capacity change from 0 to 128 [ 80.910842][ T2940] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 80.920174][ T2940] ext4 filesystem being mounted at /186/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 80.942461][ T2930] loop6: detected capacity change from 0 to 40427 [ 80.966255][ T2930] F2FS-fs (loop6): invalid crc value [ 80.982157][ T2930] F2FS-fs (loop6): Found nat_bits in checkpoint [ 80.991991][ T289] EXT4-fs (loop0): unmounting filesystem. [ 81.032024][ T2948] loop4: detected capacity change from 0 to 2048 [ 81.048456][ T2930] F2FS-fs (loop6): Start checkpoint disabled! [ 81.050492][ T2948] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 81.063548][ T2930] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 81.076622][ T2930] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 81.091665][ T28] audit: type=1400 audit(1793234254.253:411): avc: denied { execute } for pid=2947 comm="syz.4.978" path="/190/bus/bus" dev="loop4" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 81.133720][ T60] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 81.201149][ T2962] bio_check_eod: 2027 callbacks suppressed [ 81.201171][ T2962] syz.6.961: attempt to access beyond end of device [ 81.201171][ T2962] loop6: rw=2049, sector=77824, nr_sectors = 2088 limit=40427 [ 81.229619][ T291] EXT4-fs (loop4): unmounting filesystem. [ 81.239638][ T2962] syz.6.961: attempt to access beyond end of device [ 81.239638][ T2962] loop6: rw=2049, sector=79912, nr_sectors = 2008 limit=40427 [ 81.281550][ T2962] syz.6.961: attempt to access beyond end of device [ 81.281550][ T2962] loop6: rw=2049, sector=49152, nr_sectors = 3624 limit=40427 [ 81.316106][ T2962] syz.6.961: attempt to access beyond end of device [ 81.316106][ T2962] loop6: rw=2049, sector=52776, nr_sectors = 472 limit=40427 [ 81.333969][ T60] usb 8-1: Using ep0 maxpacket: 16 [ 81.340381][ T60] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 81.359321][ T60] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 81.377384][ T60] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 81.378355][ T2962] syz.6.961: attempt to access beyond end of device [ 81.378355][ T2962] loop6: rw=2049, sector=73728, nr_sectors = 4096 limit=40427 [ 81.403684][ T60] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.411812][ T60] usb 8-1: Product: syz [ 81.423697][ T60] usb 8-1: Manufacturer: syz [ 81.428345][ T60] usb 8-1: SerialNumber: syz [ 81.448988][ T2962] syz.6.961: attempt to access beyond end of device [ 81.448988][ T2962] loop6: rw=2049, sector=81920, nr_sectors = 3056 limit=40427 [ 81.488133][ T2965] loop3: detected capacity change from 0 to 40427 [ 81.500601][ T2965] F2FS-fs (loop3): Wrong segment_count / block_count (31 > 0) [ 81.508453][ T2965] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 81.529711][ T2965] F2FS-fs (loop3): invalid crc value [ 81.536171][ T2965] F2FS-fs (loop3): Found nat_bits in checkpoint [ 81.576851][ T43] kworker/u4:2: attempt to access beyond end of device [ 81.576851][ T43] loop6: rw=1, sector=84976, nr_sectors = 1040 limit=40427 [ 81.586394][ T2965] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 81.592889][ T43] kworker/u4:2: attempt to access beyond end of device [ 81.592889][ T43] loop6: rw=1, sector=86016, nr_sectors = 8 limit=40427 [ 81.598989][ T2965] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 81.611843][ T43] kworker/u4:2: attempt to access beyond end of device [ 81.611843][ T43] loop6: rw=1, sector=86024, nr_sectors = 8 limit=40427 [ 81.633224][ T43] kworker/u4:2: attempt to access beyond end of device [ 81.633224][ T43] loop6: rw=1, sector=86032, nr_sectors = 8 limit=40427 [ 81.652318][ T60] usb 8-1: 0:2 : does not exist [ 81.660663][ T60] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 81.680242][ T60] usb 8-1: USB disconnect, device number 2 [ 81.841058][ T2974] input: syz1 as /devices/virtual/input/input9 [ 81.930502][ T28] audit: type=1400 audit(1793234255.093:412): avc: denied { create } for pid=2983 comm="syz.0.990" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 81.955924][ T28] audit: type=1400 audit(1793234255.113:413): avc: denied { write } for pid=2983 comm="syz.0.990" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 81.976520][ T28] audit: type=1400 audit(1793234255.113:414): avc: denied { nlmsg_write } for pid=2983 comm="syz.0.990" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 81.991722][ T2989] loop3: detected capacity change from 0 to 512 [ 82.014381][ T2994] loop6: detected capacity change from 0 to 2048 [ 82.036190][ T2994] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 82.144236][ T420] Bluetooth: hci0: Frame reassembly failed (-84) [ 82.151903][ T28] audit: type=1400 audit(1793234255.313:415): avc: denied { write } for pid=3024 comm="syz.3.1000" path="socket:[32330]" dev="sockfs" ino=32330 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 82.160158][ T1972] EXT4-fs (loop6): unmounting filesystem. [ 82.542716][ T3053] kvm [3052]: vcpu2, guest rIP: 0x9130 Unhandled WRMSR(0x11e) = 0xfffffc18 [ 82.556765][ T3053] kvm [3052]: vcpu2, guest rIP: 0x9130 Unhandled WRMSR(0x186) = 0xfffffc18 [ 82.565801][ T3053] kvm [3052]: vcpu2, guest rIP: 0x9130 Unhandled WRMSR(0x187) = 0xfffffc18 [ 82.676384][ T3032] loop7: detected capacity change from 0 to 131072 [ 82.690183][ T3032] F2FS-fs (loop7): invalid crc value [ 82.697520][ T3032] F2FS-fs (loop7): Found nat_bits in checkpoint [ 82.732369][ T3032] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 82.863720][ T19] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 82.915672][ T3072] device batadv_slave_1 entered promiscuous mode [ 82.923011][ T3071] device batadv_slave_1 left promiscuous mode [ 82.940647][ T28] audit: type=1400 audit(1793234256.103:416): avc: denied { name_bind } for pid=3073 comm="syz.7.1018" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 82.981827][ T28] audit: type=1326 audit(1793234256.143:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3077 comm="syz.4.1020" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd362b9f559 code=0x7ffc0000 [ 83.012095][ T28] audit: type=1326 audit(1793234256.143:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3077 comm="syz.4.1020" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fd362b9f559 code=0x7ffc0000 [ 83.037979][ T28] audit: type=1326 audit(1793234256.143:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3077 comm=BA exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd362b9f559 code=0x7ffc0000 [ 83.074240][ T3086] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1024'. [ 83.075207][ T19] usb 4-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 83.096411][ T19] usb 4-1: config 0 interface 0 has no altsetting 0 [ 83.104223][ T19] usb 4-1: New USB device found, idVendor=056a, idProduct=0016, bcdDevice= 0.00 [ 83.113324][ T19] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.122469][ T19] usb 4-1: config 0 descriptor?? [ 83.149252][ T3094] FAULT_INJECTION: forcing a failure. [ 83.149252][ T3094] name failslab, interval 1, probability 0, space 0, times 0 [ 83.162085][ T3094] CPU: 0 PID: 3094 Comm: syz.4.1027 Tainted: G W syzkaller #0 [ 83.170960][ T3094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 83.181036][ T3094] Call Trace: [ 83.184326][ T3094] [ 83.187266][ T3094] __dump_stack+0x21/0x24 [ 83.191652][ T3094] dump_stack_lvl+0x110/0x170 [ 83.196360][ T3094] ? __cfi_dump_stack_lvl+0x8/0x8 [ 83.201418][ T3094] ? up_write+0x7b/0x290 [ 83.205949][ T3094] dump_stack+0x15/0x24 [ 83.210121][ T3094] should_fail_ex+0x3bf/0x510 [ 83.214821][ T3094] __should_failslab+0xac/0xf0 [ 83.219619][ T3094] should_failslab+0x9/0x20 [ 83.224156][ T3094] __kmem_cache_alloc_node+0x3d/0x2d0 [ 83.229556][ T3094] ? kobject_uevent_env+0x286/0x720 [ 83.234795][ T3094] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 83.240284][ T3094] ? __cfi_dev_uevent_name+0x10/0x10 [ 83.245589][ T3094] ? kobject_uevent_env+0x286/0x720 [ 83.250822][ T3094] kmalloc_trace+0x29/0xb0 [ 83.255259][ T3094] ? __cfi_dev_uevent_name+0x10/0x10 [ 83.260563][ T3094] kobject_uevent_env+0x286/0x720 [ 83.265700][ T3094] ? device_pm_check_callbacks+0xc4b/0xc80 [ 83.271525][ T3094] kobject_uevent+0x1d/0x30 [ 83.276068][ T3094] device_add+0xa1a/0xec0 [ 83.280442][ T3094] netdev_register_kobject+0x18e/0x330 [ 83.285930][ T3094] ? raw_notifier_call_chain+0xfa/0x110 [ 83.291512][ T3094] register_netdevice+0xec9/0x1550 [ 83.296653][ T3094] ? __cfi_register_netdevice+0x10/0x10 [ 83.302226][ T3094] ? memcpy+0x56/0x70 [ 83.306229][ T3094] ip_tunnel_newlink+0x622/0xce0 [ 83.311190][ T3094] ? kasan_save_alloc_info+0x1f/0x30 [ 83.316490][ T3094] ? __kasan_kmalloc+0x95/0xb0 [ 83.321274][ T3094] ? __cfi_ip_tunnel_newlink+0x10/0x10 [ 83.326747][ T3094] ? memset+0x35/0x40 [ 83.330753][ T3094] ? ipgre_netlink_parms+0x7ba/0xb40 [ 83.336098][ T3094] erspan_newlink+0x2a6/0x800 [ 83.340797][ T3094] ? __cfi_erspan_newlink+0x10/0x10 [ 83.346007][ T3094] ? alloc_netdev_mqs+0xc5e/0xfb0 [ 83.351062][ T3094] ? rtnl_create_link+0x86e/0xaf0 [ 83.356131][ T3094] ? __cfi_erspan_newlink+0x10/0x10 [ 83.361340][ T3094] rtnl_newlink+0x14dc/0x20d0 [ 83.366039][ T3094] ? memcpy+0x56/0x70 [ 83.370068][ T3094] ? __cfi_rtnl_newlink+0x10/0x10 [ 83.375131][ T3094] ? selinux_capable+0x2b6/0x3b0 [ 83.380082][ T3094] ? __cfi_selinux_capable+0x10/0x10 [ 83.385396][ T3094] ? __cfi_mutex_lock+0x10/0x10 [ 83.390282][ T3094] ? ns_capable+0x8c/0xf0 [ 83.394635][ T3094] ? netlink_net_capable+0x125/0x160 [ 83.399939][ T3094] ? __cfi_rtnl_newlink+0x10/0x10 [ 83.404999][ T3094] rtnetlink_rcv_msg+0xb28/0xde0 [ 83.409954][ T3094] ? 0xffffffffa0000960 [ 83.414124][ T3094] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 83.419603][ T3094] ? __kernel_text_address+0xd/0x30 [ 83.424818][ T3094] ? avc_has_perm_noaudit+0x390/0x490 [ 83.430206][ T3094] ? memcpy+0x56/0x70 [ 83.434215][ T3094] ? avc_has_perm_noaudit+0x30a/0x490 [ 83.439692][ T3094] ? __cfi_avc_has_perm_noaudit+0x10/0x10 [ 83.445433][ T3094] ? kasan_save_alloc_info+0x1f/0x30 [ 83.450741][ T3094] ? avc_has_perm+0x163/0x250 [ 83.455433][ T3094] ? __alloc_skb+0x226/0x4a0 [ 83.460048][ T3094] ? netlink_sendmsg+0x635/0xbd0 [ 83.465008][ T3094] ? ____sys_sendmsg+0x5fb/0x9c0 [ 83.470073][ T3094] ? __cfi_avc_has_perm+0x10/0x10 [ 83.475118][ T3094] ? selinux_nlmsg_lookup+0x38f/0x440 [ 83.480508][ T3094] netlink_rcv_skb+0x200/0x450 [ 83.485296][ T3094] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 83.490772][ T3094] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 83.496084][ T3094] ? __netlink_lookup+0x387/0x3b0 [ 83.501136][ T3094] rtnetlink_rcv+0x1c/0x20 [ 83.505572][ T3094] netlink_unicast+0x8c1/0xa60 [ 83.510356][ T3094] netlink_sendmsg+0x8b9/0xbd0 [ 83.515145][ T3094] ? __cfi_netlink_sendmsg+0x10/0x10 [ 83.520455][ T3094] ? security_socket_sendmsg+0x93/0xb0 [ 83.525944][ T3094] ? __cfi_netlink_sendmsg+0x10/0x10 [ 83.531259][ T3094] ____sys_sendmsg+0x5fb/0x9c0 [ 83.536041][ T3094] ? __sys_sendmsg_sock+0x40/0x40 [ 83.541079][ T3094] ? import_iovec+0x7c/0xb0 [ 83.545599][ T3094] ___sys_sendmsg+0x2a2/0x360 [ 83.550287][ T3094] ? __sys_sendmsg+0x290/0x290 [ 83.555061][ T3094] ? security_file_alloc+0x33/0x130 [ 83.560292][ T3094] ? percpu_counter_add_batch+0x13c/0x160 [ 83.566032][ T3094] ? __fdget+0x19c/0x220 [ 83.570293][ T3094] __x64_sys_sendmsg+0x20d/0x2e0 [ 83.575413][ T3094] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 83.580905][ T3094] ? __kasan_check_write+0x14/0x20 [ 83.586044][ T3094] ? fpregs_restore_userregs+0x128/0x260 [ 83.591716][ T3094] ? switch_fpu_return+0xe/0x10 [ 83.596609][ T3094] x64_sys_call+0x171/0x9a0 [ 83.601134][ T3094] do_syscall_64+0x4c/0xa0 [ 83.605566][ T3094] ? clear_bhb_loop+0x30/0x80 [ 83.610282][ T3094] ? clear_bhb_loop+0x30/0x80 [ 83.615007][ T3094] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 83.620922][ T3094] RIP: 0033:0x7fd362b9f559 [ 83.625363][ T3094] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.644981][ T3094] RSP: 002b:00007fd3639a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 83.653432][ T3094] RAX: ffffffffffffffda RBX: 00007fd362e25fa0 RCX: 00007fd362b9f559 [ 83.661419][ T3094] RDX: 0000000020040040 RSI: 0000200000000000 RDI: 0000000000000004 [ 83.669430][ T3094] RBP: 00007fd362c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 83.677435][ T3094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.685426][ T3094] R13: 00007fd362e26038 R14: 00007fd362e25fa0 R15: 00007fffbf533b98 [ 83.693429][ T3094] [ 83.729319][ T3097] loop6: detected capacity change from 0 to 512 [ 83.736405][ T3097] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 83.817419][ T3105] loop4: detected capacity change from 0 to 512 [ 83.837471][ T3107] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.857353][ T3105] EXT4-fs (loop4): Test dummy encryption mode enabled [ 83.870260][ T3107] EXT4-fs (loop7): Test dummy encryption mode enabled [ 83.882168][ T3107] EXT4-fs error (device loop7): ext4_orphan_get:1431: comm syz.7.1033: bad orphan inode 134217728 [ 83.895424][ T3105] EXT4-fs error (device loop4): ext4_orphan_get:1405: inode #15: comm syz.4.1032: inode has both inline data and extents flags [ 83.910431][ T19] wacom 0003:056A:0016.000C: Unknown device_type for 'HID 056a:0016'. Assuming pen. [ 83.921107][ T19] wacom 0003:056A:0016.000C: hidraw0: USB HID v10.01 Device [HID 056a:0016] on usb-dummy_hcd.3-1/input0 [ 83.932704][ T3107] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 83.942875][ T19] input: Wacom Graphire4 6x8 Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:056A:0016.000C/input/input10 [ 83.948481][ T3105] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.1032: couldn't read orphan inode 15 (err -117) [ 84.012516][ T3105] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 84.024723][ T1978] EXT4-fs error (device loop7): ext4_iget_extra_inode:4765: inode #15: comm syz-executor: corrupted in-inode xattr [ 84.057175][ T1978] EXT4-fs error (device loop7): ext4_iget_extra_inode:4765: inode #15: comm syz-executor: corrupted in-inode xattr [ 84.092183][ T3103] F2FS-fs (loop6): invalid crc value [ 84.099457][ T291] EXT4-fs (loop4): unmounting filesystem. [ 84.105291][ T3103] F2FS-fs (loop6): Found nat_bits in checkpoint [ 84.115083][ T19] usb 4-1: USB disconnect, device number 6 [ 84.170638][ T3103] F2FS-fs (loop6): Start checkpoint disabled! [ 84.178926][ T3103] F2FS-fs (loop6): f2fs_disable_checkpoint() finish, err:0 [ 84.180368][ T1978] EXT4-fs (loop7): unmounting filesystem. [ 84.191444][ T3103] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e6 [ 84.203729][ T530] Bluetooth: hci0: command 0x1003 tx timeout [ 84.209814][ T1025] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 84.494102][ T3129] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.501279][ T3129] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.515146][ T3129] device bridge_slave_0 entered promiscuous mode [ 84.522909][ T3129] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.530399][ T3129] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.538184][ T3129] device bridge_slave_1 entered promiscuous mode [ 84.566933][ T3134] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 84.631194][ T3129] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.638317][ T3129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.645661][ T3129] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.652714][ T3129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.736430][ T43] device bridge_slave_1 left promiscuous mode [ 84.743897][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.765060][ T43] device bridge_slave_0 left promiscuous mode [ 84.773783][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.791619][ T43] device veth1_macvtap left promiscuous mode [ 84.797757][ T43] device veth0_vlan left promiscuous mode [ 84.818781][ T3139] erofs: (device loop3): mounted with root inode @ nid 36. [ 85.030988][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 85.038940][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.047191][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.057320][ T3146] A link change request failed with some changes committed already. Interface ipip0 may have been left with an inconsistent configuration, please check. [ 85.087316][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 85.097709][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.104838][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.126545][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 85.134942][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 85.154307][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.161403][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.174373][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 85.182273][ T3125] overlayfs: statfs failed on './file0' [ 85.194194][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 85.224407][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 85.233081][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 85.246721][ T3129] device veth0_vlan entered promiscuous mode [ 85.254101][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 85.262161][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 85.275512][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 85.283120][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 85.316998][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 85.335968][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 85.346472][ T3129] device veth1_macvtap entered promiscuous mode [ 85.377339][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 85.389591][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 85.402628][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 85.425093][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 85.446508][ T420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.654144][ T347] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 85.683875][ T3170] set_capacity_and_notify: 4 callbacks suppressed [ 85.683891][ T3170] loop4: detected capacity change from 0 to 16 [ 85.699913][ T3170] erofs: (device loop4): mounted with root inode @ nid 36. [ 85.710553][ T3170] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 85.720587][ T3170] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 85.729868][ T3170] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 85.739198][ T3170] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=46 [ 85.770583][ T3172] loop4: detected capacity change from 0 to 128 [ 85.786358][ T3172] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002] [ 85.795177][ T3172] System zones: 1-3, 19-19, 35-36 [ 85.800821][ T3172] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 85.810875][ T3172] ext4 filesystem being mounted at /209/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 85.847477][ T28] kauditd_printk_skb: 11 callbacks suppressed [ 85.847494][ T28] audit: type=1400 audit(1793234259.013:431): avc: denied { rename } for pid=3133 comm="syz.0.1043" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 85.877489][ T289] EXT4-fs (loop0): unmounting filesystem. [ 85.900625][ T291] EXT4-fs (loop4): unmounting filesystem. [ 85.903295][ T28] audit: type=1400 audit(1793234259.063:432): avc: denied { ioctl } for pid=3174 comm="syz.0.1058" path="socket:[34049]" dev="sockfs" ino=34049 ioctlcmd=0x7452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 85.942321][ T347] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 85.942825][ T3178] FAULT_INJECTION: forcing a failure. [ 85.942825][ T3178] name failslab, interval 1, probability 0, space 0, times 0 [ 85.961764][ T347] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.968973][ T3178] CPU: 1 PID: 3178 Comm: syz.4.1059 Tainted: G W syzkaller #0 [ 85.981233][ T347] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 85.984702][ T3178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 85.984718][ T3178] Call Trace: [ 85.984733][ T3178] [ 85.984742][ T3178] __dump_stack+0x21/0x24 [ 85.984770][ T3178] dump_stack_lvl+0x110/0x170 [ 85.984792][ T3178] ? __cfi_dump_stack_lvl+0x8/0x8 [ 85.984813][ T3178] ? kasan_save_alloc_info+0x1f/0x30 [ 85.984838][ T3178] ? bpf_prog_select_runtime+0x89c/0xbb0 [ 85.984875][ T3178] ? bpf_prog_create_from_user+0x2c5/0x420 [ 85.984906][ T3178] ? do_seccomp+0x801/0xec0 [ 85.984933][ T3178] ? __x64_sys_seccomp+0x7b/0x90 [ 85.984959][ T3178] ? do_syscall_64+0x4c/0xa0 [ 85.984982][ T3178] dump_stack+0x15/0x24 [ 85.985003][ T3178] should_fail_ex+0x3bf/0x510 [ 85.985030][ T3178] __should_failslab+0xac/0xf0 [ 85.985061][ T3178] should_failslab+0x9/0x20 [ 85.985085][ T3178] __kmem_cache_alloc_node+0x3d/0x2d0 [ 85.998381][ T347] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 86.008037][ T3178] ? kvmalloc_node+0x28a/0x460 [ 86.008071][ T3178] ? kvmalloc_node+0x28a/0x460 [ 86.011650][ T347] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.014305][ T3178] __kmalloc_node+0xa2/0x1e0 [ 86.014333][ T3178] kvmalloc_node+0x28a/0x460 [ 86.032911][ T347] usb 4-1: config 0 descriptor?? [ 86.033692][ T3178] ? __cfi_kvmalloc_node+0x10/0x10 [ 86.128549][ T3178] ? __kasan_kmalloc+0x90/0xb0 [ 86.133361][ T3178] ? bpf_int_jit_compile+0x238/0xcb00 [ 86.138777][ T3178] ? kmalloc_trace+0x40/0xb0 [ 86.143399][ T3178] bpf_int_jit_compile+0x474/0xcb00 [ 86.148639][ T3178] ? __kmem_cache_free+0xb7/0x1b0 [ 86.153740][ T3178] ? ____kasan_slab_free+0x13d/0x180 [ 86.159092][ T3178] ? __kasan_slab_free+0x11/0x20 [ 86.164074][ T3178] ? __kmem_cache_free+0xb7/0x1b0 [ 86.169147][ T3178] ? kfree+0x6f/0xf0 [ 86.171704][ T3185] loop0: detected capacity change from 0 to 512 [ 86.173068][ T3178] ? bpf_convert_filter+0x509a/0x5220 [ 86.173093][ T3178] ? ____kasan_slab_free+0x132/0x180 [ 86.190212][ T3178] ? __kasan_slab_free+0x11/0x20 [ 86.195207][ T3178] ? kasan_set_track+0x4b/0x70 [ 86.200019][ T3178] ? __cfi_bpf_int_jit_compile+0x10/0x10 [ 86.205707][ T3178] ? sk_filter_release_rcu+0x110/0x110 [ 86.211200][ T3178] bpf_prog_select_runtime+0x89c/0xbb0 [ 86.216682][ T3178] ? kmemdup+0x46/0x60 [ 86.220767][ T3178] ? memcpy+0x56/0x70 [ 86.224770][ T3178] ? bpf_prog_realloc+0x185/0x200 [ 86.229817][ T3178] bpf_prepare_filter+0x101c/0x11c0 [ 86.235084][ T3178] ? __cfi_seccomp_check_filter+0x10/0x10 [ 86.240823][ T3178] ? bpf_prog_create+0x1f0/0x1f0 [ 86.245786][ T3178] bpf_prog_create_from_user+0x2c5/0x420 [ 86.251437][ T3178] ? __cfi_seccomp_check_filter+0x10/0x10 [ 86.257176][ T3178] do_seccomp+0x801/0xec0 [ 86.261524][ T3178] ? prctl_set_seccomp+0x60/0x60 [ 86.266479][ T3178] ? __this_cpu_preempt_check+0x13/0x20 [ 86.272042][ T3178] ? xfd_validate_state+0x70/0x150 [ 86.277179][ T3178] ? fpregs_restore_userregs+0x128/0x260 [ 86.282834][ T3178] __x64_sys_seccomp+0x7b/0x90 [ 86.287627][ T3178] x64_sys_call+0x721/0x9a0 [ 86.292150][ T3178] do_syscall_64+0x4c/0xa0 [ 86.296597][ T3178] ? clear_bhb_loop+0x30/0x80 [ 86.301296][ T3178] ? clear_bhb_loop+0x30/0x80 [ 86.305990][ T3178] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.311903][ T3178] RIP: 0033:0x7fd362b9f559 [ 86.316371][ T3178] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.336031][ T3178] RSP: 002b:00007fd3639a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000013d [ 86.344459][ T3178] RAX: ffffffffffffffda RBX: 00007fd362e25fa0 RCX: 00007fd362b9f559 [ 86.352442][ T3178] RDX: 00002000000001c0 RSI: 0000000000000008 RDI: 0000000000000001 [ 86.360511][ T3178] RBP: 00007fd362c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 86.368493][ T3178] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.376478][ T3178] R13: 00007fd362e26038 R14: 00007fd362e25fa0 R15: 00007fffbf533b98 [ 86.384466][ T3178] [ 86.413892][ C0] ================================================================== [ 86.422017][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 86.429434][ C0] Read of size 8 at addr ffff88812076b990 by task syz.4.1059/3177 [ 86.437315][ C0] [ 86.439666][ C0] CPU: 0 PID: 3177 Comm: syz.4.1059 Tainted: G W syzkaller #0 [ 86.448543][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 86.458627][ C0] Call Trace: [ 86.461932][ C0] [ 86.464892][ C0] __dump_stack+0x21/0x24 [ 86.469254][ C0] dump_stack_lvl+0x110/0x170 [ 86.473961][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 86.479104][ C0] ? debug_smp_processor_id+0x17/0x20 [ 86.484530][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 86.489596][ C0] print_address_description+0x71/0x200 [ 86.495187][ C0] print_report+0x4a/0x60 [ 86.499566][ C0] kasan_report+0x122/0x150 [ 86.504108][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 86.509193][ C0] __asan_report_load8_noabort+0x14/0x20 [ 86.514872][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 86.519760][ C0] rcu_do_batch+0x4bc/0xc30 [ 86.524331][ C0] ? rcu_core+0xf00/0xf00 [ 86.528689][ C0] ? timerqueue_del+0xd3/0x120 [ 86.533572][ C0] rcu_core+0x486/0xf00 [ 86.536823][ T3185] bio_check_eod: 4064 callbacks suppressed [ 86.536866][ T3185] syz.0.1063: attempt to access beyond end of device [ 86.536866][ T3185] loop0: rw=524288, sector=17179852706, nr_sectors = 16 limit=512 [ 86.537811][ C0] ? ktime_get+0x141/0x170 [ 86.562381][ C0] ? lapic_next_event+0x70/0x80 [ 86.567270][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 86.572492][ C0] ? tick_program_event+0xa3/0x120 [ 86.577629][ C0] ? hrtimer_reprogram+0x351/0x400 [ 86.582774][ C0] rcu_core_si+0x9/0x10 [ 86.586977][ C0] handle_softirqs+0x1dd/0x5f0 [ 86.591778][ C0] __irq_exit_rcu+0x52/0xf0 [ 86.596303][ C0] irq_exit_rcu+0x9/0x10 [ 86.600548][ C0] sysvec_apic_timer_interrupt+0x58/0xc0 [ 86.606194][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 86.612232][ C0] RIP: 0033:0x7fd362a6f8c0 [ 86.616664][ C0] Code: 0f 7e c1 66 48 0f 7e ca 48 39 c2 73 65 48 39 f0 0f 82 2a 01 00 00 48 39 f2 72 65 66 0f c6 c0 01 0f 11 45 00 4c 89 e6 eb 09 90 <48> 8b 4b 08 48 83 c3 08 48 39 d1 72 f3 48 8d 46 f8 48 8b 76 f8 48 [ 86.636272][ C0] RSP: 002b:00007fffbf533a40 EFLAGS: 00000287 [ 86.642343][ C0] RAX: 00007fd36288f560 RBX: 00007fd36288dcb8 RCX: ffffffff815796bb [ 86.650313][ C0] RDX: ffffffff81579a15 RSI: 00007fd36288f560 RDI: 00007fd36288e990 [ 86.658292][ C0] RBP: 00007fd36288d440 R08: 00007fd362e10000 R09: 00007fd362e26038 [ 86.666274][ C0] R10: 0000000000000003 R11: 0000000000000005 R12: 00007fd36288fee8 [ 86.674268][ C0] R13: 0000000000000018 R14: 0000000000000555 R15: 0000000000000003 [ 86.682245][ C0] ? vprintk_emit+0x28b/0x420 [ 86.686944][ C0] ? console_unlock+0x1b5/0x560 [ 86.691831][ C0] [ 86.694865][ C0] [ 86.697192][ C0] Allocated by task 3175: [ 86.701517][ C0] kasan_set_track+0x4b/0x70 [ 86.706134][ C0] kasan_save_alloc_info+0x1f/0x30 [ 86.711247][ C0] __kasan_kmalloc+0x95/0xb0 [ 86.715857][ C0] __kmalloc+0xb4/0x1e0 [ 86.720011][ C0] l2tp_session_create+0x38/0xbd0 [ 86.725040][ C0] pppol2tp_connect+0xbf5/0x1640 [ 86.729986][ C0] __sys_connect+0x3da/0x460 [ 86.734578][ C0] __x64_sys_connect+0x7a/0x90 [ 86.739344][ C0] x64_sys_call+0x88d/0x9a0 [ 86.743851][ C0] do_syscall_64+0x4c/0xa0 [ 86.748262][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.754170][ C0] [ 86.756492][ C0] Freed by task 8: [ 86.760203][ C0] kasan_set_track+0x4b/0x70 [ 86.764810][ C0] kasan_save_free_info+0x2b/0x40 [ 86.769866][ C0] ____kasan_slab_free+0x132/0x180 [ 86.774990][ C0] __kasan_slab_free+0x11/0x20 [ 86.779761][ C0] slab_free_freelist_hook+0xc2/0x190 [ 86.785146][ C0] __kmem_cache_free+0xb7/0x1b0 [ 86.790023][ C0] kfree+0x6f/0xf0 [ 86.793750][ C0] l2tp_session_put+0xaf/0x1a0 [ 86.798550][ C0] l2tp_session_delete+0x3df/0x4d0 [ 86.803680][ C0] l2tp_tunnel_del_work+0x199/0x410 [ 86.808927][ C0] process_one_work+0x717/0xc30 [ 86.813780][ C0] worker_thread+0xa4d/0x11d0 [ 86.818455][ C0] kthread+0x281/0x320 [ 86.822527][ C0] ret_from_fork+0x1f/0x30 [ 86.826959][ C0] [ 86.829287][ C0] Last potentially related work creation: [ 86.835007][ C0] kasan_save_stack+0x3a/0x60 [ 86.839705][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 86.845095][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 86.851041][ C0] call_rcu+0xcf/0xf50 [ 86.855126][ C0] pppol2tp_release+0x1e3/0x2b0 [ 86.859985][ C0] sock_close+0xc9/0x220 [ 86.864235][ C0] __fput+0x1fd/0x8f0 [ 86.868228][ C0] ____fput+0x15/0x20 [ 86.872220][ C0] task_work_run+0x1e1/0x250 [ 86.876813][ C0] do_exit+0xb0d/0x29f0 [ 86.880973][ C0] __cfi___ia32_sys_exit+0x0/0x10 [ 86.886001][ C0] x64_sys_call+0x67/0x9a0 [ 86.890426][ C0] do_syscall_64+0x4c/0xa0 [ 86.894842][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.900737][ C0] [ 86.903058][ C0] The buggy address belongs to the object at ffff88812076b800 [ 86.903058][ C0] which belongs to the cache kmalloc-512 of size 512 [ 86.917108][ C0] The buggy address is located 400 bytes inside of [ 86.917108][ C0] 512-byte region [ffff88812076b800, ffff88812076ba00) [ 86.930480][ C0] [ 86.932837][ C0] The buggy address belongs to the physical page: [ 86.939242][ C0] page:ffffea000481da00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120768 [ 86.949480][ C0] head:ffffea000481da00 order:2 compound_mapcount:0 compound_pincount:0 [ 86.957808][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 86.963909][ C0] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 86.972602][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 86.981178][ C0] page dumped because: kasan: bad access detected [ 86.987613][ C0] page_owner tracks the page as allocated [ 86.993362][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1978, tgid 1978 (syz-executor), ts 61060845785, free_ts 60100233272 [ 87.016136][ C0] post_alloc_hook+0x1f5/0x210 [ 87.020917][ C0] prep_new_page+0x1c/0x110 [ 87.025427][ C0] get_page_from_freelist+0x2ca9/0x2d20 [ 87.030983][ C0] __alloc_pages+0x1fa/0x610 [ 87.035579][ C0] alloc_slab_page+0x6e/0xf0 [ 87.040167][ C0] new_slab+0x98/0x3e0 [ 87.044241][ C0] ___slab_alloc+0x70f/0xb70 [ 87.048860][ C0] __slab_alloc+0x5e/0xa0 [ 87.053199][ C0] __kmem_cache_alloc_node+0x204/0x2d0 [ 87.058660][ C0] __kmalloc_node_track_caller+0xa1/0x1e0 [ 87.064383][ C0] __alloc_skb+0x226/0x4a0 [ 87.068829][ C0] netlink_ack+0x373/0x1160 [ 87.073354][ C0] netlink_rcv_skb+0x27e/0x450 [ 87.078118][ C0] rtnetlink_rcv+0x1c/0x20 [ 87.082534][ C0] netlink_unicast+0x8c1/0xa60 [ 87.087299][ C0] netlink_sendmsg+0x8b9/0xbd0 [ 87.092073][ C0] page last free stack trace: [ 87.096745][ C0] free_unref_page_prepare+0x81b/0x820 [ 87.102246][ C0] free_unref_page+0x93/0x530 [ 87.106939][ C0] __free_pages+0x67/0x100 [ 87.111380][ C0] __free_slab+0xc7/0x1a0 [ 87.115707][ C0] __unfreeze_partials+0x15a/0x190 [ 87.120814][ C0] put_cpu_partial+0xa9/0x100 [ 87.125496][ C0] __slab_free+0x1c4/0x280 [ 87.129944][ C0] ___cache_free+0xbf/0xd0 [ 87.134391][ C0] qlist_free_all+0xc6/0x140 [ 87.139005][ C0] kasan_quarantine_reduce+0x14a/0x170 [ 87.144471][ C0] __kasan_slab_alloc+0x24/0x80 [ 87.149345][ C0] slab_post_alloc_hook+0x4f/0x2d0 [ 87.154486][ C0] kmem_cache_alloc_node+0x179/0x330 [ 87.159799][ C0] __alloc_skb+0xe8/0x4a0 [ 87.164130][ C0] netlink_ack+0x373/0x1160 [ 87.168633][ C0] netlink_rcv_skb+0x27e/0x450 [ 87.173397][ C0] [ 87.175746][ C0] Memory state around the buggy address: [ 87.181419][ C0] ffff88812076b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.189491][ C0] ffff88812076b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.197544][ C0] >ffff88812076b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.205607][ C0] ^ [ 87.210193][ C0] ffff88812076ba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.218252][ C0] ffff88812076ba80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.226329][ C0] ================================================================== [ 87.234463][ C0] Disabling lock debugging due to kernel taint [ 87.241899][ T530] Bluetooth: hci0: command 0x1003 tx timeout [ 87.251001][ T1025] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 87.259054][ T347] plantronics 0003:047F:FFFF.000D: No inputs registered, leaving [ 87.270346][ T347] plantronics 0003:047F:FFFF.000D: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 87.303202][ T28] audit: type=1400 audit(1793234260.463:433): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.465856][ T347] usb 4-1: USB disconnect, device number 7 [ 88.523715][ T1129] Bluetooth: hci1: Opcode 0x1003 failed: -110