last executing test programs: 6m53.287379516s ago: executing program 0 (id=33): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') 6m53.074738027s ago: executing program 0 (id=36): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000000040)={0x100, 0xffffffffffffffff, 0x20, {0xc5, 0x100}, 0x4}, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0x0, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r4 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r4, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 6m51.107014975s ago: executing program 0 (id=37): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x8, 0x10, 0x80000000, 0x5}}) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x37}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r4, &(0x7f0000000040)=0x1f13, 0x12) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x4}, @const={0x0, 0x0, 0x0, 0x4}, @var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x48}, 0x28) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, 0x0) bind$inet6(r5, 0x0, 0x0) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r6, 0x404c534a, &(0x7f0000000380)) 6m50.051102497s ago: executing program 0 (id=38): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x804810, &(0x7f0000000a40), 0x26, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") chdir(&(0x7f0000000240)='./file0\x00') r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x139) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, 0x1a, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f2835973810000000000d300e6d60200000000000000000000000100", [0x8]}) pwrite64(r0, &(0x7f0000000180)='w', 0x1, 0xf49) 6m48.290899214s ago: executing program 0 (id=44): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') 6m47.37491494s ago: executing program 0 (id=48): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000800000000000003000000000000000000000000000000fdfffffffbffffff0000000000000000ffffffffffffffff053b000000000000000000000000000002000000000000005600000000000000feffffffff7f400002000000000000080000000000000000010005000000000044000500ac141426000000000000000000000000000004d53c"], 0xfc}}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x1, @empty, 0xffff}, 0x1c) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x2c, r3, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) 6m46.916986652s ago: executing program 32 (id=48): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000800000000000003000000000000000000000000000000fdfffffffbffffff0000000000000000ffffffffffffffff053b000000000000000000000000000002000000000000005600000000000000feffffffff7f400002000000000000080000000000000000010005000000000044000500ac141426000000000000000000000000000004d53c"], 0xfc}}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x1, @empty, 0xffff}, 0x1c) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x2c, r3, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) 10.508421199s ago: executing program 4 (id=1028): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000007a00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe81}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}}, 0x4000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x80040, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x1c) write$binfmt_misc(r7, &(0x7f0000000000), 0xd) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="01", 0xfffffe9c}], 0x1}}], 0x2, 0x0) 9.675027111s ago: executing program 1 (id=1029): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$f2fs(&(0x7f0000010580), &(0x7f00000105c0)='./file1\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='active_logs=4,jqfmt=vfsv0,prjjquota=f2fs\x00,mode=adaptive,heap,norecovery,fsync_mode=posix,user_xattr,disable_roll_forward,\x00\x00\x00'], 0x1, 0x105c9, &(0x7f0000020bc0)="$eJzs3M1uG1UUAODjpClNKCVCLNh1JISUSLUVJ2kFuwCpAIlUET8LVuDYjuXWP1HsJKYIEVgjln0RWLFnz0uwQyyQ2BWBPDOGphQRqHGS5vuk8Zl7PXN8rlWpOnMjB3BuzSe//FyIKzEbEdMRcTkiPS/kR2otCy9ExNWImHrgKOTzf0xcjIi5iLgyTJ7lLORvfXrvcOP+YGMuz3rtZFYMnAYvRUR7Jzs/aGex28ji7Xy+st9MY3t1P4/ZG+07+bibxYP6VprhoDK6rpLGlUZ2fXdnrzeM261KdRgbze10fqeTfWBvvzHKk95wu7Kbjmv1rVG5h+l9d7PBII93e/0sTy3P93GaPvr9Uczm64N6tp6dO2msdvr5fDerr1YfDON+HnvZdFS7rVpax9Z//JLPgLebnb1Bsl/f7TW7neR6qfxyqXyjWN7t1ur9+mqx0q7dWE0WGq3hZcV+vdJea3S7jVa9VO22F5OFRrVaLJeThfX6VrPSScrl0kppqXh9MT+7lrxx6/2kVUsWhvG1Zmev32z1ku3ubpLdsZgsl1ZeWUxeLCfvbmwmm+/cvLmx+d6H6x/cenXjrdfzi/5SVrKwvLS8XCwvFZfLi/9ywb+eyvUP/4uezPofcunxbue8K5x0AQBnT9r/z8Yk+/9Pvr330/oXle/1/3COnaX+v5k35Pr/8Tsl/e/k+v9jrP/zc7R+/T+PRf8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBu/TDz9ZvpyXw2fjqffyafei4fFyJiKiJ+e4TpuHgk53SeZ+Zvrp95qIbvCpFmGH7GU/kxFxFr+XH/2UfXfmGs3wQAAAA8mb45vPpV1q1nL/MnXRCTlD20mbr80ZjyFSJiZv7HMWWbGr48P6Zk6b/vCzEYU7b0AdalMSXLH4p9NqZ0xzJ9JFx6IBSyMDXJagAAgMk42gnYUQcAAHhyfXnSBTB+x9m/K8RoK3O0F5z+5f2fG4KzR0YAAADAGVQ46QIAAACA/13a/5/l3/8DAAAA/ln2+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL+zcze5aQNRHMCfDW7pl4qqLiv1Kt3BMXqELrtEHKCX4Aj0CrkAZyC7HCHCER6j4IhIURgbBf1+kj/Ggj/PiM2bQQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgT7fVev5/8fPfuTm7+jx57gYAAAA4ZVut583JNI0/tde/tJe+teMiIsqIONW7j+JdJ3PU5lTPvL56UsNNRJOw/4z37fYxIn612/3Xvr8FAAAAuF6b5WqWuvW0m166IIaUJm3Kz78z5RURUU3vMqWV+933TGHN73scfzOlNRNYk0xhacptnCvtRUadw+ToUKRDOWg5AADAILqdwLBdCAAAAEP6c3S+uGAdDKyIw1LmYS24+ef944Lgh84IAAAAeIOKSxcAAAAA9K7p/z3/DwAAAK5bev4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfdpW6/lmuZqdm7OrX+HHJL25rusMtwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8MD+vKNACIRBGOxd35nM/Q8rDRobmlSB8PE3BgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw4nd/+T8xNc4kc6+NpeeRZO3U2Do19s6Noz+Mr18DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/vzkgIhEARRMGf876Tvf1hJ0DOIEAENjypq0QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHzR7375PzE1ziRzp42l45Fk7aqxddXYe9A4ejDe/g0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFzv37xpJFQcA/M3uzt4PkFujLJyNJ56cKF6y5y8EmyuEYCFYieWS2z1W91TuUnhHCtNYCP4HNtpeIwQEOQv/giusvDI2EWSLCBZWyvyKk2zQiZrZ3dznA2/eN5OXed83gZDvvEkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMLkarhQxM3k0MniRn7ux92NtaR/cKBP7PTvnk9aEkf1pr1wWsk96s46CwAAAE66ZlHfhxC2463VpG900vr/mWJMUvNvPJLFRT1/sO4v+qL2T9q97756e2+iTjZPHEL4pjMerNS2wvl2seK4cxXGpM8Ssic0zfTb1nhz87FJnN716PP7999op+Gp/5YxAPB/uFz0eTCMPkl/PxqOxoPeLBMDYHG1/vnTxZCi/m92asgLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYMYmm+H5Io5CCE+0/ooTD3Y31g7rd/p3zxft3LuPf1q+ZnKJOIQwHI0Hp2tcyzy7WHHcrdt33u+Px4ObRwqe/FdfJRAIFiU45h9QAACcKHHekrp+O95aTc5FSyH88eX++v9SKQ4V6//vR/culecq1/+92lY436rW/8vrNz5avnX7zgujG/3rg+uDD670Xuq9uvLay71XlpP7uZIdjzlbAAAAFlU7b+X6v7E0vf9/thSHivX/Dz+/80t5rqb6f8rR9/+POSEAAICH2KMXfvs1OuR81G6Hj/vr6zd72XHv4yvZcQap/r0z06dO5a1c/zeXZpAbAAAAULvJZrRv//9aKQ4V9/+/fe73L8rXbOaPIIaj8eDy2ofja/UtZ25N7/93Dh1Xx58T17BcAAAAZuRM3sr7/3H6/n/jqWJMI4Tw7NNZnP8bwEr1/+utz66W5yq///9ifUucS41udj+qvP+fju2G0OrWkBgAAAAn0um8JfX/T/HW6ntfn32r7f1/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5kf+5tEwbCOA6/viRK3CYjpLf4mIGGCsEKgIRkyTMwAAvRUNFaLAIrgATnms5QPE/z/xVX3AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvL3r0xcfEVFE6jJFmm7/zp8R8RVp17aT73sW+8up+Xnk4nCc5fyN+X8ZEWUUfZwDANC7qtsc6029GuQd5h3lHeetyqZevvLTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3duBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAPHAgAAAADC/K3T6NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADGCgAA//9fbFmx") syz_mount_image$udf(&(0x7f0000000c40), &(0x7f0000000240)='./file1\x00', 0x2004018, &(0x7f0000000180)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00'], 0x47, 0xc15, &(0x7f0000001940)="$eJzs3V1sZOdZB/DnnWPHY6e0TtNuWmjKSEXtymWj/equq0WVt3ENlbabql5X5Koef+x2FO94ZXvppkBlQAWJm4rcIG6QRYlA6gVXhEtcGqRWCAlVvSgXSJZoo1xw4YtKCFBqdM68Y493vVk3G39s8vtFzv/MmeeM34/xmWNpX58AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACI++7nLp8+ko24FAHCYrk5+6fQ5n/8A8K5yze//AAAAAAAAAAAAAABw3KUo4kSkGHplM01XjzvqV1rt23emxif2PmwwRYpaFFV9+VU/c/bc+U9duDjazTc//u324Xhu8trlxrOLN28tzS8vz881ptqt2cW5+X2/wsMef7eRagAaN1+4PXf9+nLj7DPndj19Z/i1gcdPDF+6eOrCaLd2anxiYrKnpq//LX/3e9xvhcdjUUQzUrwx/HpqRkQtHn4sHvDeOWiDVSdGqk5MjU9UHVloNdsr5ZOplqtqEY2eg8a6Y3QIc/FQxiJWy+aXDR4puzd5q7nUnFmYb3yxubTSWmkttlOt09qyP42oxWiKWIuIjYF7X64/ivhopHjp9GaaiYiiOw6frBYGP7g9tQPo4z6U7Wz0R6zVHoE5O8YGooirkeJnr56M2XLM8ld8POILZb4S8XKZn4lI5RvjfMRP93gf8WjqiyL+NVIsps00V50PuueVK19ufL59fbGntnteeeQ/Hw7TMT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25Hij57+nWpdcVTr0t93afQ9z/9m75rxpx7wOmXtMxGxWtvfmtz+vHQ41cr/DqBj7Es9ivhGXv/3B0fdGAAAAAAAAAAAAAAAAAAAgHe1Ip6PFF85dTKtRe89xVvtG41rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzjsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KhbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIZyLF+vP16vFaLeJaRPx8a2ur+vqfra2tiM1y+2EddV8BAAAAAAAAAAAAAAAAAADg2EpFfCxSPPm/m6kREXeGXxt4/MTwpYunLowWUUQqS3rrn5u8drnx7OLNW0vzy8vzc42pdmt2cW5+v9+ufqXVvn1nanziQDrzQIMH3P7B+rOLt15cat346sqezw/VL88sryw1Z/d+OgajFjHdu2ekavDU+ETV6IVWs10dmmr3aWAtYmy/nQEAAAAAAAAAAAAAAAAAAODYGEpFfC5S/OQ/zqfuuvG+zpr/X+o8KrZrX/69nb8FsHBXdvX+/YD9bKf9NnSkWnjfmBqfmJjs2d3Xf29p2aaUingqUnzipQ9V6+FTDO25Nr6se29Zd/N8rhv+lbJudVdVfWRqfKJxdbF96vLCwuJsc6U5szDfmLzVnN33Hw4AAAAAAAAAAAAAAAAAAACANzGUivhRpPivv/231L3vfF7/39d51LP+/zeqJfSVetqd26q1/e+t1vZ3tt93aXToo0/fb/9BrP8v25RSEd+MFOd+9KHqfvrd9f/Td9WWdX8SKV5/+iO5rvZYWdfsdqfzitdbC/Ony9q/jBS/+ka3NqraG7n2yZ3aM2XtYKT4883dtV/NtR/YqT1b1p6MFN/7z71rP7hTe66s/Umk+Ie/aXRrh8ra3821J3Zqn5ldXJh70LCW8/+dSPHXV38rdft83/nv+fsPq3fltnvm/M233675H+7Zt5rn9Y/z/DcfMP8XIsV36h/JdZ2xn8nPP1H9f2f+PxEp/v1fdtdez7Xv36k9s99uHbVy/r8dKb77Fz/e7nOe/zyyOzPUO/+/3Lc7t98lRzT/T/TsG87tmv0Fx+LdaPnFr7/QXFiYX7Jhw4aN7Y2jPjNxGMrP/z+NFP93okjd65j8+f+ezqOd67///sbO5/+lu3LbEX3+v79n36V81dLfF1FfuXmr/6mI+vKLXz/Vutm8MX9jvn32zOlPf/rCmdNnLvQ/1r2429na99i9E5Tz/4NI8cO/++H27zG7r//2vv4fuiu3HdH8P9nbp13XNfseinelcv7/KlI88dkfb/+++WbX/93f/09+bHdu//wd0fx/oGffcG5X6xccCwAAAAAAAAAAgEfJUCrizyLFb//hr6fuGqL9/Pu/ubty2xH9+68TPfvmDmldw74HGQDgGCmv/z4YKf5x6/vba7l3X//Fr3Vre6//7uc43P8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAedSmK+P1IMfTKZlofKB931K+02rfvTI1P7H3YYIoUtSiq+vKrfubsufOfunBxtJtXBg6zGx+O5yavXW48u3jz1tL88vL8XGOq3ZpdnJvf9ys87PF3G6kGsHHzhdtz168vN84+c27X03eGXxt4/MTwpYunLox2a6fGJyYme2r6+t/yd79Hus/+x6KI70eKN4ZfT98diKjFw4/FA947B22w6sRI1Ymp8YmqIwutZnulfDLVclUtotFz0Fh3jA5hLh7KWMRq2fyywSNl9yZvNZeaMwvzjS82l1ZaK63Fdqp1Wlv2pxG1GE0RaxGxscePZH8U8c1I8dLpzfRPAxFFdxw+eXXyS6fPPbg9tQPo4z6U7Wz0R6zVHoE5O8YGooi/jxQ/e/VkfG8goi86X/HxiC+U+UrEy2V+JiKVb4zzET891FM7B6kvijgfKRbTZnp1oDwfdM8rV77c+Hz7+mJPbfe88sh/PhymY35uqkcRP6jO+Jvpn/1cAwAAAAAAAAAAAAAAABwjRaxFiq+cOpmq9cHba4pb7RuNa82Zhc6yvu7av+6a6a2tra1G6uRYzumcqznXcq7n3MgZtXx8zrGc0zlXc67lXM+5kTOKfHzOsZzTOVdzruVcz7mRM/ry8TnHck7nXM25lnM950bOOCZr9wAAAAAAAAAAAAAAAAAAgHeWWhTVXdy/9bXNtDXQub/0dHRy3f1A3/H+PwAA//8YNXNU") ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000080)=0xb0000) unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x106}, 0x1c) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0xc40, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.kill\x00', 0x275a, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, 0x0, &(0x7f0000001040)) io_setup(0x20, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) openat$dir(0xffffffffffffff9c, 0x0, 0x44000, 0x2) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x300f401, 0x0, 0x2, 0x0, 0x0) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 8.222586863s ago: executing program 4 (id=1030): r0 = syz_open_dev$ndb(0x0, 0x0, 0x8000) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0xfffffffffffffff3) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001540)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_DO_IT(r0, 0xab03) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6}]}) prctl$PR_SET_MM(0x22, 0x0, &(0x7f0000000000/0x4000)=nil) close_range(r2, 0xffffffffffffffff, 0x0) 8.219727832s ago: executing program 1 (id=1031): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x40, r2, 0x1, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TDLS_ACTION={0x5}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}]}, 0x40}}, 0x0) 7.565146665s ago: executing program 2 (id=1033): socket$pppoe(0x18, 0x1, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) ioctl$BTRFS_IOC_INO_PATHS(0xffffffffffffffff, 0xc0389423, &(0x7f0000000080)={0x3, 0x0, [0xffffffffffffff50, 0x7f, 0x7, 0x128], 0x0}) socket(0x400000000010, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x11, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r0, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) 6.734857336s ago: executing program 4 (id=1035): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x3c}}, 0x20000000) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 6.599989793s ago: executing program 2 (id=1036): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0xb02, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000180)=0x1) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$nfc_llcp(r1, &(0x7f0000000140)={0x27, 0x0, 0xfbffffff, 0x5, 0x2, 0x0, "d32984bd1ca44c066af5160e961701a077609475b78411e89309de050000000000f2170e65e3f503270000000000001200000000001900", 0x3c}, 0x60) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b00001400"], 0x6c}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) 5.24547494s ago: executing program 3 (id=1037): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001980)) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) 5.172883374s ago: executing program 4 (id=1038): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000007a00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe81}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}}, 0x4000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x80040, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x1c) write$binfmt_misc(r7, &(0x7f0000000000), 0xd) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="01", 0xfffffe9c}], 0x1}}], 0x2, 0x0) 4.946314985s ago: executing program 2 (id=1039): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x40000010) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000000580), 0x5, 0x4f3, &(0x7f00000005c0)="$eJzs3d1rW+cZAPBHku3YibN8bIwkgyWQQfZBLH8wYm+DsattF4GxwG42yDxb8TLLkbHkLDa5cLa7XOxibLRQetH7/gW9aa4aAqXXLb3tVUloUxfakoKKjiTHH5KjtraU+Px+cKJzzqvoeV/Zz+uj97xHJ4DUOlf7JxMxHBHvRMSx+ubWJ5yrP6w/vj1TWzJRrV75KJM8r7bdfGrz/x2JiLWIGIyIP/424m+ZnXHLK6vz08ViYamxna8sLObLK6sXry9MzxXmCjfGJi9NTU2OToxP7Vlb7/7nH3cvv/H7gdc/+/fD+/99681atYYbZZvbsZfqTe+PE5v29UXEr/YjWA/kGu0Z6nVF+EZqP7/vRsT5JP+PRS75aXbmyb7WDNhv1Wq1+mX1ULvitSpwYGWTY+BMdiQi6uvZ7MhI/Rj+e3E4WyyVKz+7Vlq+MVs/Vj4e/dlr14uF0cZnhePRn6ltjyXrT7fHt21PRCTHwP/LDSXbIzOl4mx3uzpgmyPb8v/TXD3/gZTo/CM/cNDIf0gv+Q/pJf8hveQ/pJf8h/SS/5Be8h/SS/5DerXK/6M9qAfQfbv9/R/oYj2ArvrD5cu1pdq8/n325sryfOnmxdlCeX5kYXlmZKa0tDgyVyrNJdfsLDzr9Yql0uLYz2P5Vr5SKFfy5ZXVqwul5RuVq8l1/VcL/V1pFdCJE2fvvZeJiLVfDCVLbPqTL1fhYKtWM9Hra5CB3sj1ugMCesapP0ivr/EZv+2XhAEvthZf0bth8Ejbol/H4r5UB+iC7G6FTx50ryJA11047fwfpJXxf0gv4/+QXo7xgd3G/6NxL7+WjP/DC2vX8X/gQBtuc/+vo5vu3TUaEd+JiHdz/Yea9/oCDoLsh5nG8f+FYz8a3l46kPk8OUUwEBH/fOXKS7emK5Wlsdr+jzf2V15u7B/vRf2B9raO8DXztJnHAEB6rT++PdNcuhn30W/qkxB2xu9rjE0OJkcwh9czW+YqZPZo7sLanYg41Sp+pnG/8/qZj8PruR3xTzYeM/WXSOrbl9w3vTvxT2+K/8NN8c9863cF0uFerf8ZbZV/2SSnYyP/tvY/w3s0d6LZ/zXnXG+O3+z/cm36v7Mdxvj7q/9qdXo3mez96E7EmZb9bzPeYBJre/xa3S50GP/hX/70/XZl1dfqr9MqflNtLV9ZWMyXV1YvXm/WYvLS1NTk6MT4VD4Zo843R6p3+uWpt++3i19rf0Ob9r+/o/1DjTr9pMP2f/GDB38+t0v8H59v/ft3Mnnc9v5Xqxt1+GmH8T8Z/+Cv7cpq8WfbvP/ZVvGjWRox0WH88v9/59phAHiOlFdW56eLxcKSFStWnu+Vvuhi0Gf1HGvd6aCAffM06XtdEwAAAAAAAAAAAKBT7Wb/3tvD6cS9biMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEHwVQAAAP//QUvQlg==") open(&(0x7f0000000340)='./file1\x00', 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/tty/drivers\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x106f) r6 = socket$rds(0x15, 0x5, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) 4.22762763s ago: executing program 1 (id=1040): syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp12500xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 000040'], 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000500)="14", 0x1, 0xfffffffffffffffd) syz_init_net_socket$ax25(0x3, 0x3, 0x8) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, 0x0, 0x0) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r5, &(0x7f00000042c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9e", 0x78}], 0x1}}, {{0x0, 0x0, &(0x7f00000022c0)=[{&(0x7f0000001040)="39e6f0f5240525bf127de94fe5cfc0b0f2c98c4ac8bf0568e948e0274b0445d03a56f1bfe147fb8ac1da60b16f07dbe40e90d68b4619d12165154b679949da907d460d298e92e0d24077e89d302255e0a9626f61e6dc304713126dd04ca5e168c8f7894d2d189c22945826101c5199f90c3734146364f219", 0x78}, {&(0x7f0000001100)}, {&(0x7f0000001200)="e86b23ea031a0d0335d120405fcbc0e8261e54e194b7ac7427e456a0c74eba6fd030e30723c080ff9d1d60aa58929f37061fea9199560e8c9734c24ad5a9849b6dc72795f44e9954bf08f35b5483099d17afa38d10de84516fb241942b5dc2443a0df8de2b82fba03bd1aaf1a8b54a56340e1c17ec2c1f797cb9e8534005fad205586e8df9c5e5846de0a63ea0935349fbe97099bcd39d198870265cb0e9d30982731773077edf0340e001654b40167f7172daaaf09261d1a91c77ab96126862c5af4dedd795869895c3f9770a945fc27c4579371167a0e2981f9e678f36a1f5c630359af6d41a45159b21d214d2b46132bc35cb5dc8a2324c3b447144e3ec5aa60a0791c33111d4c18e54f0f61d99dc68d109530c58fbb766a533071d8f12d4fa93efa0867620756cb13183b963714fc8f641ff59bcb98d36d132c30e4aacf1585a2aa076bf6ab258ee85734651c05ab4c24c32f18f2a884ff3562b367cb24c4e35587a42b7da49d69756a1f5e1e8eac669e0b968e8d88d863f7ea0a364926f0fb64d8f347c39f68ae32be6a3d875a7470dd209327d4060c75fba01cfb285aca1e8a1bddf0759ba9485bcbb58559337", 0x1b0}], 0x3, &(0x7f0000002340)=[@ip_ttl={{0x14, 0x0, 0x2, 0x8004}}, @ip_retopts={{0x10}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x40}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @loopback}}}], 0x60}}, {{0x0, 0x0, 0x0}}], 0x3, 0xc054) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) 3.799039052s ago: executing program 4 (id=1042): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x1e, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/59, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/231, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) mount$fuse(0x0, 0x0, 0x0, 0x4001, 0x0) 3.6189833s ago: executing program 1 (id=1043): r0 = socket(0x10, 0x3, 0x1000) sendmsg$can_bcm(r0, 0x0, 0x8800) sendmsg$kcm(r0, &(0x7f0000000b40)={&(0x7f0000000100)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha384\x00'}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000000)="21cfe65b3b5b0c15c145acc30186525ea639870475c6e9e42518607570e14a", 0x1f}, {&(0x7f0000000180)="0912f7b179d91aebdd36958c70ef", 0xe}, {&(0x7f00000001c0)="b135e84ea58ecd4e9b26c09f40cdfa7fa7e40f5c065f527974ab11a447ce4a040855e5cf1af45e3140d73f9c4f2b4359df74bd7d70a65d0c41db2be8492d44844ffc0b841de39c85eda7ccf20cebc8dbcf1f1d2a39c7771d8be525852f7b84a31d657fb7b1552d836fa1bd2ce29b056f7c7c1fc6fb28824a0a761b7110ea3deca16e7bb07bc87685f0c04f8bd9a2ade852b125a7df1375ea972fa9", 0x9b}, {&(0x7f00000002c0)="445c17c33ae4ea38183fc131f8a3be615c20bd86bb8184f92419a68e974472a45af6aba0cf1064c85647e78c9f26425311b617f63a777542b4d8c9ce4aced8101e6f6b24e5", 0x45}, {&(0x7f0000000380)="ac2032d95fa30d76efd223848bb74a174682c1816c8d1e10209d95f1eec34f520023d0bc0f1f41aeb00a7cc375ff368441dc0f389683b198b0e7080f791292aad935fde5a325365277753f77c88f30318189f27edfa0e6f438b6ff486eddbde81087c7ca13369b6d3d8972fdde9de5560297", 0x72}, {&(0x7f0000000400)="fcea50680173131d5d451188b94e1cd1e64f3bbca06484be2509a5dbeed2631c2e256baea8b797b7220fc9fdeb513a986078e79cb96c5e09195f4f22c7b1d7805d1c0ae706582ee358416f31046d602805aeee7bd33eada48a61d413467290820fe82baab19fbe2b8547f0433a8a7139b8ad84cc3e8cc66745f8c98cd80bc77f35d96710ead4cbd59ff847b4eb33fd8a88f296e1715c3b0dbd5af99ac7ffcc6b8ed551bef240aec47ec135d167e7079b09a3b33e0215a9a0187dd570c58de8f1bb471e2d879c8a7027b9ce4b522aa9a66eef85525683c0f5da0830c9f54c717dc8e33bc926641fa7a3a61c18b99b3c67d884f4", 0xf3}, {&(0x7f0000000500)="3755c714410961908ec51bdc3b09cd8f155589154b37dc0225496b9e94de54ce5b087bd4a657c451427ef789919381dbe55a2e0169601f4ae927561210a4c6e778c9b0c5ce2b590b0ec054e1fce0c1d312eda05ed1f47dbe5d774f6e80d33d4e3fbb827f83c243ba8457637d24312fac077cee583ae531b6ddb5686a323c08e2bc582e", 0x83}, {&(0x7f0000000640)="5e4db21c69bfe929de9a26285a77f9228a8c404887a8c83811c670b0d074cce6b8cc438e4cd9caf25a6f7385d6e21b869deecde1eeb35409a43d677778d16efed00b496b168caf8b5cdfffebd01b8ec910ec35c536b2c04c96f56d42a92d926b6fde9f70f744a2f6c911b3b15962a0d68246506c9d0094073d11608b6ba79e3ac495b36b2d85943328b895d20bdbd418daf4a099df67f896386d9f0bd5f226a8b0ea97dab62fd19742fc800a46f08af0ef66f4d76b", 0xb5}], 0x8, &(0x7f00000007c0)=[{0x28, 0x111, 0x6, "ee14e231694ac11d1a8d50a2423b5580df42ebea2b"}, {0xe8, 0x114, 0xffff, "4fb5095e1e0e4b4ee1d53343541bd86221f0636fc07f534576a79efb779b2bf5ba90c5a1c231fe2b37259f35e161047e38fd9faf626b1793fa6d5457b3b605a81644851919f3c5676ddc21aec2bcf7e41dfef1aee53f5b0c3725352bf10fbda8c845f71b67c4550f291c95248b8d4af3caae2783325e86699b39fef4f5f90d8fd9d3cb36fd1cf8f77e2a51a159e771a6eccc8f53de82f43832bb9f7b0e992feff55373a1bc281eeb78dfc26d694aa43623ef447b5f5fb7ee066983fc847a1500c5140159f85ab4715d2e3ea6af5aebe7970f251a5c"}, {0x10, 0x3a, 0xa}, {0x78, 0x6, 0x4, "034ee23293b07d5ff0976f9407114a06aac9d3af74e4d11c9f681a70b49608827cf83ec007697538fb0ab9f94919eddb287ec731dcb67489cdfc99efb2f8275943c72e4163105a6e45519c142ac788f5cc1b4c4ba77600ef89de7a07db6a7c22247c9753"}, {0x28, 0x102, 0x8, "61801d6db8097f4fedc0a6b3774b032d51740af4"}, {0x58, 0x117, 0xffffffcb, "6a3a25da76bf30434677db446e625f45d347a55ab61bbaef87f058793cd7194526bc27183d68f61a4f4211ff43efba22c7e7e0049188a015ed0fd59ff39d8fe4abf6"}], 0x218}, 0x80) fchdir(0xffffffffffffffff) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sequencer(0xffffff9c, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x14) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)={0x28, 0x4, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004850}, 0x20000004) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$PIO_UNISCRNMAP(r2, 0x4b6a, &(0x7f0000000000)) ioctl$KDSETMODE(r2, 0x4b3a, 0x1) ioctl$TCXONC(r2, 0x4b3a, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0x5) 3.612962681s ago: executing program 3 (id=1044): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x8000) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0xfffffffffffffff3) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_DO_IT(r0, 0xab03) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6}]}) prctl$PR_SET_MM(0x22, 0x0, &(0x7f0000000000/0x4000)=nil) close_range(r1, 0xffffffffffffffff, 0x0) 2.444053759s ago: executing program 1 (id=1045): syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x8002, &(0x7f00000000c0)=ANY=[], 0x9, 0x627b, &(0x7f0000010200)="$eJzs3U9vHGcdB/Df7D//KU2jHqoSIeS2AVpK87eEQIG2Bzj0wgHlihq5bhWRAkoCSquIuMqFAy8ChMQREEdOvIAeuHLjBRApQQJ66qCxn8cZL96s43R31n4+H8md+c0z432m3x3vbmZmnwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4q3v//BsFRFv/yItOB7xuehH9CJWmnotIlbWjuf1BxHxbGw1xzMRMVyKqHLjUxGvRsTHxyLu3b+13iw6t89+fO9Pf//dj574wd/+MDz9nz/f6L82ab2bN3/977/cPvj+AgAAQInquq6r9DH/RPp83+u6UwDAXOTX/zrJy9ULV28uWH/UarVafQjrtnpvt9tFRGy2t2neMzgdDwCHzGZ80nUX6JD8izaIiCe67gSw0KquO8BM3Lt/a71K+Vbt14O17fZ8Lciu/Dernfs7Jk2nGb/GZF7PrzvRj6cn9GdlTn1YJDn/3lj+S6l9lKazzn9eJuU/2r71qTg5//748T/m6OTf2zP/UuX8B4+Uf1/+AAAAAACwwPK//x/v+Pzv0uPvyr487Pzv2pz6AAAAAAAAAACftccd/29HZfw/AAAAWFTNZ/XGb449WDbpu9ia5ZeqiCfH1gcKk26WWe26HwAAAAAAAAAAAABQksH2NbyXqohhRDy5ulrXdfPTNl4/qsfd/rArff+hZF3/kQcAgG0fHxu7l7+KWI6IS+m7/oarq6t1vbyyWq/WK0v5/exoableaX2uzdNm2dJoH2+IB6O6+WXLre3apn1entY+/vuaxxrV/X10bD46DBwAImL71eieV6Qjpq6fiq7f5XA4OP6PHsc/+9H18xQAAACYvbqu6yp9nfeJdM6/13WnAIC5yK//4+cF1Gq1Wq1WH726rd7b7XYREZvtbZr3DIbjB4BDZjM+6boLdEj+RRtExLNddwJYaFXXHWAm7t2/tV6lfKv260Ea3z1fC7Ir/81qa7u8/V7TacavMZnX8+tO9OPpCf15Zk59WCQ5/954/m9vt4/SerPOf14m5d/s5/EO+tO1nH9/PP8xRyf/3p75lyrnP3ik/PvyBwAAAACABZb//f/4Qp3/HR10d6Z62PnftZk9KgAAAAAAAADM1r37t9bzfa/5/P8X9ljP/Z9HU86/kn+Rcv7p/v+dC29eHFuv35q/++aD/P91/9b672/88/N5ut/8l/JMlZ5ZVXpGVOmRqkGaHnDHJrgz7I+aRxpWvf4gXfNTD9+NK3E1NuLMrnV76Xh40H52V3vT0+FWe93fbj+3q32w0563P7+rfZiudKpXcvupWI+fxtV4Z6u9aVuasv/LU9rrKe05/77jv0g5/0Hrp8l/NbVXY9PG3Y96/3fct6d7Pc4bV774qzOz352p7kR/Z9/amv17voP+bP0/eWIUP7++ce3Uzcs3blw7G2mya+m5SJPPWM5/mH5y/i++sN2e/+63j9e7H40eOf9FcScGE/N/oTXf7O9Lc+5bF3L+o/ST838nte99/B/m/Ccf/y930B8AAAAAAAAAAAAAAAB4mLqut24RfSMiLqT7f7q6NxMAmK/8+l8nefm86v5Bt//j7v3oqv9q9ZzrasH6M9f603rWj/fWQu2v+kD1fxesPwtXt9V7e71dRMRf29s07xl+udcvAwAW2acR8Y+uO0Fn5F+w/H1/zfRk150B5ur6Bx/++PLVqxvXrnfdEwAAAAAAAADgoPL4n2ut8Z9P1nV9e2y9XeO/vhlrjzv+5yDP7AwwOmGg6v6j79PD9CL6vdZw48/FpPG/hztzDxv/ezDl8YZT2kdT2pemtC9Pad/zRo+WnP9zrfHOT0bEibHh10sY/3V8zPsS5Pyfbz2fm/y/MrZeO//6t4c5/96u/E/feP9np69/8OErV96//N7Gexs/OX/27JnzFy5cvHjx9LtXrm6c2f5vhz2erZx/HvvadaBlyfnnzOVflpz/l1It/7Lk/L+cavmXJeef3+/Jvyw5//zZR/5lyfm/lGr5lyXn/9VUy78sOf+XUy3/suT8v5Zq+Zcl5/9KquVflpz/qVTLvyw5/9Op3mf+K7PuF/OR889nuBz/Zcn55ysb5F+WnP+5VMu/LDn/86mWf1ly/q+mWv5lyfl/PdXyL0vO/0Kq5V+WnP83Ui3/suT8L6Za/mXJ+X8z1fIvS87/W6mWf1ly/q+lWv5lyfl/O9XyL0vO/zupln9Zcv7fTbX8y5Lzfz3V8i/Lg+//N2PGjJk80/VfJgAAAAAAAAAAAABg3DwuJ+56HwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/7EDBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzdW4xcd30H8DN789qBxEBIndQJG8ckIdlk13biC22KCdeGW0lICr1gu961WfANr10CjWpHgRIJo6KKtuGhLSDU5qUiqnigFaA8oFaVKkH7QF8QFSoPURVQQKpKK2CrOef//+/M7OzMrne8OXvO5yMlv+zMmTlnzvxndr92vjsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtLr5DbOfbGRZ1mg0igu2ZtlLmnPzxNb8kte+uMcHAAAArN3P83+/cE264OAKbtSyzT/d9K2vLCwsLGTvHf7T0c8uLKQrJrJsdFOW5ddFz3z/fY3WbYInsvHGUMvXQ312P9zn+pE+14/2uX6sz/Wb+lw/3uf6JSdgic1ZI93Zzvw/txanNLs2G82v29nlVk80Ng01z126bdbIb7Mweiyby05ks9l02/bFto18+6/d3NzXW7O4r6GWfW1vrpAfP3Y0HkMjnOOdbftavM/oh6/PJn7y48eO/vW556/vNvuehrb7K47z9h3N4/x4uKQ41ka2KZ2TeJxDLce5vctzMtx2nI38ds3/7jzOF1Z4nMOLh7muOp/z8Wwo/+9v5+dppJF1OU/bw2U/vSXLsouLh925zZJ9ZUPZlrZLhhafn/FiRTbvo7mUXp6NrGqd3ryCddqcMzvb12nnayI+/zeH240scwytT9MPHx9red5/tnA56zRqPurlXiuda3DQr5WyrMG4Lr6dP+gnu67BneHxP3br8muw69rpsgbT425Zgzv6rcGhseH8mNOT0Mhvs7gGd7VtP5zvqZHP527tvQanzp08MzX/0Y/dNXfyyPHZ47On9uzaNb1n7979+/dPHZs7MTtd/Psyz3b5bcmG0mtgRzh38TVwW8e2rUt14QtjS95/L/d1ON7jdbi1Y9tBvw5HOh9cY31ekEvXdPHaeE/zpI9fGsqWeY3lz88da38dpsfd8jocaXkddv2e0uV1OLKC12FzmzN3rOxnlpGWf7odw/LfC9a2Bre2rMHOn0c61+Cgfx4pyxocD+viu3cs/71gezjeJydX+/PI8JI1mB5ueO9pXpJ+3h/fn49u6/KG5hVXjWXn52fP3v3okXPnzu7KwlgXr2hZK53rdUvLY8qWrNehVa/Xg3M3PXlDl8u3hnM1flfzX+PLPlfNbe65u/dzlX93634+2y7dnYUxYOt9Prt9N2+ez7Es+9w3H3/w64997g3Lns9m3vz41Np/Fk+5tOX9d3SZ99+Y+39R7C/d1RPDoyPF63c4nZ3Rtvfj9qdqJH/vauT7fmFqZe/Ho+Gf9X4/vrbH+/G2jm0H/X482vng4vtxo9+fdqxN5/M5HtbJiene78fNbbbtXu2aHOn5fnxLmI1w/l8TkkLKRS1rZ7l1m/Y1MjIaHtdI3EP7Ot3Ttv1oyGbNfT29+/LW6e23FPc1nB7dovVapxMd2w56naY/+1punTb6/enb5el8PsfDurh2T+912tzm2XvW/t65Of5ny3vnWL81ODo81jzm0bQI8/f7bGFzXIN3Z0ez09mJbCa/dixfT418X5P3rmwNjoV/1vu9cluPNXh7x7aDXoPp+9hya68xsvTBD0Dn8zke1sVT9/Zeg81t3rhvsD+73h4uSdu0/Oza+edry/2Z1w0dp+lKrZWRcJzf3Nf7z2ab25zYv9qc2fs83RkuuarLeep8/S73mprJ1uc8bQvH+fz+5c9T83ia23z2wArX08Esyy58+P78z3vD36/83fnvfKXt7126/Z3OhQ/f/6OXHvvH1Rw/ABvfL4qxpfhe1/I3Uyv5+38AAABgQ4i5fyjMRP4HAACAyoi5P/5f4Yn8DwAAAJURc/9ImElN8v+2Nz4/94sLWWrmLwTx+nQaHii2ix3X6fD1xMKi5uX3f2n2v//hwsr2PZRl2c8e+IOu2297IB5XYSIc5zNvar98ia/ctaJ9H374Qtpva3/98+H+4+NZ6TLoVsGdzrLsa9d8Ot/PxPsu5fPZBw7n88GLTz7R3OaFA8XX8fbPvaLY/i9C+ffgsSNtt38unIcfhDn9tu7nI97uy5des33fI4v7i7dr7Lg6f9hPvb+43/h7cj7zRLF9PM/LHf/XP/X0l5vbP/rq7sd/Yaj78T8d7vdLYf7vjcX2rc9B8+t4u0+E44/7i7e7+4vf6Hr8z3yy2P7Mm4vtDocZ9397+Hrnm5+faz1fjzaOtD2u7C3FdnH/09/54/z6eH/x/juPf/zQpbbz0bk+nv234n6mOraPl8f9RH/fsf/m/bSuz7j/p//ocNt57rf/Zx587sbm/Xbu/86O7c58+I58/4v31/4bm/7yE5/uur94PAf/9kzb4zn47vA6Dvt/6v1hPYbr/++Z4v46f7vC4Xe3v//E7T+/9ULb44ne+pNi/8+87ng+N41v3nLVS1569cVXNc9dln17U3F//fZ//K9Otx3/F64rzke8Pnb0O/e/nLj/sx+ZPHV6/vzcTDqrj12T/+6ctxfHE4/3mvDe2vn1odPnPjB7dmJ6YjrLJqr7K/Qu2xfD/FExLvbeemHJO+gdD4fn84Y//9qWW//1U/Hyf39PcfmltxXft257+Lkbxx7Jss+Ey7eG5291+1/qqZuvy1/fjWfDES4s/X3Ba7F953/tX9GG4fF3/lwQ1/uZV34gPw/N6/LvG/F1vcbj/95McT9fDed1Ifxm5h3XLe6vdfv4uxEuPVS83td8/sLbXHxe/yY83+/4QXH/8bji4/1e+DnmG9va3+9uC+voqxeGOu8//y0eF8P7SXaxuD5uFc/3pReu63p48feQZBevz7/+k3Q/16/qYS5n/qPzUyfmTp1/dOrc7Py5qfmPfuzQydPnT507lP8uz0Mf7Hf7xfenLfn708zs3nuy/N3qdDGuiJHSHP+Zh4/O7Ju+dWb22JHzx849fGb27PGj8/NHZ2fmbz1y7NjsR/rdfm7mvl27D+zZt3vy+NzMffsPHNhzYHLu1OnmYRQH1cfe6Q9Nnjp7KL/J/H33HNh17733TE+ePD0ze9++6enJ8/1un39vmmze+vcnz86eOHJu7uTs5Pzcx2bv23Vg797dfX8b4Mkzx+Ynps6ePzV1fn727FTxWCbO5Rc3v/f1uz3VNP8fxc+znRrFL+LL3nXn3vT7WZu+9Piyd1Vs0vELRJ8Pv4vmn192Zv9Kvo65fzTMpCb5HwAAAOog5v6xMBP5HwAAACoj5v5NYSbyPwAAAFRGzP3jYSY1yf+V6/9vu7Ci/ev/6/+3ni/9/5r1/x8qW/+/eL/Q/x+MtfbvV9P/36f/r/+v/9/mxen/l+f49f/1/1mqbP3/mPs3Z1kt8z8AAADUQcz9W8JM5H8AAACojJj7rwozkf8BAACgMmLuf0mYSU3yv/6//r/+v/6//n/3/ev/b0z6/73p//eh/z+V1av/f3GQx6//r//PUmXr/8fc/9Iwk5rkfwAAAKiDmPuvDjOR/wEAAKAyYu6/JsxE/gcAAIDKiLl/a5hJTfK//n+WDbWUl/X/9f/zC/T/9f/1/zcs/f/e9P/70P/3+f/6//r/DFTZ+v8x978szKQm+R8AAADqIOb+l4eZyP8AAABQPiOXd7OY+18RZrIk/1/mDgAAAIAXXcz912YdHwRfk7//1//3+f/l7/9vStfp/+v/Z6Xs/w9n+v/lof/fm/5/H/r/+v/6//r/DFTZ+v957s/Gs1eGmdQk/wMAAEAdxNx/XZiJ/A8AAACVEXP/L4WZyP8AAABQGTH3bwszqUn+1//X/y9//9/n/+v/l73/7/P/y0T/vzf9/z70//X/9f/1/xmosvX/Y+6/PsykJvkfAAAA6iDm/hvCTOR/AAAAqIyY+385zET+BwAAgMqIuX97mElN8r/+f8n7/7E5qv+v/6//r/+v/78i+v+96f/3of+v/6//r//PQJWt/x9z/41hJjXJ/wAAAFAHMfffFGYi/wMAAEBlxNz/qjAT+R8AAAAqI+b+iTCTmuR//f+S9/+LHvyYz//X/9f/1//X/18Z/f/e9P/70P/X/x9I/3/hgv6//j+FsvX/Y+6/OcykJvkfAAAA6iDm/h1hJvI/AAAAVEbM/beEmcj/AAAAUBkx9+8MM6lJ/tf/3xD9/0z/X/9f/1//X/9/ZfT/e9P/70P/X//f5//r/zNQZev/x9z/6jCTmuR/AAAAqIOY+28NM5H/AQAAoDJi7r8tzET+BwAAgMqIuf/2MJOa5H/9f/1//X/9f/3/7vvX/9+Y9P970//vQ/9f/1//X/+fgSpb/z/m/teEmdQk/wMAAEAdxNx/R5iJ/A8AAACVEXP/nWEm8j8AAABURsz9k2EmNcn/+v/6//r/+v/6/933r/+/Men/96b/34f+v/6//r/+PwNVtv5/zP13hZnUJP8DAABAHcTcf3eYifwPAAAAlRFz/1SYifwPAAAAlRFz/3SYSU3yv/6//r/+v/7/qvr/r1q8X/3/gv5/uej/96b/34f+v/7/i97/H9X/p1LK1v+PuX9XmElN8j8AAADUQcz9u8NM5H8AAACojJj794SZyP8AAABQGTH33xNmUpP8r/+v/6//r//v8/+771//f2PS/+9t8P3/+BD1//X/9f99/r/+P0uVrf8fc/+9YSY1yf8AAABQBzH37w0zkf8BAACgMmLu3xdmIv8DAABAZcTcvz/MpCb5X/9f/1//X/9f/7/7/vX/Nyb9/958/n8f+v/6//r/+v+s0UN/2PpV2fr/MfcfCDOpSf4HAACAOoi5/7VhJvI/AAAAVEbM/b8SZiL/AwAAQGXE3P+rYSY1yf/6/23d8+bD1f/X/9f/1//P6f9vTPr/ven/96H/r/+v/6//z0At2/8P0Xu9+/8x998XZlKT/A8AAAB1EHP/r4WZyP8AAABQGTH3vy7MRP4HAACAyoi5/2CYSU3yv/6/z//X/9f/1//vvv/17v+PxfvV/18T/f/e9P/70P/X/9f/1/9noMr2+f8x978+zKQm+R8AAADqIOb++8NM5H8AAACojJj73xBmIv8DAABAZcTc/8Ywk5rkf/1//f+N0v+/Sv9f/7/j8VSt/+/z/wdD/783/f8+9P/1//X/9f8ZqLL1/2Puf1OYSU3yPwAAANRBzP1vDjOR/wEAAKAyYu5/S5iJ/A8AAACVEXP/W8NMapL/9f/1/zdK/z/T/9f/73g8+v/6/93o//em/9+H/r/+v/6//j8DVbb+f8z9vx5mUpP8DwAAAHUQc/8DYSbyPwAAAFRGzP1vCzOR/wEAAKAyYu5/e5hJTfK//r/+v/6//v+a+v+b9f/1/8tF/7+3Ddb///nV4XL9/4L+f7mPf7X9/5GOr69I///7y/X/FzZ13l7/nyuhbP3/mPvfEWZSk/wPAAAAdRBz/zvDTOR/AAAAqIyY+98VZiL/AwAAQGXE3P8bYSY1yf/6/83jWGwv6/9Xtf8/pP/v8//1/2tC/7+3Ddb/9/n/HfT/y338Pv9f/5+lytb/j7n/3WEmNcn/AAAAUAcx9z8YZiL/AwAAQGXE3P9QmIn8DwAAAJURc/97wkxqkv/1/33+fz36/z7/P9P/1/+vibX170f1/yP9f/1//f9y9P//U/+fja1s/f+Y+x8OM6lJ/gcAAIA6iLn/kTAT+R8AAAAqI+b+3wwzkf8BAACgMmLuf2+YSU3yv/7/Run/T2zQ/v/j+v9XsP9/09XFdvr/+v8s8vn/ven/96H/r/9ftv6/z/9ngytb/z/m/veFmaw8/4+veEsAAADgyuj8i6QOMff/VphJTf7+HwAAAOog5v7fDjOR/wEAAKAyYu7/nTCTmuR//f+N0v/3+f+Z/r/P/+94PPr/+v/drF//P77z6P/r/+v/R/r/+v/6/3QqW/8/5v7fDTOpSf4HAACAOoi5//1hJvI/AAAAbAjd/p/sTjH3Hwozkf8BAACgMmLuPxxmUpP8r/+v/6//X9L+/5/t+Jfvfuudh3fp/+v/6/+vyrp+/n/zxe/z//X/9f8T/X/9f/1/OpWt/x9z/5Ewk5rkfwAAAKiDmPt/L8xE/gcAAIDKiLn/aJiJ/A8AAACVEXP/TJhJTfK//r/+v/5/Sfv/G/jz/+P50P9vN7D+f3zT1f/vqujfp1V0Zfv/jyz2xPX/V9v/H+t6qf6//v9GPn79f/1/lipb/z/m/tkwk5rkfwAAAKiDkPuHjhVz8Qr5HwAAACoj5v7jYSbyPwAAAFRGzP0fCDOpSf7X/9f/1//X//f5/93336v/3xjx+f9llfr3P81fKPr/HcrT/+9O/1//fyMfv/6//j9Lla3/H3P/XJhJTfI/AAAA1EHM/R8MM5H/AQAAoDJi7v9QmIn8DwAAAJURc/+JMJOa5H/9f/1//X/9f/3/7vsv7ef/6//3tNb+vf5/oP9f7/7//+j/6//r/zMYZev/x9x/MsykJvkf+H/27qTJsjqt4/hJLaiswIULI1y4McKlL4GFrvUFuHDjxgjDBQ6oOFM4jygozorgPIAKgogKTj1Bd9N00zN0Nz3PAz3RdBPVUZnP82Rl5s1zc7h57zn//+ezqEfSSu5tojqLH8m3DwAA0IPc/TfFLfY/AAAANCN3/w/ELfY/AAAANCN3/w/GLZ3sf/3/Wfr/vUpZ/7///S/v//MVz7H//zb9/1Gvr//X/7dM/z9O/7/E4v7/+mEY+ur/Pf9f/6//Z0Wm1v/n7v+huKWT/Q8AAAA9yN3/w3GL/Q8AAADNyN1/c9xi/wMAAEAzcvf/SNzSyf4/0P9vDX32/5nxev6/5//r/4/q/3d+0P/r/6dvvf3/bVe/8un/j93/33/nspedaP/f4vP/r1/0wU3382e16fd/zP7/4lGfr/+nRVPr/3P3/2jc0sn+BwAAgB7k7v+xuMX+BwAAgGbk7r8lbrH/AQAAoBm5+388bulk/6/u+f+Xdj4+0/6/6P/1/zsf0P97/r/+f7Y8/39cT8//v/mZG2564eFveuQkr99R/7/Qpvv5ub9/z//X/3PY1Pr/3P0/Ebd0sv8BAACgB7n7fzJusf8BAACgGbn7fypusf8BAACgGbn7fzpu6WT/r67/n/Xz/4v+X/+/8wH9v/5f/z9b+v9xPfX/p3l9/b/+X/+v/2e1ptb/5+7/mbilk/0PAAAAPcjd/7Nxi/0PAAAAzcjdf2vcYv8DAABAM3L3X45bOtn/+v/z7/9f1v/r/+Pq//X/+v/zp/8fp/9fQv+v/9f/6/9Zqan1/7n7b4tbOtn/AAAA0IPc/T8Xt9j/AAAA0Izc/T8ft9j/AAAA0Izc/b8Qt3Sy//X/nv+v/9f/6/8Xv77+f570/+P0/0vo/8/az1+n/9f/6/+51gn7/5dGvmyvpP/P3f+LcUsn+x8AAAB6kLv/l+IW+x8AAACakbv/l+MW+x8AAACakbv/V+KWTva//l//r//X/5+6/z/8S2+H/n8x/f966P/HTab/37qw8MP6/9n3/57/r//X/7PP1J7/n7v/V+OWTvY/AAAA9CB3/6/FLSP7/8T/MB8AAADYqNz9vx63+P4/AAAAzF5WZ7n7fyNu6WT/6//1//p//b/n/y9+/bH+/5Fr3p/+f1r0/+Mm0/8fQf+v/5/z+9f/6/85bGr9f+7+34xbOtn/AAAA0IPc/bfHLfY/AAAANCN3/2/FLfY/AAAANCN3/2/HLZ3s/8X9/97/X/9/PPr//e9f/7/418eq+v/8M+r/R/v/b/f8/z7p/8etv/+/qP/f/+fX/5+jTb//xvv/S8s+X//PIlPr/3P33xG3dLL/AQAAoAe5+++MW+x/AAAAaEbu/t+JW+x/AAAAaEbu/t+NWzrZ/57/r//X/8+v//f8/12bfP7/sPb+/4L+/5j0/+M8/38J/b/+X//v+f+s1NT6/9z9d8Utnex/AAAA6MFdLw47u//3hsH+BwAAgDm69t8dOPgvlIbc/b8ft9j/AAAA0Izc/X8Qt3Sy//X/+n/9v/5f/7/49U/a/y97MLLn/6+H/n+c/n8J/f959PMXGuv/7z7q86fQ/9+q/2di9vX/j+19fFP9f+7+P4xbOtn/AAAA0IPc/X8Ut9j/AAAA0Izc/X8ct9j/AAAA0Izc/X8St3Sy/8+9/x8JYvX/+n/9v/6/pf5/Gf3/euj/x+n/l9D/e/6/5//r/1mpvf5//9fDTfX/ufv/NG7pZP8DAABAD3L3/1ncYv8DAABAM3L33x232P8AAADQjNz9fx63dLL/Pf9f/6//1//r/xe/vv5/nvT/4/T/S+j/9f/6f/0/K7Xv+f/X2FT/n7v/nrilk/0PAAAAPcjdf2/cYv8DAABAM3L3/0XcYv8DAABAM3L3/2Xc0sn+1/+fb/+fH9f/6/8H/b/+X/+/Ft32/1uLfic67Ij+/8nvu/yd+z+i/9f/6//1//p/VmAS/f+Vvb+7zN3/V3FLJ/sfAAAAepC7/6/jFvsfAAAAmpG7/2/iFvsfAAAAmpG7/2/jlhPu/69f6btaH/2/5//r//X/+v/Fr6//n6du+/9j8vz/JfT/+n/9v/6flZpE/3/NH+fu/7u4xff/AQAAoBm5+/8+brH/AQAAoBm5+/8hbrH/AQAAoBm5+/8xbulk/+v/9f/6f/2//n/x65+2/98eFtP/r4f+f5z+fwn9v/5f/6//Z6Wm1v/n7r8vbulk/wMAAEAPcvffH7fY/wAAANCM3P3/FLfY/wAAANCM3P3/HLd0sv/1//p//b/+X/+/+PU9/3+e9P/j9P/DMDww8gYW9f9XLur/9f/6f/0/pzS1/j93/7/ELZ3sfwAAAOhB7v4H4hb7HwAAAJqRu//BuMX+BwAAgGbk7v/XuKWT/a//1//r//X/+v/Fr6//nyf9/zj9/xKe/6//1//r/1mpqfX/ufsfils62f8AAADQg9z9D8ct9j8AAAA0I3f/v8Ut9j8AAAA0I3f/I3FLJ/tf/6//1//r/8+l/7+s/z9I/78e59f/D/p//b/+fwn9v/5f/89B6+r/X4qv98v6/9z9/x63dLL/AQAAoAe5+x+NW+x/AAAAaEbu/v+IW+x/AAAAaEbu/v+MWzrZ//p//b/+X//v+f+LX1//P0+e/z9O/7+E/l//f6L3/w37/kj/r//nsHX1/0f1/gf/OHf/f8Utnex/AAAA6EHu/sfiFvsfAAAAmpG7//G4xf4HAACAZuTu/++4pZP9r//X/+/v/4dB/6//1//vWkP/vz3o/1dO/z9O/7+E/r/N/v9rhoae/3/pyM/X/zNFU+v/c/f/T9zSyf4HAACAHuTu/9+4xf4HAACAZuTu/7+4xf4HAACAZuTu//+4paX9//LR6dv8+/+LBz5R/z8Mw7O3eP6//n/k9fX/k+n/66+q/n919P/j9P9L6P/b7P/X9P49/1//z2FT6/9z978ibmlp/wMAAEDncve/Mm6x/wEAAKAZuftfFbfY/wAAANCM3P2vjls62f/z7/8PfqL+fzjT8//1/zsf0P/r//X/s3XW/v6e7fg9Tf+v/z+y/7909Xe8bvv/rSP+vmfQ/+v/9f8sMLX+P3f/a+KWTvY/AAAA9CB3/xNxi/0PAAAAzcjd/2TcYv8DAABAM3L3vzZu6WT/6//1//r/efb/2/p//b/+f6GpPP//xhu/42n9f6v9v+f/H0X/r//X/3PQ1Pr/3P2vi1s62f8AAADQg9z9r49b7H8AAABoRu7+p+IW+x8AAACa8dROyLk9vGEYutz/h/v/64bdQnXXov4/GjX9/zX0//vfv/5/8a8Pz//X/+v/z99U+n/P/z/d+9f/6//n/P5P1P9/8+HP1//Toqn1/7n7n45bOtn/AAAA0IPc/W+MW+x/AAAAaEbu/jfFLfY/AAAANCN3/zNxSyf73/P/z7n/v07/r//X/9evS/2//n8N9P/j9P9L6P/P3s/nV1X9/3yf//+1+n9WZ2r9f+7+N8ctO8PvW77ulP8xAQAAgAnJ3f+WuKWT7/8DAABAD3L3vzVusf8BAACgGbn73xa3dLL/9f+e/6//1//r/xe/vv5/nvT/4/T/S/TT/28v+uCm+/mz2vT732D/v/PLwvP/maKp9f+5+98et3Sy/wEAAKBtL+78mLv/HXGL/Q8AAADNyN3/zrjF/gcAAIBm5O5/Nm7pZP/Psf+/pP/X/5+o//8e/f+B19f/6/9bpv/P39EX0/8v0U//v9Cm+/mVvf+r/yXoq//fof9niqbW/+fufy5u6WT/AwAAQA9y978rbrH/AQAAoBm5+98dt9j/AAAAMFMXD30kd/974pYm9v+FpT9jjv2/5/+fvv/fGnrs/z3/X/+v/+/JfPr/exf+Ju35//p//f9837/+X//PYVPr/3P3P791ocH9DwAAAO36rm/9/ueO+3Of3/lxe3hv3GL/AwAAQDNy978vbrH/AQAAoBm5+98ft3Sy//X/ffX/fT7/X/+v/9f/92Q+/f9i+n/9v/5/vu9f/6//57Cp9f+5+z8Qt1wz/Jb/r+gBAAAAa3X9yX567v4Pxi2dfP8fAAAAepC7/0Nxy6H9f+WY/1Y7AAAAMDW5+z8ct3Ty/X/9/8T7/+Gc+v/4efr/Xevu/7cO/Hz9/y79v/5/FfT/487Y/1/Z0v/r/0fo//X/+n8Omlr/n7v/0YeGLvc/AAAANGrfP1H4yM6P28NH45bj7v+D36gCAAAAJid3/8fiFt//BwAAgGbk7v943NLJ/tf/T7z/P9Xz/y/V/+X5/9Ps/9f2/P/btxe+vv5f/98y/f84z/9fQv+v/9f/6/9ZqRP0/zuD9Lz7/9z9n4hbOtn/AAAA0IPc/Z+MW+x/AAAAaEbu/k/FLfY/AAAANCN3/6fjlk72v/5/A/3/HReH4Vz7/2M8/1//30f/f8Trt9P/f+MNl5/47u998D79P3vW2f/nrwX9v/5f/79L/6//1/9z0NSe/5+7/zNxSyf7HwAAAHqQu/+FuMX+BwAAgGbk7v9s3HJ1/z++qXcFAAAArFLu/s/FLZ18/1//3+Lz/+fZ/+df6w30/5fn1/9nU9x7/+/5//r/wzz/f5z+fwn9v/5f/6//Z6Wm1v/n7v983NLJ/gcAAIAe5O7/QtyS+3/rxP/oHgAAAJiY3P1fjFt8/x8AAACakbv/xbilk/2v/9f/T6X/T57/v/d5nv+/S/+v/z8J/f84/f8S+n/9v/5f/89KTa3/z93/pbilk/0PAAAAPcjd/1LcYv8DAABAM3L3fzlusf8BAACgGbn7vxK3dLL/9f/6f/2//n/9/f/u11r9/95fVf3/6uj/x+n/l9D/6//1//p/Vmpq/X/u/q8GAAD//y+MZ1o=") creat(&(0x7f0000000000)='./file1\x00', 0x96) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1a5a438, &(0x7f00000028c0)=ANY=[@ANYRES32=0x0, @ANYRESHEX=0x0, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYBLOB="0d9435a8af712ba22db08aad61bf52901d77aded910bc7949acdf1a626f568d38938f8ec34f72c1e0b3e6540dc1e44beac32958b12631708d0a5635580b2f9fef13a977211e5d519ab9531321cfb53a9b413ea91f290924482d4007a70a19759dd63f9fc81f2c63fe27bce5e7dddf01fa5c3f09ef226ee04045b0cf0661e3d5a67446c4d93db12c2ac7a15f0265fd7eade1a72cbd696413a03174375c955f8c82a9774c2c8ac5046d59c86dbd5165e6e447586", @ANYBLOB="4c07f18b4a72a428cdf1fcc6a889d51c7d395bfc15396c272d41b4a79dba0739c1c7461ae19481932aa4c03054c8b2442a4c1e4311032bebb0cb70495acfcf1f08735df868c705", @ANYBLOB="37b57cfa7d0121345c29b6064f49a0f95b88671b8e9149556e5ff3c7012f7856b6557bae1d1d61efea623114a0b4b52f68387d2040dd08c5aa753b596ede3f3d637f96752310a389efcd8cf335ca9dbbbc10bda7a16342968c9ab4fd1ac65da604cd9b42d6d0dc0e895e0b2f42822d1b342f88a8d607008d20b22b776a70a07a2c53fc32be094c857279c58542b176bfbcc6c7e9808da687b44a8b21d23cc2f80050f8fd457f5a5595226d2008bcded226ab2e75d00ab5592daa23e809e04c2b370af460ae93b7efc32bf174830779058ad75290b9abb59be5f8859001e651c1d404a5f28eaf3781f2288249ae7b385a9c40929cae3fa5a6f142cd057ebdbc000000e34db2d14a6458499de0819d89f570a72fee0dd8cf744e0daf8f31b1d8edda87296ca7632e1e6e23", @ANYRES16, @ANYRES32, @ANYBLOB="ac2d5b5b8945d57e7869648ebe10b8d2719763b4bf3f6667bf8f722606d2b3593f26218e9a5fba2e7d4166787da71737b380045fb0a682e2915271f214c0112961b73c4638e7ba68deb34826d7682ace7549c83bf52bd9142b6c5adebf82155270d33204c09c07ed4ca2fc932af48646c9624e3e3544d68f61a2b073fb85332599b299a4f441a8e2f74c57aa38b5b596238280c1693bba97ff258679ab84485970b60f81093dda6501baba18a7790ca3e6fcfa12898b9fff3faf613d71f9d64dbd5c2edad8e774fb0da39e532d92164e2d34aff7cae32f3cd7aa9aace000f136323e4808d0c66c0828942def38deb2e1d847555fe0d5ba8084babb3169f9f06246ecd5327758448c9c7e4591da12ff1b084e757d05af4f0f0444ecfcc0c4d2067a98d49fe52412218380bb75e21cd23724e0390b116b9a1c1e3350b3e6f17c5bd1f1adb4ce1d03d5b30eb0690340708f06dfca5c9d74a7c140cabddd0f37d8bcf15e578dde85d7c28ccb1c9633ceeb54bb278d5a097220ca53a2ea4781aca2b70189199938afba9a700a610225311fe8316794ca0ae139a50dbd34d572d6165eaaa94844620045e615d51f5e19c29aadad3539490961135851f15bbfd0604f3926877583d85c45a04c6f155ad6e1966d2004ab6ab51f9beb82dbcdcaaab886564cbf81b581da397eba4fc8fe430ef93ed613cd588e399669b9f4b63481163e6c2b74112538192be9551ca400bc2b947a535fccbc567a68a3ab94554385bb1f2a0e2146310113102a9ffbcbbf44d30e076d363d6201faecf8bbbbc9d7fcd38195860bbc85ee3f5f9b2c990164abc3a7674ab2a631147d708585f52694a46b681cbc623b53a272f21f2aa5597beec8094954541316cc45ec9751fef12369e7272b7bdcb527bac4a19e0bba1b68ef98e3563705e9ca40bb914cece2fd75c2375b81a06dadcdb1c54a175855e30c3d9ca58ca873e43d703b1471526fb3dfe12e140b81df3afae6104e5ffa4e8585b456a7199c75c5abc7afeca743fce310df09062f20b9a99fac5d019338d98606805f4faad9cc81ebf03b7239a340c973828b676af4e594d796689f9823730c5ead8dba256925869ab0d7196a99b75a15f9927852d7813aa5a4cb76764749e882d59c094c5ebd1911153150e8d53aa8abbf360a4045b63e0e296d03158de8aa02b5aeb459dcdc6b9d5aa8c0e455e7cb6a5d9b26ee5420e41d89590a0c04ca8701a6a386716a32e04102f281f66317a21940c0cf83e128f4f83bdf6770170d74d43f3b1f4c0bb5e8c69254e0bfd15c6d02596bf3b547e5b9b8e84390455a9c4b00b633c661616aca4a4158868be21633f343155996eaff00c2c347fea03c6f06e7adcd83cf320e3a446d07dba202e5960632560da8a3b60efe5a814a5cb2a4ff0842fff23897b583b381e5030e506caef8dc97bef9532111e3eb3621870ec39fe2351d3814a02d2f9e38aac1f0897f32ddbffdc6e0acdea95ff7f67865daae1130f68f00985682ecefc43fb6f8521514923b5cf3560be0739aeb4eb00b389d39ebb9b974e054120fcd48c0d6bc09441c2c19f41bdfceed01a3b686921500fae88795f216794d21dd3a98f2fdb5a1590e0cbdc5cd9593b164e255131c21f22ed7e7ed4ec83db91f8bf5f327d7222be1e470a7c0d0a657c73ad606f2ef0c59d3c118c601d23d67ee16ce3658c9153b8131f06c1e4f83c49dbe6dbc3478b1313b9221bc4c5eadebfd16cd07afde509f2e926fcfd5f8feabe836f4080ea5e65c1e4d859f16ac45ad8c804eb9ecce363faf19c1409d8192a644823578ccfd5b643478eb948223676d375f811fffa874f7c2a281104a28baf4da2716ae870abb3e0f05e63466176356728a700fe39ebb62bdbff139fdbf21520022984dc6d3eed1d81b94f28a07cc238ccb64d65e87534c0111bb76212368c6e8e9a536e758fa2f16a2cab9d31984055488b27bcff12bcc5a0fe21a0e44edfb87c681060e6944ff89dce4a9c7122c53acc27913a5fbf15c9ada971df88f0df3f82eb563f63c640ad6e39a1f5c1aad83c364957ec6d645f4243d1fb4ecef275d4c0ca0284064cde0c282d793f290bab5a4dec15f3e2adcc9d455d2e28bd040d6e0f651ac6f20f55d1303d2aaef2104b393afc849e9cd7743ca20a6f092cbf42a67446892493128d38bb0d0f507ffe3fd718ec48eff58df729728bc01ee180d676dfa22c81da0e4e3fda94f4f94195bc82e1f941d8a290ca0d416373d420eba196470e4f25940506061c601f12b3656d6d6b3a47e50d5235b7fd0f82bb0835aee3470b69bf7e59616ece447d9af36c396f687214ff7d7e27961f461c780b4c563aeb47fa9f335cbdade8a06711ba79b6fe8778ac1bc06bb59131c17409c1d1d0cc746aec8c3b1348f9585945192d8e32002c676753ab246a92702fc8e3a3ce89b84661b1b10dcd73fddacd311ca663d483b87a59225f60627eecf409d6188236b198633d47c5f1c0ba0bb4321aac88a6061d5e97883914cd74284ab937b9579ccee6ab5bb39f6274a04e3e7a8c3d033e340357bc15c5f6daa047b1cee448ac380bbde4bf806b0891a04b9e408609b040b7d3a02d2a76d4013756d79244792c543fe2327a3c371852bed5ab54de987bc4699b32ad1c08f7fff7a23069e72bddc9a590b2c707bac3957d46b657a4e17f1914db58fb6436bdd58b86df491016a2b9ebe0c35a859b216f17f4828c8dee30a38ed1fc36347af978999d0c404313cf99c9281c45194abd79475a80ea1486840aad72b1c0c4f17fe35a150fcb574fa9fcc09a7fc5dcd34e15d4bf1bccfa8bf423d2437e2eb0d3ca9324fbfc7e256b862c50ebc8db3fb69f69003d37807af8ddccf2d929ad9d06ebbb7e538d93bb0b7bc828e1639e0b5e89c22badca307ad28183c3083e87c917feb4c882397d397ea2e7ff0e05ebb252940302cdc0f0f7efe40685f7c3e8923e3795d70471768464c4659f2c76d11713ab44f4c944a4819deb1248b02457403e9630aaf4a180e9e55bb4d291e9a2bc85a1ed17f906d54935c7e5e8b707ead56284fda0208bd88ab5c3259bd5329c0d26653eb07b6856ad799fd6fa8d2111da3970ff8509bc2ef3a8813d04f36001526b70757646ed4bf252aacec389195532bf7f335afae4351adb93c846e22f1f2a3e0d620d81688bd5530e389f2284b3c997d4abab7c30aac1b141425cd9aa315dc5a5e8b04fd503d79896b1494d8be48048c7392fc92c325b76bde4496c49da34c9ff95969bec8f95c356239d5336907957383b12c512fff6d797097a26a5aee9251bae940ef1a19b3f746396300d3baeb476b023f740ed7c1da92fdbf1834c3a882a6079885b933333d0e194cc1f25a06c3a2d370936886cb385d9861d6762c7416a1db5275228b6499cdef9767fb998d43251b963bc4477b2c051b70a0317de5f6ec3158914145bd036ff194df9722d2a3d2ac2397891b573a34ad16236cdc7ca77bc15f0fdbc3cae923d61633a42bab450a80cf3ee6580e792b1617d74fa189d450a64ca12d8c797698208ea61010b6072885b762af598159621f838ebacc00ea11f5924b39b2bbbc5c7d667871ce32e9aa75893a9fa13a2ffe66b360e266446259a8745addb4e186139d86d4e8d48537ac35029b0d87c03e8c1a9b9a422594496feda8bc5502777428fe737198ed896c2128a4f7d552f2eea8fef6e68feaf3cbfd549e622eea7bc988bb16fc49b7ab241426f2e40edcca07d4f947ccb1d3b8c2e9cb14a0c04495dbb75bd9c935f36bfe398455b0e5f927d5726e617c69ca81fe36c3e6ea510c5fe4735161c992f9ebf66727e5a7ded590061d4da3b86b996846a6bb102e47d33465d88a68644c8a76a770d5e0318e6c301e7c7f5575bf15a9589b32cfaa41ee15972488497195a2cb49a6b6f937a8e311e34d311dfd4fe222d3abc095b0b24a1b7193eb3353def0cc1511c8fce9b0a7867ae2fed4db93009646dc91a3745387cbe61b37f749b40d5d38970856b7ab8b6e1e0b81c078c68cb55c57854b8b5863b7a4c87f42e6d6dca2de0326b1b26970168c99f59816877448e7f72626f5354fdb5e033cd6b42e9476665efae66287e656590d1f80b3a09557a57d7de4bade6a122d40a92db1d347463b74151d44a02dbe067259c633b8c84425e77a736fca99f06d0fd66e35365511ec017537f4c212e7f2e23369958c3a7b92feffad9edb12139f1f690f9512725c0a1a164e78b4130c91fd3961df91c1a11783c24b03bcf305fd0e14e6510f4d58cf73326e94f2bc1b1ab295297bee7a98b77afe483a7d66e780d5e111b4202285f580ce571ecc0985501faa0e9f2f5b9848d770d8d8ad7b90a951f83279073e45a0c7abcf89cd6200f7fc320e46ea3de2addee3a984432501063f9928d0897d93dde20fe8fbe4dabc1ac34b0efdb3d7c7b4d49571ea64252d7209ff6d0ae5b95ef35d8160c5976f7ed9c4b69db81a73f6d00fd254c417696d6af694f3688826cc04db8019f2419fa99e47dc436fd76890b5291cd2724717a1e604e6cb5e214235664e8c7148c2bd87996c05bcfe1f29200f40a0d766df3ddc6faef82fb34d385f90b8f0e4bb7ba519e7986735c169cb3546d62fb70fbd49eec4edd70397d2fcbfdb9cd87331fce3c9786b7090501b904c8f925a1dbfa151a18e6c145ebb74da7100de60a627100d6c04ce789a7d4e88692cb090fd9ff2006e5ddb870f5b2aa502081eb7a26744de9a0d29a66ef18eb097e1d396561078e3f9258046a3a3e9b5878964d71b526755084f385d9777b2ab503f9d77c09a46004b5005f69eedee80edd87dd17f2292eba00f71dedb010b7b003a8400f6b44d63559a10bc0052c678ac8ed9658aff4f858778ebb60cbaf53d82248a260c7255f943711e8ac31a4b7a4694dcdace3be25ea43bdc9dfd52d369292d8d7581a6979d1b8ad543baeb9296907e0926025f4c3597e98e2eacd048a5dedd0e9dabc3268ed35a91c6180908af07a95bf374573c7b4f611eb30bbb5f1721a6550f483dcaed51d84fdaa5c6a52d7c4d04ca4edfd2884483c2d5aaebf6f06c6fff8bff813923ac8c6edd0eadefab938442ff09b1b3ff926c963d67a01cccbd86cb69bb5e5a4adca82110f87d3ee7800b14412b48cd94feacbaa9c1921e816d0287ad1198b94fd6de314912b79938a0d00ef5968ca4cb506afa1496ce4886c8c44955a92c9d2395f108a357e240511cc7e6548ac4174e5b52cc1f03ea8fa8268a7283e9cd25518cc71114869537891b64337222f04c111407bc2c8777f1132e1b294ec533610fd1ae3b4aa7e20c315d87aeed3a19151677e04173fbd55e88669f515dea19c8b99f8d7e829734f615a9b95e278fec62cf2d1a37d535ef71996530c62e65bb6fde625447e9122cfd947d7032c7580bfa5286bdde0bd9c4f0c63cbceddc302e1daef7f27bf289f72456802560e4477b27520b45f3a39e787824f169b3fa0ec7fba1c37f4499d43a9cdca7595f3e9ab74223c34819b260130d8a7613653101cc9a6e236ac01965356c90814c632ed421a62654a457ccc66040026451610b94898d13292cf2096fc1744b8fe67cebbcae0a3830be987694e593d732f05e3c6503a71173dc9870c3eca017318b628dd651232ea1c424a98b394188c8b8dbf30d69f1976219fd5b1975f8deebabeca970581f011f428c164bb35e0d6be187a5a2887d6bb0889c41c5c24d0b173f05db5d3a9e50318b448b3c8c00"/4083, @ANYRESDEC, @ANYRESHEX, @ANYRES16=0x0], 0xb, 0x0, &(0x7f0000000000)) 2.329044775s ago: executing program 3 (id=1046): r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x6e23, 0xfffffdff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg$inet6(r0, &(0x7f0000001840), 0x3b, 0x0) 2.197866101s ago: executing program 3 (id=1047): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0xb02, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000180)=0x1) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$nfc_llcp(r1, &(0x7f0000000140)={0x27, 0x0, 0xfbffffff, 0x5, 0x2, 0x0, "d32984bd1ca44c066af5160e961701a077609475b78411e89309de050000000000f2170e65e3f503270000000000001200000000001900", 0x3c}, 0x60) bind$nfc_llcp(0xffffffffffffffff, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) 1.117075515s ago: executing program 2 (id=1048): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x3c, r2, 0x1, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}]}, 0x3c}}, 0x0) 1.115939465s ago: executing program 3 (id=1049): syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp12500xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/tty/drivers\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x106f) r6 = socket$rds(0x15, 0x5, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) 994.157251ms ago: executing program 2 (id=1051): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000007a00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe81}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}}, 0x4000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x80040, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x1c) write$binfmt_misc(r7, &(0x7f0000000000), 0xd) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="01", 0xfffffe9c}], 0x1}}], 0x2, 0x0) 478.432596ms ago: executing program 1 (id=1052): syz_mount_image$ntfs3(&(0x7f0000000040), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='sparse,acl,nohidden,iocharset=cp1250= v4.3) to resolve. [ 195.850217][ T7155] XFS (loop2): Metadata CRC error detected at xfs_allocbt_read_verify+0x42/0xd0, xfs_cntbt block 0x8 [ 195.882365][ T7155] XFS (loop2): Unmount and run xfs_repair [ 195.888154][ T7155] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 195.940480][ T7155] 00000000: 41 42 33 43 00 00 00 03 ff ff ff ff ff ff ff ff AB3C............ [ 195.969916][ T7155] 00000010: 00 00 00 00 00 00 00 08 00 00 00 01 00 00 06 00 ................ [ 196.010288][ T7155] 00000020: 00 00 00 00 00 00 42 cb 9f 91 9c b7 20 0a 10 1d ......B..... ... [ 196.030214][ T7155] 00000030: 00 00 00 00 83 85 41 d8 00 00 00 07 00 00 00 01 ......A......... [ 196.073870][ T7155] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 196.161593][ T7155] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 196.430873][ T7155] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 196.589440][ T7155] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 196.648898][ T7155] XFS (loop2): metadata I/O error in "xfs_btree_read_buf_block+0x1df/0x2e0" at daddr 0x8 len 4 error 74 [ 196.696787][ T7194] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 196.718746][ T7155] XFS (loop2): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x519/0x8b0 (fs/xfs/xfs_trans_buf.c:296). Shutting down filesystem. [ 196.749282][ T7155] XFS (loop2): Please unmount the filesystem and rectify the problem(s) [ 196.893324][ T7176] loop4: detected capacity change from 0 to 32768 [ 196.962045][ T5086] Bluetooth: hci0: command 0x0406 tx timeout [ 196.968217][ T5086] Bluetooth: hci2: command 0x0406 tx timeout [ 196.974736][ T5086] Bluetooth: hci3: command 0x0406 tx timeout [ 197.220638][ T7176] XFS (loop4): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 197.762180][ T7176] XFS (loop4): Ending clean mount [ 197.782278][ T5774] XFS (loop2): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 197.873049][ T6013] XFS (loop4): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 200.198200][ T7241] netlink: 24 bytes leftover after parsing attributes in process `syz.4.288'. [ 200.938902][ T7228] loop1: detected capacity change from 0 to 32768 [ 200.979127][ T7228] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.286 (7228) [ 201.034722][ T7228] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 201.182405][ T7228] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 201.374558][ T7228] BTRFS info (device loop1): force clearing of disk cache [ 201.558781][ T7228] BTRFS info (device loop1): enabling auto defrag [ 201.704108][ T7228] BTRFS info (device loop1): max_inline at 0 [ 201.734461][ T7228] BTRFS info (device loop1): enabling disk space caching [ 201.780465][ T7228] BTRFS info (device loop1): disk space caching is enabled [ 202.117382][ T7228] BTRFS error (device loop1): open_ctree failed: -4 [ 202.986620][ T7251] loop3: detected capacity change from 0 to 32768 [ 203.061087][ T7282] IPVS: length: 24 != 24159191448 [ 203.320308][ T7251] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 204.131087][ T7251] XFS (loop3): Ending clean mount [ 204.230265][ T5769] Bluetooth: hci1: command tx timeout [ 204.238361][ T7299] syz.1.300 uses obsolete (PF_INET,SOCK_PACKET) [ 204.275330][ T5775] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 208.129499][ T5769] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 208.143310][ T5769] CPU: 1 PID: 5769 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 208.143347][ T5769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 208.143357][ T5769] Workqueue: hci1 hci_rx_work [ 208.143383][ T5769] Call Trace: [ 208.143391][ T5769] [ 208.143397][ T5769] dump_stack_lvl+0x18c/0x250 [ 208.143416][ T5769] ? show_regs_print_info+0x20/0x20 [ 208.143430][ T5769] ? load_image+0x400/0x400 [ 208.143450][ T5769] sysfs_create_dir_ns+0x26e/0x2a0 [ 208.143462][ T5769] ? sysfs_warn_dup+0xa0/0xa0 [ 208.143472][ T5769] ? do_raw_spin_unlock+0x121/0x230 [ 208.143487][ T5769] kobject_add_internal+0x61c/0xcc0 [ 208.143504][ T5769] kobject_add+0x164/0x240 [ 208.143514][ T5769] ? __rwlock_init+0x150/0x150 [ 208.143528][ T5769] ? kobject_init+0x1e0/0x1e0 [ 208.143539][ T5769] ? _raw_spin_unlock+0x28/0x40 [ 208.143560][ T5769] ? get_device_parent+0x366/0x390 [ 208.143576][ T5769] device_add+0x408/0xc20 [ 208.143591][ T5769] hci_conn_add_sysfs+0xd5/0x1e0 [ 208.143603][ T5769] le_conn_complete_evt+0xf5d/0x1540 [ 208.143618][ T5769] ? hci_event_packet+0x4cb/0x1270 [ 208.143634][ T5769] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 208.143650][ T5769] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 208.143666][ T5769] ? skb_pull_data+0xfb/0x200 [ 208.143679][ T5769] hci_le_conn_complete_evt+0x187/0x440 [ 208.143696][ T5769] ? hci_remote_host_features_evt+0x150/0x150 [ 208.143707][ T5769] hci_event_packet+0x7ba/0x1270 [ 208.143724][ T5769] ? bis_list+0x290/0x290 [ 208.143735][ T5769] ? lockdep_hardirqs_on+0x98/0x150 [ 208.143747][ T5769] ? hci_send_to_monitor+0xd7/0x4f0 [ 208.143758][ T5769] hci_rx_work+0x43a/0xd60 [ 208.143777][ T5769] ? process_scheduled_works+0x96f/0x15d0 [ 208.143789][ T5769] process_scheduled_works+0xa5d/0x15d0 [ 208.143819][ T5769] ? worker_attach_to_pool+0x380/0x380 [ 208.143833][ T5769] ? assign_work+0x3d2/0x5d0 [ 208.143848][ T5769] worker_thread+0xa55/0xfc0 [ 208.143860][ T5769] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 208.143871][ T5769] ? _raw_spin_unlock+0x40/0x40 [ 208.143880][ T5769] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 208.143901][ T5769] kthread+0x2fa/0x390 [ 208.143909][ T5769] ? pr_cont_work+0x560/0x560 [ 208.143921][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 208.143930][ T5769] ret_from_fork+0x48/0x80 [ 208.143941][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 208.143950][ T5769] ret_from_fork_asm+0x11/0x20 [ 208.143971][ T5769] [ 208.143991][ T5769] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 208.144014][ T5769] Bluetooth: hci1: failed to register connection device [ 210.006594][ T7339] IPVS: length: 24 != 24159191448 [ 210.150306][ T51] Bluetooth: hci1: command tx timeout [ 210.300883][ T7325] tty tty1: ldisc open failed (-12), clearing slot 0 [ 213.335286][ T7360] loop2: detected capacity change from 0 to 32768 [ 213.501270][ T7360] XFS (loop2): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 214.004467][ T7360] XFS (loop2): Ending clean mount [ 214.960311][ T23] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 215.127107][ T5774] XFS (loop2): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 215.364362][ T23] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 215.364445][ T23] usb 5-1: config 2 has no interface number 0 [ 215.372898][ T23] usb 5-1: config 2 interface 88 altsetting 7 endpoint 0x6 has invalid maxpacket 256, setting to 64 [ 215.373089][ T23] usb 5-1: config 2 interface 88 altsetting 7 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 215.373293][ T23] usb 5-1: config 2 interface 88 has no altsetting 0 [ 215.648589][ T23] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 215.962325][ T23] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.971907][ T23] usb 5-1: Product: syz [ 215.976511][ T23] usb 5-1: Manufacturer: syz [ 215.981841][ T23] usb 5-1: SerialNumber: syz [ 215.989806][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 215.999191][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 216.084965][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 216.215716][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 216.254476][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 216.367678][ T7409] IPVS: length: 24 != 24159191448 [ 217.350735][ T23] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 217.364482][ T23] asix: probe of 5-1:2.88 failed with error -71 [ 217.375791][ T23] usb 5-1: USB disconnect, device number 3 [ 217.684737][ T7421] netlink: 168 bytes leftover after parsing attributes in process `syz.1.328'. [ 218.527960][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 218.540005][ T51] CPU: 0 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 218.548301][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 218.560491][ T51] Workqueue: hci0 hci_rx_work [ 218.566270][ T51] Call Trace: [ 218.570534][ T51] [ 218.574284][ T51] dump_stack_lvl+0x18c/0x250 [ 218.579950][ T51] ? show_regs_print_info+0x20/0x20 [ 218.585264][ T51] ? load_image+0x400/0x400 [ 218.589894][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 218.595093][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 218.599846][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 218.605309][ T51] kobject_add_internal+0x61c/0xcc0 [ 218.610814][ T51] kobject_add+0x164/0x240 [ 218.615442][ T51] ? __rwlock_init+0x150/0x150 [ 218.620395][ T51] ? kobject_init+0x1e0/0x1e0 [ 218.625195][ T51] ? _raw_spin_unlock+0x28/0x40 [ 218.630080][ T51] ? get_device_parent+0x366/0x390 [ 218.635249][ T51] device_add+0x408/0xc20 [ 218.639779][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 218.645015][ T51] le_conn_complete_evt+0xf5d/0x1540 [ 218.652010][ T51] ? hci_event_packet+0x4cb/0x1270 [ 218.657861][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 218.664475][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 218.670262][ T51] ? skb_pull_data+0xfb/0x200 [ 218.675046][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 218.680700][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 218.686859][ T51] hci_event_packet+0x7ba/0x1270 [ 218.692349][ T51] ? bis_list+0x290/0x290 [ 218.696778][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 218.702234][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 218.707823][ T51] hci_rx_work+0x43a/0xd60 [ 218.712728][ T51] ? process_scheduled_works+0x96f/0x15d0 [ 218.718794][ T51] process_scheduled_works+0xa5d/0x15d0 [ 218.724831][ T51] ? worker_attach_to_pool+0x380/0x380 [ 218.730755][ T51] ? assign_work+0x3d2/0x5d0 [ 218.735540][ T51] worker_thread+0xa55/0xfc0 [ 218.741465][ T51] kthread+0x2fa/0x390 [ 218.746180][ T51] ? pr_cont_work+0x560/0x560 [ 218.752282][ T51] ? kthread_blkcg+0xd0/0xd0 [ 218.757454][ T51] ret_from_fork+0x48/0x80 [ 218.762098][ T51] ? kthread_blkcg+0xd0/0xd0 [ 218.767338][ T51] ret_from_fork_asm+0x11/0x20 [ 218.772220][ T51] [ 218.779758][ T51] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 218.794575][ T51] Bluetooth: hci0: failed to register connection device [ 220.892034][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 222.952445][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 224.018828][ T7465] netlink: 'syz.1.341': attribute type 3 has an invalid length. [ 224.131324][ T788] IPVS: starting estimator thread 0... [ 224.149163][ T7467] IPVS: set_ctl: invalid protocol: 227 172.20.20.187:20000 [ 224.260511][ T7469] IPVS: using max 24 ests per chain, 57600 per kthread [ 224.335049][ T5769] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 224.346335][ T5769] CPU: 0 PID: 5769 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 224.354286][ T5769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 224.364650][ T5769] Workqueue: hci3 hci_rx_work [ 224.369343][ T5769] Call Trace: [ 224.372776][ T5769] [ 224.375725][ T5769] dump_stack_lvl+0x18c/0x250 [ 224.380492][ T5769] ? show_regs_print_info+0x20/0x20 [ 224.385687][ T5769] ? load_image+0x400/0x400 [ 224.390287][ T5769] sysfs_create_dir_ns+0x26e/0x2a0 [ 224.395505][ T5769] ? sysfs_warn_dup+0xa0/0xa0 [ 224.400438][ T5769] ? do_raw_spin_unlock+0x121/0x230 [ 224.405661][ T5769] kobject_add_internal+0x61c/0xcc0 [ 224.411131][ T5769] kobject_add+0x164/0x240 [ 224.415743][ T5769] ? __rwlock_init+0x150/0x150 [ 224.420851][ T5769] ? kobject_init+0x1e0/0x1e0 [ 224.426583][ T5769] ? _raw_spin_unlock+0x28/0x40 [ 224.431551][ T5769] ? get_device_parent+0x366/0x390 [ 224.436778][ T5769] device_add+0x408/0xc20 [ 224.441477][ T5769] hci_conn_add_sysfs+0xd5/0x1e0 [ 224.446599][ T5769] le_conn_complete_evt+0xf5d/0x1540 [ 224.451911][ T5769] ? hci_event_packet+0x4cb/0x1270 [ 224.457049][ T5769] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 224.463334][ T5769] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 224.469174][ T5769] ? skb_pull_data+0xfb/0x200 [ 224.474243][ T5769] hci_le_conn_complete_evt+0x187/0x440 [ 224.479913][ T5769] ? hci_remote_host_features_evt+0x150/0x150 [ 224.486255][ T5769] hci_event_packet+0x7ba/0x1270 [ 224.491386][ T5769] ? bis_list+0x290/0x290 [ 224.495820][ T5769] ? lockdep_hardirqs_on+0x98/0x150 [ 224.501207][ T5769] ? hci_send_to_monitor+0xd7/0x4f0 [ 224.506427][ T5769] hci_rx_work+0x43a/0xd60 [ 224.511032][ T5769] ? process_scheduled_works+0x96f/0x15d0 [ 224.517116][ T5769] process_scheduled_works+0xa5d/0x15d0 [ 224.522799][ T5769] ? worker_attach_to_pool+0x380/0x380 [ 224.528295][ T5769] ? assign_work+0x3d2/0x5d0 [ 224.532905][ T5769] worker_thread+0xa55/0xfc0 [ 224.537511][ T5769] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 224.543500][ T5769] ? _raw_spin_unlock+0x40/0x40 [ 224.548360][ T5769] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 224.554415][ T5769] kthread+0x2fa/0x390 [ 224.558570][ T5769] ? pr_cont_work+0x560/0x560 [ 224.563254][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 224.568010][ T5769] ret_from_fork+0x48/0x80 [ 224.572445][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 224.577064][ T5769] ret_from_fork_asm+0x11/0x20 [ 224.581940][ T5769] [ 224.606063][ T5769] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 224.623319][ T5769] Bluetooth: hci3: failed to register connection device [ 226.889275][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 227.078971][ T7487] loop1: detected capacity change from 0 to 32768 [ 227.181214][ T7487] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 227.303522][ T7487] XFS (loop1): Ending clean mount [ 228.059898][ T7523] ptrace attach of "./syz-executor exec"[5774] was attempted by "./syz-executor exec"[7523] [ 228.111497][ T5767] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 228.817898][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 228.829916][ T51] CPU: 0 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 228.838653][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 228.849018][ T51] Workqueue: hci2 hci_rx_work [ 228.853981][ T51] Call Trace: [ 228.857383][ T51] [ 228.860602][ T51] dump_stack_lvl+0x18c/0x250 [ 228.865826][ T51] ? show_regs_print_info+0x20/0x20 [ 228.871066][ T51] ? load_image+0x400/0x400 [ 228.875706][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 228.880951][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 228.885665][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 228.891132][ T51] kobject_add_internal+0x61c/0xcc0 [ 228.896538][ T51] kobject_add+0x164/0x240 [ 228.901043][ T51] ? __rwlock_init+0x150/0x150 [ 228.905988][ T51] ? kobject_init+0x1e0/0x1e0 [ 228.910782][ T51] ? _raw_spin_unlock+0x28/0x40 [ 228.915641][ T51] ? get_device_parent+0x366/0x390 [ 228.920852][ T51] device_add+0x408/0xc20 [ 228.925198][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 228.930252][ T51] le_conn_complete_evt+0xf5d/0x1540 [ 228.935581][ T51] ? hci_event_packet+0x4cb/0x1270 [ 228.940729][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 228.947157][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 228.952835][ T51] ? skb_pull_data+0xfb/0x200 [ 228.957671][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 228.963260][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 228.969430][ T51] hci_event_packet+0x7ba/0x1270 [ 228.974377][ T51] ? bis_list+0x290/0x290 [ 228.978737][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 228.984033][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 228.989330][ T51] hci_rx_work+0x43a/0xd60 [ 228.993848][ T51] ? process_scheduled_works+0x96f/0x15d0 [ 228.999653][ T51] process_scheduled_works+0xa5d/0x15d0 [ 229.005248][ T51] ? worker_attach_to_pool+0x380/0x380 [ 229.010804][ T51] ? assign_work+0x3d2/0x5d0 [ 229.015481][ T51] worker_thread+0xa55/0xfc0 [ 229.020090][ T51] kthread+0x2fa/0x390 [ 229.024168][ T51] ? pr_cont_work+0x560/0x560 [ 229.028856][ T51] ? kthread_blkcg+0xd0/0xd0 [ 229.033447][ T51] ret_from_fork+0x48/0x80 [ 229.037950][ T51] ? kthread_blkcg+0xd0/0xd0 [ 229.042831][ T51] ret_from_fork_asm+0x11/0x20 [ 229.047680][ T51] [ 229.056017][ T51] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 229.085612][ T51] Bluetooth: hci2: failed to register connection device [ 231.128220][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 231.215190][ T7559] loop1: detected capacity change from 0 to 512 [ 231.231839][ T7559] EXT4-fs: Ignoring removed orlov option [ 231.249188][ T7559] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 231.330964][ T7561] netlink: 24 bytes leftover after parsing attributes in process `syz.4.365'. [ 231.615121][ T7559] EXT4-fs (loop1): 1 truncate cleaned up [ 231.737765][ T7559] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 232.035076][ T7550] loop2: detected capacity change from 0 to 32768 [ 232.121284][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.158505][ T7550] JBD2: Ignoring recovery information on journal [ 232.376108][ T7570] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[7570] [ 232.419954][ T7550] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 232.878105][ T27] audit: type=1800 audit(1773870880.256:2): pid=7550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.362" name="file1" dev="loop2" ino=17058 res=0 errno=0 [ 232.934478][ T7555] loop3: detected capacity change from 0 to 32768 [ 233.016464][ T7555] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 233.245465][ T7555] XFS (loop3): Ending clean mount [ 233.481479][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 233.491595][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 233.499149][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 233.509222][ T51] Workqueue: hci1 hci_rx_work [ 233.513912][ T51] Call Trace: [ 233.517212][ T51] [ 233.520141][ T51] dump_stack_lvl+0x18c/0x250 [ 233.524928][ T51] ? show_regs_print_info+0x20/0x20 [ 233.530133][ T51] ? load_image+0x400/0x400 [ 233.534654][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 233.539792][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 233.544929][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 233.550198][ T51] kobject_add_internal+0x61c/0xcc0 [ 233.555423][ T51] kobject_add+0x164/0x240 [ 233.559847][ T51] ? __rwlock_init+0x150/0x150 [ 233.564623][ T51] ? kobject_init+0x1e0/0x1e0 [ 233.569487][ T51] ? _raw_spin_unlock+0x28/0x40 [ 233.574718][ T51] ? get_device_parent+0x366/0x390 [ 233.579926][ T51] device_add+0x408/0xc20 [ 233.584301][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 233.589353][ T51] le_conn_complete_evt+0xf5d/0x1540 [ 233.594687][ T51] ? hci_event_packet+0x4cb/0x1270 [ 233.599982][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 233.606342][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 233.612000][ T51] ? skb_pull_data+0xfb/0x200 [ 233.616741][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 233.622294][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 233.628449][ T51] hci_event_packet+0x7ba/0x1270 [ 233.633407][ T51] ? bis_list+0x290/0x290 [ 233.637746][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 233.643070][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 233.648535][ T51] hci_rx_work+0x43a/0xd60 [ 233.653182][ T51] ? process_scheduled_works+0x96f/0x15d0 [ 233.659168][ T51] process_scheduled_works+0xa5d/0x15d0 [ 233.664735][ T51] ? worker_attach_to_pool+0x380/0x380 [ 233.670301][ T51] ? assign_work+0x3d2/0x5d0 [ 233.675006][ T51] worker_thread+0xa55/0xfc0 [ 233.679869][ T51] kthread+0x2fa/0x390 [ 233.684016][ T51] ? pr_cont_work+0x560/0x560 [ 233.688703][ T51] ? kthread_blkcg+0xd0/0xd0 [ 233.693388][ T51] ret_from_fork+0x48/0x80 [ 233.697895][ T51] ? kthread_blkcg+0xd0/0xd0 [ 233.702571][ T51] ret_from_fork_asm+0x11/0x20 [ 233.707428][ T51] [ 233.790566][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 233.805203][ T51] Bluetooth: hci1: failed to register connection device [ 233.839042][ T5775] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 234.449975][ T7550] syz.2.362 (7550) used greatest stack depth: 19472 bytes left [ 234.620235][ T5774] OCFS2: ERROR (device loop2): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #33 has bad signature [ 234.664326][ T5774] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 234.675112][ T5774] OCFS2: File system is now read-only. [ 234.686865][ T5774] (syz-executor,5774,1):_ocfs2_free_suballoc_bits:2489 ERROR: status = -30 [ 234.818976][ T5774] (syz-executor,5774,1):_ocfs2_free_clusters:2583 ERROR: status = -30 [ 234.841680][ T5774] (syz-executor,5774,1):ocfs2_sync_local_to_main:1001 ERROR: status = -30 [ 234.920985][ T7609] netlink: 24 bytes leftover after parsing attributes in process `syz.3.375'. [ 235.534202][ T5774] (syz-executor,5774,0):ocfs2_sync_local_to_main:1013 ERROR: status = -30 [ 235.545371][ T5774] (syz-executor,5774,0):ocfs2_shutdown_local_alloc:449 ERROR: status = -30 [ 235.673614][ T5774] ocfs2: Unmounting device (7,2) on (node local) [ 235.832160][ T5769] Bluetooth: hci1: command 0x0406 tx timeout [ 236.610833][ T7621] Cannot find add_set index 0 as target [ 237.690146][ T5769] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 237.699878][ T5769] CPU: 1 PID: 5769 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 237.707973][ T5769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 237.718233][ T5769] Workqueue: hci2 hci_rx_work [ 237.722937][ T5769] Call Trace: [ 237.726324][ T5769] [ 237.729710][ T5769] dump_stack_lvl+0x18c/0x250 [ 237.734459][ T5769] ? show_regs_print_info+0x20/0x20 [ 237.739661][ T5769] ? load_image+0x400/0x400 [ 237.744291][ T5769] sysfs_create_dir_ns+0x26e/0x2a0 [ 237.749515][ T5769] ? sysfs_warn_dup+0xa0/0xa0 [ 237.754299][ T5769] ? do_raw_spin_unlock+0x121/0x230 [ 237.759793][ T5769] kobject_add_internal+0x61c/0xcc0 [ 237.765187][ T5769] kobject_add+0x164/0x240 [ 237.769771][ T5769] ? __rwlock_init+0x150/0x150 [ 237.774749][ T5769] ? kobject_init+0x1e0/0x1e0 [ 237.779657][ T5769] ? _raw_spin_unlock+0x28/0x40 [ 237.784818][ T5769] ? get_device_parent+0x366/0x390 [ 237.790129][ T5769] device_add+0x408/0xc20 [ 237.794553][ T5769] hci_conn_add_sysfs+0xd5/0x1e0 [ 237.799495][ T5769] le_conn_complete_evt+0xf5d/0x1540 [ 237.804810][ T5769] ? hci_event_packet+0x4cb/0x1270 [ 237.810052][ T5769] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 237.816948][ T5769] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 237.823147][ T5769] ? skb_pull_data+0xfb/0x200 [ 237.828376][ T5769] hci_le_conn_complete_evt+0x187/0x440 [ 237.834322][ T5769] ? hci_remote_host_features_evt+0x150/0x150 [ 237.840594][ T5769] hci_event_packet+0x7ba/0x1270 [ 237.845926][ T5769] ? bis_list+0x290/0x290 [ 237.850573][ T5769] ? lockdep_hardirqs_on+0x98/0x150 [ 237.855907][ T5769] ? hci_send_to_monitor+0xd7/0x4f0 [ 237.861404][ T5769] hci_rx_work+0x43a/0xd60 [ 237.866827][ T5769] ? process_scheduled_works+0x96f/0x15d0 [ 237.873014][ T5769] process_scheduled_works+0xa5d/0x15d0 [ 237.878688][ T5769] ? worker_attach_to_pool+0x380/0x380 [ 237.884449][ T5769] ? assign_work+0x3d2/0x5d0 [ 237.889867][ T5769] worker_thread+0xa55/0xfc0 [ 237.895003][ T5769] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 237.901163][ T5769] ? _raw_spin_unlock+0x40/0x40 [ 237.906010][ T5769] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 237.912158][ T5769] kthread+0x2fa/0x390 [ 237.916414][ T5769] ? pr_cont_work+0x560/0x560 [ 237.921209][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 237.925978][ T5769] ret_from_fork+0x48/0x80 [ 237.930484][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 237.935282][ T5769] ret_from_fork_asm+0x11/0x20 [ 237.940439][ T5769] [ 237.947594][ T5769] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 237.962063][ T5769] Bluetooth: hci2: failed to register connection device [ 239.189394][ T7630] loop4: detected capacity change from 0 to 32768 [ 239.568747][ T7630] XFS (loop4): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 239.645824][ T7653] netlink: 24 bytes leftover after parsing attributes in process `syz.3.384'. [ 240.011696][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 240.412242][ T7665] capability: warning: `syz.1.386' uses 32-bit capabilities (legacy support in use) [ 240.455444][ T7630] XFS (loop4): Ending clean mount [ 241.251138][ T6013] XFS (loop4): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 241.531067][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 241.549813][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 241.557337][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 241.567601][ T51] Workqueue: hci3 hci_rx_work [ 241.572332][ T51] Call Trace: [ 241.575629][ T51] [ 241.578709][ T51] dump_stack_lvl+0x18c/0x250 [ 241.583659][ T51] ? show_regs_print_info+0x20/0x20 [ 241.589044][ T51] ? load_image+0x400/0x400 [ 241.593568][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 241.598864][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 241.603629][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 241.609030][ T51] kobject_add_internal+0x61c/0xcc0 [ 241.614264][ T51] kobject_add+0x164/0x240 [ 241.618711][ T51] ? __rwlock_init+0x150/0x150 [ 241.623857][ T51] ? kobject_init+0x1e0/0x1e0 [ 241.628639][ T51] ? _raw_spin_unlock+0x28/0x40 [ 241.633502][ T51] ? get_device_parent+0x366/0x390 [ 241.638624][ T51] device_add+0x408/0xc20 [ 241.643076][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 241.648661][ T51] le_conn_complete_evt+0xf5d/0x1540 [ 241.654895][ T51] ? hci_event_packet+0x4cb/0x1270 [ 241.660728][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 241.668738][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 241.675517][ T51] ? skb_pull_data+0xfb/0x200 [ 241.681096][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 241.686954][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 241.694095][ T51] hci_event_packet+0x7ba/0x1270 [ 241.699795][ T51] ? bis_list+0x290/0x290 [ 241.704426][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 241.710392][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 241.715902][ T51] hci_rx_work+0x43a/0xd60 [ 241.720691][ T51] ? process_scheduled_works+0x96f/0x15d0 [ 241.726422][ T51] process_scheduled_works+0xa5d/0x15d0 [ 241.732099][ T51] ? worker_attach_to_pool+0x380/0x380 [ 241.737742][ T51] ? assign_work+0x3d2/0x5d0 [ 241.742431][ T51] worker_thread+0xa55/0xfc0 [ 241.747116][ T51] kthread+0x2fa/0x390 [ 241.751219][ T51] ? pr_cont_work+0x560/0x560 [ 241.755914][ T51] ? kthread_blkcg+0xd0/0xd0 [ 241.760502][ T51] ret_from_fork+0x48/0x80 [ 241.764929][ T51] ? kthread_blkcg+0xd0/0xd0 [ 241.769535][ T51] ret_from_fork_asm+0x11/0x20 [ 241.774574][ T51] [ 241.820295][ T51] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 241.847327][ T51] Bluetooth: hci3: failed to register connection device [ 242.754164][ T7693] fuse: Bad value for 'fd' [ 243.664224][ T7698] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[7698] [ 243.910225][ T5769] Bluetooth: hci3: command 0x0406 tx timeout [ 244.108655][ T7700] netlink: 12 bytes leftover after parsing attributes in process `syz.4.391'. [ 244.130480][ T7700] bridge_slave_0: default FDB implementation only supports local addresses [ 244.969270][ T7711] vivid-000: ================= START STATUS ================= [ 244.978974][ T7711] vivid-000: Generate PTS: true [ 244.984433][ T7711] vivid-000: Generate SCR: true [ 244.989475][ T7711] tpg source WxH: 640x360 (Y'CbCr) [ 244.994745][ T7711] tpg field: 1 [ 244.998686][ T7711] tpg crop: 640x360@0x0 [ 245.003268][ T7711] tpg compose: 640x360@0x0 [ 245.007821][ T7711] tpg colorspace: 8 [ 245.011819][ T7711] tpg transfer function: 0/0 [ 245.016627][ T7711] tpg Y'CbCr encoding: 0/0 [ 245.021123][ T7711] tpg quantization: 0/0 [ 245.025406][ T7711] tpg RGB range: 0/2 [ 245.029522][ T7711] vivid-000: ================== END STATUS ================== [ 245.682497][ T7702] loop2: detected capacity change from 0 to 32768 [ 245.705599][ T7702] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 245.716676][ T7705] loop4: detected capacity change from 0 to 32768 [ 245.725418][ T7702] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 245.767364][ T7705] XFS (loop4): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 245.828427][ T7702] gfs2: fsid=syz:syz.0: journal 0 mapped with 1 extents in 0ms [ 245.865180][ T787] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 245.880610][ T787] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 245.920418][ T7705] XFS (loop4): Ending clean mount [ 245.952742][ T787] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 72ms [ 245.975746][ T787] gfs2: fsid=syz:syz.0: jid=0: Done [ 245.983253][ T7702] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 246.046206][ T7713] netlink: 'syz.1.402': attribute type 3 has an invalid length. [ 246.912644][ T6013] XFS (loop4): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 246.942469][ T5769] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 246.952894][ T5769] CPU: 1 PID: 5769 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 246.960564][ T5769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 246.970734][ T5769] Workqueue: hci0 hci_rx_work [ 246.975774][ T5769] Call Trace: [ 246.979080][ T5769] [ 246.982119][ T5769] dump_stack_lvl+0x18c/0x250 [ 246.986920][ T5769] ? show_regs_print_info+0x20/0x20 [ 246.992274][ T5769] ? load_image+0x400/0x400 [ 246.996912][ T5769] sysfs_create_dir_ns+0x26e/0x2a0 [ 247.002056][ T5769] ? sysfs_warn_dup+0xa0/0xa0 [ 247.006769][ T5769] ? do_raw_spin_unlock+0x121/0x230 [ 247.012122][ T5769] kobject_add_internal+0x61c/0xcc0 [ 247.017797][ T5769] kobject_add+0x164/0x240 [ 247.022336][ T5769] ? __rwlock_init+0x150/0x150 [ 247.027146][ T5769] ? kobject_init+0x1e0/0x1e0 [ 247.031854][ T5769] ? _raw_spin_unlock+0x28/0x40 [ 247.036737][ T5769] ? get_device_parent+0x366/0x390 [ 247.041897][ T5769] device_add+0x408/0xc20 [ 247.046286][ T5769] hci_conn_add_sysfs+0xd5/0x1e0 [ 247.051355][ T5769] le_conn_complete_evt+0xf5d/0x1540 [ 247.056767][ T5769] ? hci_event_packet+0x4cb/0x1270 [ 247.061920][ T5769] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 247.068379][ T5769] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 247.074137][ T5769] ? skb_pull_data+0xfb/0x200 [ 247.078841][ T5769] hci_le_conn_complete_evt+0x187/0x440 [ 247.084425][ T5769] ? hci_remote_host_features_evt+0x150/0x150 [ 247.090708][ T5769] hci_event_packet+0x7ba/0x1270 [ 247.095688][ T5769] ? bis_list+0x290/0x290 [ 247.100312][ T5769] ? lockdep_hardirqs_on+0x98/0x150 [ 247.105692][ T5769] ? hci_send_to_monitor+0xd7/0x4f0 [ 247.111019][ T5769] hci_rx_work+0x43a/0xd60 [ 247.115476][ T5769] ? process_scheduled_works+0x96f/0x15d0 [ 247.121218][ T5769] process_scheduled_works+0xa5d/0x15d0 [ 247.126784][ T5769] ? worker_attach_to_pool+0x380/0x380 [ 247.132335][ T5769] ? assign_work+0x3d2/0x5d0 [ 247.136957][ T5769] worker_thread+0xa55/0xfc0 [ 247.141541][ T5769] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 247.147436][ T5769] ? _raw_spin_unlock+0x40/0x40 [ 247.152341][ T5769] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 247.158442][ T5769] kthread+0x2fa/0x390 [ 247.162541][ T5769] ? pr_cont_work+0x560/0x560 [ 247.167525][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 247.172197][ T5769] ret_from_fork+0x48/0x80 [ 247.177169][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 247.181760][ T5769] ret_from_fork_asm+0x11/0x20 [ 247.186532][ T5769] [ 247.193477][ T5769] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 247.208474][ T5769] Bluetooth: hci0: failed to register connection device [ 247.542430][ T7745] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[7745] [ 248.917111][ T7759] netlink: 'syz.4.413': attribute type 3 has an invalid length. [ 248.980195][ T788] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 249.144406][ T7764] loop2: detected capacity change from 0 to 256 [ 249.198472][ T788] usb 4-1: Using ep0 maxpacket: 32 [ 249.214335][ T788] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 249.242853][ T788] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 249.297019][ T788] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 249.346576][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 249.365743][ T7764] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xf3da6b1f, utbl_chksum : 0xe619d30d) [ 249.379677][ T788] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 249.390813][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 249.402183][ T788] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 249.413281][ T788] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 249.427339][ T788] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 249.457077][ T7766] netlink: 24 bytes leftover after parsing attributes in process `syz.4.414'. [ 249.722524][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.837836][ T7764] process 'syz.2.412' launched './file1' with NULL argv: empty string added [ 249.947935][ T788] usb 4-1: config 0 descriptor?? [ 250.262023][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 250.272037][ T51] CPU: 0 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 250.279507][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 250.289571][ T51] Workqueue: hci3 hci_rx_work [ 250.294251][ T51] Call Trace: [ 250.297541][ T51] [ 250.300461][ T51] dump_stack_lvl+0x18c/0x250 [ 250.305343][ T51] ? show_regs_print_info+0x20/0x20 [ 250.310544][ T51] ? load_image+0x400/0x400 [ 250.315073][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 250.320370][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 250.325187][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 250.330493][ T51] kobject_add_internal+0x61c/0xcc0 [ 250.330691][ T7757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.335714][ T51] kobject_add+0x164/0x240 [ 250.335776][ T51] ? __rwlock_init+0x150/0x150 [ 250.354098][ T51] ? kobject_init+0x1e0/0x1e0 [ 250.359039][ T51] ? _raw_spin_unlock+0x28/0x40 [ 250.363918][ T51] ? get_device_parent+0x366/0x390 [ 250.369331][ T51] device_add+0x408/0xc20 [ 250.373695][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 250.378812][ T51] le_conn_complete_evt+0xf5d/0x1540 [ 250.384190][ T51] ? hci_event_packet+0x4cb/0x1270 [ 250.389575][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 250.395991][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 250.401916][ T51] ? skb_pull_data+0xfb/0x200 [ 250.406783][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 250.412456][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 250.418636][ T51] hci_event_packet+0x7ba/0x1270 [ 250.423925][ T51] ? bis_list+0x290/0x290 [ 250.428338][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 250.433750][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 250.438947][ T51] hci_rx_work+0x43a/0xd60 [ 250.443627][ T51] ? process_scheduled_works+0x96f/0x15d0 [ 250.449464][ T51] process_scheduled_works+0xa5d/0x15d0 [ 250.455199][ T51] ? worker_attach_to_pool+0x380/0x380 [ 250.460843][ T51] ? assign_work+0x3d2/0x5d0 [ 250.465543][ T51] worker_thread+0xa55/0xfc0 [ 250.470278][ T51] kthread+0x2fa/0x390 [ 250.474344][ T51] ? pr_cont_work+0x560/0x560 [ 250.479390][ T51] ? kthread_blkcg+0xd0/0xd0 [ 250.484091][ T51] ret_from_fork+0x48/0x80 [ 250.488531][ T51] ? kthread_blkcg+0xd0/0xd0 [ 250.493131][ T51] ret_from_fork_asm+0x11/0x20 [ 250.497900][ T51] [ 250.504807][ T51] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 250.519314][ T51] Bluetooth: hci3: failed to register connection device [ 250.580309][ T7757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.691217][ T788] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 250.712254][ T788] usb 4-1: USB disconnect, device number 3 [ 250.728528][ T788] usblp0: removed [ 251.520244][ T7787] ptrace attach of "./syz-executor exec"[6013] was attempted by "./syz-executor exec"[7787] [ 251.650384][ T788] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 251.950205][ T788] usb 4-1: Using ep0 maxpacket: 32 [ 251.994626][ T788] usb 4-1: config 0 has an invalid interface number: 46 but max is 0 [ 252.034852][ T788] usb 4-1: config 0 has no interface number 0 [ 252.519675][ T788] usb 4-1: too many endpoints for config 0 interface 46 altsetting 0: 223, using maximum allowed: 30 [ 252.593353][ T788] usb 4-1: config 0 interface 46 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 252.805106][ T788] usb 4-1: config 0 interface 46 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 252.831914][ T7797] netlink: 24 bytes leftover after parsing attributes in process `syz.4.422'. [ 253.210226][ T788] usb 4-1: config 0 interface 46 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 253.222524][ T788] usb 4-1: config 0 interface 46 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 253.234989][ T788] usb 4-1: config 0 interface 46 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 223 [ 253.252997][ T788] usb 4-1: string descriptor 0 read error: -71 [ 253.261926][ T788] usb 4-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 253.271391][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.308878][ T788] usb 4-1: config 0 descriptor?? [ 253.356310][ T788] usb 4-1: can't set config #0, error -71 [ 253.372491][ T788] usb 4-1: USB disconnect, device number 4 [ 254.010075][ T7810] netlink: 24 bytes leftover after parsing attributes in process `syz.4.425'. [ 254.929865][ T5769] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 254.939581][ T5769] CPU: 0 PID: 5769 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 254.947124][ T5769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 254.957355][ T5769] Workqueue: hci2 hci_rx_work [ 254.962036][ T5769] Call Trace: [ 254.965310][ T5769] [ 254.968317][ T5769] dump_stack_lvl+0x18c/0x250 [ 254.973002][ T5769] ? show_regs_print_info+0x20/0x20 [ 254.978222][ T5769] ? load_image+0x400/0x400 [ 254.982755][ T5769] sysfs_create_dir_ns+0x26e/0x2a0 [ 254.987983][ T5769] ? sysfs_warn_dup+0xa0/0xa0 [ 254.992698][ T5769] ? do_raw_spin_unlock+0x121/0x230 [ 254.998030][ T5769] kobject_add_internal+0x61c/0xcc0 [ 255.003770][ T5769] kobject_add+0x164/0x240 [ 255.008280][ T5769] ? __rwlock_init+0x150/0x150 [ 255.013039][ T5769] ? kobject_init+0x1e0/0x1e0 [ 255.017881][ T5769] ? _raw_spin_unlock+0x28/0x40 [ 255.022754][ T5769] ? get_device_parent+0x366/0x390 [ 255.027884][ T5769] device_add+0x408/0xc20 [ 255.032210][ T5769] hci_conn_add_sysfs+0xd5/0x1e0 [ 255.037136][ T5769] le_conn_complete_evt+0xf5d/0x1540 [ 255.042440][ T5769] ? hci_event_packet+0x4cb/0x1270 [ 255.047607][ T5769] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 255.053856][ T5769] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 255.059482][ T5769] ? skb_pull_data+0xfb/0x200 [ 255.064152][ T5769] hci_le_conn_complete_evt+0x187/0x440 [ 255.069893][ T5769] ? hci_remote_host_features_evt+0x150/0x150 [ 255.076128][ T5769] hci_event_packet+0x7ba/0x1270 [ 255.081218][ T5769] ? bis_list+0x290/0x290 [ 255.085565][ T5769] ? lockdep_hardirqs_on+0x98/0x150 [ 255.090778][ T5769] ? hci_send_to_monitor+0xd7/0x4f0 [ 255.096060][ T5769] hci_rx_work+0x43a/0xd60 [ 255.100579][ T5769] ? process_scheduled_works+0x96f/0x15d0 [ 255.106473][ T5769] process_scheduled_works+0xa5d/0x15d0 [ 255.112232][ T5769] ? worker_attach_to_pool+0x380/0x380 [ 255.117848][ T5769] ? assign_work+0x3d2/0x5d0 [ 255.122452][ T5769] worker_thread+0xa55/0xfc0 [ 255.127143][ T5769] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 255.133225][ T5769] ? _raw_spin_unlock+0x40/0x40 [ 255.138143][ T5769] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 255.144147][ T5769] kthread+0x2fa/0x390 [ 255.148301][ T5769] ? pr_cont_work+0x560/0x560 [ 255.153230][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 255.157983][ T5769] ret_from_fork+0x48/0x80 [ 255.162389][ T5769] ? kthread_blkcg+0xd0/0xd0 [ 255.166986][ T5769] ret_from_fork_asm+0x11/0x20 [ 255.171832][ T5769] [ 255.175004][ C0] vkms_vblank_simulate: vblank timer overrun [ 255.183886][ T5769] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 255.199331][ T5769] Bluetooth: hci2: failed to register connection device [ 255.250228][ T5914] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 256.300162][ T5914] usb 3-1: config 0 has an invalid interface number: 200 but max is 0 [ 256.316080][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.324701][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.338471][ T5914] usb 3-1: config 0 has no interface number 0 [ 256.347963][ T5914] usb 3-1: config 0 interface 200 altsetting 2 has an invalid endpoint with address 0xD8, skipping [ 256.359277][ T5914] usb 3-1: config 0 interface 200 has no altsetting 0 [ 256.373290][ T5914] usb 3-1: New USB device found, idVendor=0b57, idProduct=8528, bcdDevice=6d.39 [ 256.382701][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.427248][ T5914] usb 3-1: Product: syz [ 256.443024][ T5914] usb 3-1: Manufacturer: syz [ 256.447738][ T5914] usb 3-1: SerialNumber: syz [ 256.466311][ T5914] usb 3-1: config 0 descriptor?? [ 256.586016][ T7829] loop3: detected capacity change from 0 to 512 [ 256.646051][ T7829] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 256.761082][ T5914] usbhid 3-1:0.200: couldn't find an input interrupt endpoint [ 256.765324][ T7829] ext4 filesystem being mounted at /104/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 256.818137][ T7829] fs-verity (loop3, inode 15): Unrecognized descriptor size: 0 bytes [ 256.869230][ T5914] usb 3-1: USB disconnect, device number 7 [ 259.533634][ T51] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 259.817992][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 260.610801][ T7867] loop1: detected capacity change from 0 to 32768 [ 260.645117][ T7867] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 260.776700][ T7867] XFS (loop1): Ending clean mount [ 261.025047][ T787] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 261.230147][ T787] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 261.358737][ T787] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 261.412195][ T787] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 261.432516][ T787] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.470303][ T787] usb 4-1: Product: syz [ 261.477499][ T787] usb 4-1: Manufacturer: syz [ 261.492678][ T787] usb 4-1: SerialNumber: syz [ 261.525793][ T787] cdc_mbim 4-1:1.0: skipping garbage [ 261.664022][ T5767] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 261.733956][ T7879] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 262.399919][ T7879] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 262.416628][ T787] cdc_mbim 4-1:1.0: setting tx_max = 184 [ 262.457520][ T787] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 262.525182][ T787] wwan wwan0: port wwan0mbim0 attached [ 262.674304][ T787] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, fa:2f:b8:a0:4a:e5 [ 262.693049][ T787] usb 4-1: USB disconnect, device number 5 [ 262.703985][ T787] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 263.588573][ T7904] loop4: detected capacity change from 0 to 512 [ 263.723112][ T787] wwan wwan0: port wwan0mbim0 disconnected [ 263.724077][ T7904] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 263.746576][ T7904] ext4 filesystem being mounted at /96/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 263.766877][ T7904] fs-verity (loop4, inode 15): Unrecognized descriptor size: 0 bytes [ 263.859849][ T5769] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 264.350692][ T7906] loop2: detected capacity change from 0 to 65536 [ 264.394780][ T7906] XFS (loop2): Mounting V5 Filesystem 9b7348e5-2fa0-41a5-9526-c53a678b01f3 [ 264.454585][ T7906] XFS (loop2): Ending clean mount [ 264.489012][ T7906] XFS (loop2): Quotacheck needed: Please wait. [ 264.593006][ T7906] XFS (loop2): Quotacheck: Done. [ 265.366062][ T5774] XFS (loop2): Unmounting Filesystem 9b7348e5-2fa0-41a5-9526-c53a678b01f3 [ 266.848020][ T6013] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 267.080309][ T7947] loop1: detected capacity change from 0 to 1024 [ 267.107987][ T7947] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 267.162571][ T7947] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 267.285736][ T7947] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1229: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 267.652329][ T7944] loop3: detected capacity change from 0 to 40427 [ 267.958006][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 268.008605][ T7944] F2FS-fs (loop3): invalid crc value [ 268.079884][ T51] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 268.114368][ T7944] F2FS-fs (loop3): Found nat_bits in checkpoint [ 268.452430][ T7944] F2FS-fs (loop3): Start checkpoint disabled! [ 269.266056][ T7944] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 270.596389][ T7981] netlink: 24 bytes leftover after parsing attributes in process `syz.2.467'. [ 270.964881][ T7986] loop3: detected capacity change from 0 to 512 [ 271.012473][ T7986] EXT4-fs (loop3): orphan cleanup on readonly fs [ 271.024652][ T7986] Quota error (device loop3): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 271.049214][ T7986] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 271.088059][ T7986] EXT4-fs error (device loop3): ext4_acquire_dquot:6949: comm syz.3.465: Failed to acquire dquot type 1 [ 271.126350][ T7986] Quota error (device loop3): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 271.190732][ T7986] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 271.244977][ T7986] EXT4-fs error (device loop3): ext4_acquire_dquot:6949: comm syz.3.465: Failed to acquire dquot type 1 [ 271.303870][ T7986] EXT4-fs error (device loop3): ext4_validate_block_bitmap:439: comm syz.3.465: bg 0: block 248: padding at end of block bitmap is not set [ 271.390231][ T7986] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6651: Corrupt filesystem [ 271.464865][ T7986] Quota error (device loop3): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 271.479914][ T7986] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 271.680329][ T7986] EXT4-fs error (device loop3): ext4_acquire_dquot:6949: comm syz.3.465: Failed to acquire dquot type 1 [ 271.704052][ T7986] EXT4-fs (loop3): 1 orphan inode deleted [ 271.801106][ T7986] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 271.907864][ T7997] loop4: detected capacity change from 0 to 1024 [ 271.954581][ T7997] EXT4-fs (loop4): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 272.007570][ T7986] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 272.215597][ T7997] EXT4-fs error (device loop4): ext4_map_blocks:608: inode #3: block 2: comm syz.4.472: lblock 2 mapped to illegal pblock 2 (length 1) [ 272.280174][ T7986] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 272.518889][ T7986] ext4 filesystem being remounted at /111/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 272.568973][ T7997] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 272.577607][ T7997] EXT4-fs error (device loop4): ext4_map_blocks:608: inode #3: block 48: comm syz.4.472: lblock 0 mapped to illegal pblock 48 (length 1) [ 272.632453][ T7997] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 272.676489][ T7997] EXT4-fs error (device loop4): ext4_acquire_dquot:6949: comm syz.4.472: Failed to acquire dquot type 0 [ 272.682820][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 272.698288][ T5769] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 272.723121][ T7997] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5920: Corrupt filesystem [ 272.738495][ T7997] EXT4-fs error (device loop4): ext4_evict_inode:252: inode #11: comm syz.4.472: mark_inode_dirty error [ 272.784915][ T7997] EXT4-fs warning (device loop4): ext4_evict_inode:255: couldn't mark inode dirty (err -117) [ 272.860314][ T7997] EXT4-fs (loop4): 1 orphan inode deleted [ 272.982101][ T7997] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 273.000068][ T3466] EXT4-fs error (device loop4): ext4_map_blocks:608: inode #3: block 1: comm kworker/u4:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 273.020871][ T3466] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 273.035459][ T3466] EXT4-fs error (device loop4): ext4_release_dquot:6985: comm kworker/u4:8: Failed to release dquot type 0 [ 273.103649][ T8017] netlink: 24 bytes leftover after parsing attributes in process `syz.1.477'. [ 273.307766][ T6013] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.321906][ T3466] EXT4-fs error (device loop4): ext4_map_blocks:608: inode #3: block 1: comm kworker/u4:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 273.337604][ T3466] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 273.409204][ T8019] netlink: 24 bytes leftover after parsing attributes in process `syz.3.478'. [ 274.000903][ T3466] EXT4-fs error (device loop4): ext4_release_dquot:6985: comm kworker/u4:8: Failed to release dquot type 0 [ 274.021948][ T6013] EXT4-fs error (device loop4): __ext4_get_inode_loc:4489: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 274.045364][ T6013] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5920: Corrupt filesystem [ 274.055798][ T6013] EXT4-fs error (device loop4): ext4_quota_off:7233: inode #3: comm syz-executor: mark_inode_dirty error [ 274.942101][ T8032] syzkaller1: entered promiscuous mode [ 274.968938][ T8032] syzkaller1: entered allmulticast mode [ 278.419464][ T8056] netlink: 24 bytes leftover after parsing attributes in process `syz.4.488'. [ 279.671364][ T5769] Bluetooth: hci1: command 0x0406 tx timeout [ 282.772510][ T8090] netlink: 24 bytes leftover after parsing attributes in process `syz.1.500'. [ 288.668833][ T8138] loop3: detected capacity change from 0 to 512 [ 288.947350][ T8138] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 288.966144][ T8142] IPVS: length: 24 != 24159191448 [ 289.301452][ T8138] ext4 filesystem being mounted at /119/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 289.402426][ T8138] fs-verity (loop3, inode 15): Unrecognized descriptor size: 0 bytes [ 290.081732][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 293.872430][ T8182] netlink: 24 bytes leftover after parsing attributes in process `syz.3.525'. [ 297.974254][ T8211] loop1: detected capacity change from 0 to 512 [ 299.027619][ T8211] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 299.054308][ T8211] ext4 filesystem being mounted at /141/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 299.281760][ T8211] fs-verity (loop1, inode 15): Unrecognized descriptor size: 0 bytes [ 300.335720][ T27] audit: type=1326 audit(1773870947.716:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8224 comm="syz.2.538" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8f2f9c799 code=0x0 [ 300.359870][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 301.461512][ T5769] block nbd2: Receive control failed (result -32) [ 301.492460][ T8231] block nbd2: shutting down sockets [ 303.357064][ T8256] netlink: 24 bytes leftover after parsing attributes in process `syz.3.543'. [ 305.170319][ T5804] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 305.434048][ T5804] usb 5-1: Using ep0 maxpacket: 8 [ 305.612378][ T5804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 305.970232][ T5804] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 305.999935][ T5804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.026201][ T5804] usb 5-1: config 0 descriptor?? [ 306.468596][ T5804] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 307.069421][ T5804] usb 5-1: USB disconnect, device number 4 [ 308.693973][ T8301] loop1: detected capacity change from 0 to 512 [ 308.720704][ T8304] IPVS: length: 24 != 24159191448 [ 308.929111][ T8301] EXT4-fs: Ignoring removed orlov option [ 309.081903][ T8301] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 309.157166][ T8301] EXT4-fs (loop1): 1 truncate cleaned up [ 309.181455][ T8301] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 311.807827][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 312.593100][ T8331] netlink: 24 bytes leftover after parsing attributes in process `syz.1.561'. [ 313.082173][ T8332] ptrace attach of "./syz-executor exec"[6013] was attempted by "./syz-executor exec"[8332] [ 313.995898][ T8336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.566'. [ 314.306380][ T8353] ptrace attach of "./syz-executor exec"[6013] was attempted by "./syz-executor exec"[8353] [ 314.402901][ T8353] Zero length message leads to an empty skb [ 317.359105][ T8378] netlink: 24 bytes leftover after parsing attributes in process `syz.3.576'. [ 317.935733][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.936027][ T5769] block nbd1: Receive control failed (result -32) [ 317.942569][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.983136][ T8369] block nbd1: shutting down sockets [ 318.670600][ T8386] ptrace attach of "./syz-executor exec"[5774] was attempted by "./syz-executor exec"[8386] [ 319.262064][ T8401] netlink: 'syz.4.582': attribute type 32 has an invalid length. [ 320.165193][ T8410] loop4: detected capacity change from 0 to 512 [ 320.180270][ T5804] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 320.182148][ T8410] EXT4-fs: Ignoring removed orlov option [ 320.200749][ T8411] netlink: 'syz.3.583': attribute type 3 has an invalid length. [ 320.230310][ T8410] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 320.236886][ T8412] loop1: detected capacity change from 0 to 4096 [ 320.309741][ T8410] EXT4-fs (loop4): 1 truncate cleaned up [ 320.331363][ T8410] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 320.401951][ T5804] usb 3-1: config 84 has an invalid interface number: 116 but max is 0 [ 320.410796][ T5804] usb 3-1: config 84 has no interface number 0 [ 320.417768][ T5804] usb 3-1: config 84 interface 116 has no altsetting 0 [ 320.431496][ T5804] usb 3-1: New USB device found, idVendor=18ec, idProduct=3290, bcdDevice= a.66 [ 320.442468][ T5804] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.451230][ T5804] usb 3-1: Product: syz [ 320.455699][ T5804] usb 3-1: Manufacturer: syz [ 320.460903][ T5804] usb 3-1: SerialNumber: syz [ 320.559337][ T6013] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 320.659402][ T8415] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 321.156810][ T5804] usb 3-1: USB disconnect, device number 8 [ 321.688601][ T8422] netlink: 24 bytes leftover after parsing attributes in process `syz.4.587'. [ 324.229114][ T5769] block nbd1: Receive control failed (result -32) [ 324.229499][ T8428] block nbd1: shutting down sockets [ 325.864499][ T8444] loop2: detected capacity change from 0 to 4096 [ 326.184525][ T8456] netlink: 24 bytes leftover after parsing attributes in process `syz.1.601'. [ 326.254415][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 326.993738][ T8462] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 327.377859][ T5804] libceph: connect (1)[c::]:6789 error -101 [ 328.755130][ T5804] libceph: mon0 (1)[c::]:6789 connect error [ 328.823783][ T8461] ceph: No mds server is up or the cluster is laggy [ 330.029107][ T8481] IPVS: length: 24 != 24159191448 [ 330.790180][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 331.349801][ T8493] comedi: valid board names for 8255 driver are: [ 331.377500][ T8493] 8255 [ 331.384937][ T8493] comedi: valid board names for vmk80xx driver are: [ 331.405324][ T8493] vmk80xx [ 331.408422][ T8493] comedi: valid board names for usbduxsigma driver are: [ 331.417791][ T8493] usbduxsigma [ 331.421714][ T8493] comedi: valid board names for usbduxfast driver are: [ 331.429482][ T8493] usbduxfast [ 331.433269][ T8493] comedi: valid board names for usbdux driver are: [ 331.474594][ T8493] usbdux [ 331.484792][ T8493] comedi: valid board names for ni6501 driver are: [ 331.521359][ T8493] ni6501 [ 331.535017][ T8493] comedi: valid board names for dt9812 driver are: [ 331.552533][ T8493] dt9812 [ 331.562700][ T8493] comedi: valid board names for ni_labpc_cs driver are: [ 331.591572][ T8493] ni_labpc_cs [ 331.598625][ T8493] comedi: valid board names for ni_daq_700 driver are: [ 331.610144][ T8493] ni_daq_700 [ 331.613763][ T8493] comedi: valid board names for labpc_pci driver are: [ 331.697647][ T8497] netlink: 24 bytes leftover after parsing attributes in process `syz.4.612'. [ 331.807366][ T8493] labpc_pci [ 331.817939][ T8493] comedi: valid board names for adl_pci9118 driver are: [ 331.830204][ T23] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 331.933258][ T8493] pci9118dg [ 331.977961][ T8493] pci9118hg [ 332.060398][ T23] usb 4-1: device descriptor read/64, error -71 [ 332.200294][ T8493] pci9118hr [ 332.203555][ T8493] comedi: valid board names for 8255_pci driver are: [ 332.215491][ T8493] 8255_pci [ 332.218831][ T8493] comedi: valid board names for s526 driver are: [ 332.227509][ T8493] s526 [ 332.238809][ T8493] comedi: valid board names for multiq3 driver are: [ 332.260221][ T8493] multiq3 [ 332.263471][ T8493] comedi: valid board names for pcmuio driver are: [ 332.310563][ T8493] pcmuio48 [ 332.313955][ T8493] pcmuio96 [ 332.317264][ T8493] comedi: valid board names for pcmmio driver are: [ 332.331132][ T8493] pcmmio [ 332.350291][ T8493] comedi: valid board names for pcmda12 driver are: [ 332.357310][ T8493] pcmda12 [ 332.361808][ T8493] comedi: valid board names for pcmad driver are: [ 332.368653][ T8493] pcmad12 [ 332.371820][ T8493] pcmad16 [ 332.375301][ T8493] comedi: valid board names for ni_labpc driver are: [ 332.383694][ T8493] lab-pc-1200 [ 332.387580][ T8493] lab-pc-1200ai [ 332.391555][ T8493] lab-pc+ [ 332.394972][ T8493] comedi: valid board names for atmio16 driver are: [ 332.403937][ T8500] netlink: 'syz.4.614': attribute type 32 has an invalid length. [ 332.413964][ T8493] atmio16 [ 332.417221][ T8493] atmio16d [ 332.420641][ T8493] comedi: valid board names for ni_at_ao driver are: [ 332.428199][ T8493] at-ao-6 [ 332.431513][ T23] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 332.441130][ T8493] at-ao-10 [ 332.444471][ T8493] comedi: valid board names for ni_at_a2150 driver are: [ 332.452803][ T8493] ni_at_a2150 [ 332.456460][ T8493] comedi: valid board names for adq12b driver are: [ 332.466312][ T8493] adq12b [ 332.469363][ T8493] comedi: valid board names for mpc624 driver are: [ 332.477074][ T8493] mpc624 [ 332.480726][ T8493] comedi: valid board names for c6xdigio driver are: [ 332.488060][ T8493] c6xdigio [ 332.492964][ T8493] comedi: valid board names for aio_iiro_16 driver are: [ 332.501047][ T8493] aio_iiro_16 [ 332.505354][ T8493] comedi: valid board names for aio_aio12_8 driver are: [ 332.514049][ T8493] aio_aio12_8 [ 332.517868][ T8493] aio_ai12_8 [ 332.522521][ T8493] aio_ao12_4 [ 332.526905][ T8493] comedi: valid board names for fl512 driver are: [ 332.534684][ T8493] fl512 [ 332.538102][ T8493] comedi: valid board names for dmm32at driver are: [ 332.566630][ T8493] dmm32at [ 332.583845][ T8493] comedi: valid board names for dt282x driver are: [ 332.593390][ T23] usb 4-1: device descriptor read/64, error -71 [ 332.602698][ T8493] dt2821 [ 332.606330][ T8493] dt2821-f [ 332.610486][ T8493] dt2821-g [ 332.614505][ T8493] dt2823 [ 332.617721][ T8493] dt2824-pgh [ 332.621800][ T8493] dt2824-pgl [ 332.625335][ T8493] dt2825 [ 332.628832][ T8493] dt2827 [ 332.632463][ T8493] dt2828 [ 332.635967][ T8493] dt2829 [ 332.639198][ T8493] dt21-ez [ 332.642908][ T8493] dt23-ez [ 332.646613][ T8493] dt24-ez [ 332.650656][ T8493] dt24-ez-pgl [ 332.654434][ T8493] comedi: valid board names for dt2817 driver are: [ 332.661465][ T8493] dt2817 [ 332.664568][ T8493] comedi: valid board names for dt2815 driver are: [ 332.671291][ T8493] dt2815 [ 332.674437][ T8493] comedi: valid board names for dt2814 driver are: [ 332.681470][ T8493] dt2814 [ 332.684913][ T8493] comedi: valid board names for dt2811 driver are: [ 332.693150][ T8493] dt2811-pgh [ 332.696813][ T8493] dt2811-pgl [ 332.700641][ T8493] comedi: valid board names for dt2801 driver are: [ 332.708386][ T8493] dt2801 [ 332.711711][ T8493] comedi: valid board names for das6402 driver are: [ 332.719523][ T8493] das6402-12 [ 332.723748][ T23] usb usb4-port1: attempt power cycle [ 332.730433][ T8493] das6402-16 [ 332.734017][ T8493] comedi: valid board names for das1800 driver are: [ 332.741914][ T8493] das-1701st [ 332.745506][ T8493] das-1701st-da [ 332.749090][ T8493] das-1702st [ 332.753259][ T8493] das-1702st-da [ 332.757312][ T8493] das-1702hr [ 332.762028][ T8493] das-1702hr-da [ 332.766195][ T8493] das-1701ao [ 332.769673][ T8493] das-1702ao [ 332.773485][ T8493] das-1801st [ 332.777249][ T8493] das-1801st-da [ 332.781814][ T8493] das-1802st [ 332.785792][ T8493] das-1802st-da [ 332.789703][ T8493] das-1802hr [ 332.793644][ T8493] das-1802hr-da [ 332.797889][ T8493] das-1801hc [ 332.805863][ T8493] das-1802hc [ 332.809368][ T8493] das-1801ao [ 332.814644][ T8493] das-1802ao [ 332.818747][ T8493] comedi: valid board names for das800 driver are: [ 332.826338][ T8493] das-800 [ 332.829745][ T8493] cio-das800 [ 332.833700][ T8493] das-801 [ 332.837161][ T8493] cio-das801 [ 332.841931][ T8493] das-802 [ 332.845143][ T8493] cio-das802 [ 332.849364][ T8493] cio-das802/16 [ 332.854419][ T8493] comedi: valid board names for isa-das08 driver are: [ 332.861997][ T8493] isa-das08 [ 332.865535][ T8493] das08-pgm [ 332.869035][ T8493] das08-pgh [ 332.872884][ T8493] das08-pgl [ 332.876449][ T8493] das08-aoh [ 332.879785][ T8493] das08-aol [ 332.883761][ T8493] das08-aom [ 332.887249][ T8493] das08/jr-ao [ 332.891000][ T8493] das08jr-16-ao [ 332.894753][ T8493] pc104-das08 [ 332.898369][ T8493] das08jr/16 [ 332.902051][ T8493] comedi: valid board names for das16m1 driver are: [ 332.909496][ T8493] das16m1 [ 332.915665][ T8493] comedi: valid board names for dac02 driver are: [ 332.925361][ T8493] dac02 [ 332.929894][ T8493] comedi: valid board names for rti802 driver are: [ 332.937488][ T8493] rti802 [ 332.941107][ T8493] comedi: valid board names for rti800 driver are: [ 332.948146][ T8493] rti800 [ 332.951610][ T8493] rti815 [ 332.954775][ T8493] comedi: valid board names for pcm3724 driver are: [ 332.963065][ T8493] pcm3724 [ 332.966302][ T8493] comedi: valid board names for pcl818 driver are: [ 332.973604][ T8493] pcl818l [ 332.976891][ T8493] pcl818h [ 332.980608][ T8493] pcl818hd [ 332.984672][ T8493] pcl818hg [ 332.987992][ T8493] pcl818 [ 332.991435][ T8493] pcl718 [ 332.995071][ T8493] pcm3718 [ 332.998339][ T8493] comedi: valid board names for pcl816 driver are: [ 333.005793][ T8493] pcl816 [ 333.008829][ T8493] pcl814b [ 333.012160][ T8493] comedi: valid board names for pcl812 driver are: [ 333.019874][ T8493] pcl812 [ 333.025997][ T8493] pcl812pg [ 333.029376][ T8493] acl8112pg [ 333.033961][ T8493] acl8112dg [ 333.037391][ T8493] acl8112hg [ 333.043356][ T8493] a821pgl [ 333.046747][ T8493] a821pglnda [ 333.050657][ T8493] a821pgh [ 333.054129][ T8493] a822pgl [ 333.057368][ T8493] a822pgh [ 333.061381][ T8493] a823pgl [ 333.064733][ T8493] a823pgh [ 333.068053][ T8493] pcl813 [ 333.071797][ T8493] pcl813b [ 333.075057][ T8493] acl8113 [ 333.078336][ T8493] iso813 [ 333.081807][ T8493] acl8216 [ 333.085243][ T8493] a826pg [ 333.088779][ T8493] comedi: valid board names for pcl730 driver are: [ 333.096048][ T8493] pcl730 [ 333.099488][ T8493] iso730 [ 333.102859][ T8493] acl7130 [ 333.106272][ T8493] pcm3730 [ 333.109760][ T8493] pcl725 [ 333.123891][ T8493] p8r8dio [ 333.130218][ T23] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 333.139434][ T8493] acl7225b [ 333.143281][ T8493] p16r16dio [ 333.147526][ T8493] pcl733 [ 333.159247][ T8493] pcl734 [ 333.170557][ T23] usb 4-1: device descriptor read/8, error -71 [ 333.181077][ T8493] opmm-1616-xt [ 333.184823][ T8493] pearl-mm-p [ 333.188391][ T8493] ir104-pbf [ 333.194265][ T8493] comedi: valid board names for pcl726 driver are: [ 333.201459][ T8493] pcl726 [ 333.205086][ T8493] pcl727 [ 333.208195][ T8493] pcl728 [ 333.212186][ T8493] acl6126 [ 333.215568][ T8493] acl6128 [ 333.218687][ T8493] comedi: valid board names for pcl724 driver are: [ 333.227505][ T8493] pcl724 [ 333.230965][ T8493] pcl722 [ 333.234335][ T8493] pcl731 [ 333.237790][ T8493] acl7122 [ 333.241708][ T8493] acl7124 [ 333.244952][ T8493] pet48dio [ 333.250366][ T8493] pcmio48 [ 333.253494][ T8493] onyx-mm-dio [ 333.257174][ T8493] comedi: valid board names for pcl711 driver are: [ 333.266877][ T8493] pcl711 [ 333.270009][ T8493] pcl711b [ 333.274439][ T8493] acl8112hg [ 333.277909][ T8493] acl8112dg [ 333.282481][ T8493] comedi: valid board names for amplc_pc263 driver are: [ 333.290520][ T8493] pc263 [ 333.293597][ T8493] comedi: valid board names for amplc_pc236 driver are: [ 333.311095][ T8493] pc36at [ 333.322710][ T8493] comedi: valid board names for amplc_dio200 driver are: [ 333.330318][ T8493] pc212e [ 333.374951][ T8493] pc214e [ 333.384252][ T8493] pc215e [ 333.387896][ T8493] pc218e [ 333.409989][ T8493] pc272e [ 333.428538][ T8493] comedi: valid board names for comedi_parport driver are: [ 333.443082][ T8493] comedi_parport [ 333.447892][ T8493] comedi: valid board names for comedi_test driver are: [ 333.456927][ T8493] comedi_test [ 333.461056][ T8493] comedi: valid board names for comedi_bond driver are: [ 333.468668][ T8493] comedi_bond [ 333.490429][ T23] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 333.523212][ T23] usb 4-1: device descriptor read/8, error -71 [ 333.660620][ T23] usb usb4-port1: unable to enumerate USB device [ 334.672476][ T8514] IPVS: length: 24 != 24159191448 [ 337.529319][ T8526] IPVS: length: 24 != 24159191448 [ 339.628496][ T8562] IPVS: length: 24 != 24159191448 [ 340.657285][ T5769] block nbd1: Receive control failed (result -32) [ 340.718978][ T8561] block nbd1: shutting down sockets [ 341.430559][ T5769] Bluetooth: hci1: command 0x0406 tx timeout [ 342.078916][ T8575] IPVS: length: 24 != 24159191448 [ 343.555054][ T8592] ptrace attach of "./syz-executor exec"[6013] was attempted by "./syz-executor exec"[8592] [ 346.782447][ T8609] loop3: detected capacity change from 0 to 4096 [ 346.806141][ T8609] ntfs3: loop3: Different NTFS sector size (4096) and media sector size (512). [ 346.866304][ T8609] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 347.430534][ T5769] Bluetooth: hci1: command 0x0406 tx timeout [ 347.798062][ T8619] IPVS: length: 24 != 24159191448 [ 348.232072][ T8621] loop1: detected capacity change from 0 to 4096 [ 348.317519][ T8622] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 351.676478][ T27] audit: type=1326 audit(1773870999.056:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8641 comm="syz.2.654" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8f2f9c799 code=0x0 [ 351.762587][ T8648] comedi: valid board names for 8255 driver are: [ 351.769158][ T8648] 8255 [ 351.772704][ T8648] comedi: valid board names for vmk80xx driver are: [ 351.990182][ T8648] vmk80xx [ 351.994492][ T8648] comedi: valid board names for usbduxsigma driver are: [ 352.011755][ T8648] usbduxsigma [ 352.015606][ T8648] comedi: valid board names for usbduxfast driver are: [ 352.077109][ T8648] usbduxfast [ 352.312593][ T5769] block nbd2: Receive control failed (result -32) [ 352.323986][ T8642] block nbd2: shutting down sockets [ 352.400457][ T8648] comedi: valid board names for usbdux driver are: [ 352.407317][ T8648] usbdux [ 352.440302][ T8648] comedi: valid board names for ni6501 driver are: [ 352.480780][ T8648] ni6501 [ 352.498591][ T8648] comedi: valid board names for dt9812 driver are: [ 352.519471][ T8648] dt9812 [ 352.535177][ T8648] comedi: valid board names for ni_labpc_cs driver are: [ 352.563558][ T8648] ni_labpc_cs [ 352.570152][ T8648] comedi: valid board names for ni_daq_700 driver are: [ 352.579472][ T8648] ni_daq_700 [ 352.583492][ T8648] comedi: valid board names for labpc_pci driver are: [ 352.591050][ T8648] labpc_pci [ 352.596628][ T8648] comedi: valid board names for adl_pci9118 driver are: [ 352.604208][ T8648] pci9118dg [ 352.607618][ T8648] pci9118hg [ 352.611715][ T8648] pci9118hr [ 352.616122][ T8648] comedi: valid board names for 8255_pci driver are: [ 352.623145][ T8648] 8255_pci [ 352.627478][ T8648] comedi: valid board names for s526 driver are: [ 352.635234][ T8648] s526 [ 352.642225][ T8648] comedi: valid board names for multiq3 driver are: [ 352.657977][ T8648] multiq3 [ 352.664845][ T8648] comedi: valid board names for pcmuio driver are: [ 352.712507][ T8648] pcmuio48 [ 352.715858][ T8648] pcmuio96 [ 352.719082][ T8648] comedi: valid board names for pcmmio driver are: [ 352.749892][ T8648] pcmmio [ 352.755691][ T8648] comedi: valid board names for pcmda12 driver are: [ 352.769612][ T8648] pcmda12 [ 352.773644][ T8648] comedi: valid board names for pcmad driver are: [ 352.781245][ T8648] pcmad12 [ 352.859538][ T8648] pcmad16 [ 352.862869][ T8648] comedi: valid board names for ni_labpc driver are: [ 352.870846][ T8648] lab-pc-1200 [ 352.874350][ T8648] lab-pc-1200ai [ 352.878062][ T8655] IPVS: length: 24 != 24159191448 [ 352.885400][ T8648] lab-pc+ [ 352.888529][ T8648] comedi: valid board names for atmio16 driver are: [ 352.895973][ T8648] atmio16 [ 352.901842][ T8648] atmio16d [ 352.912277][ T8648] comedi: valid board names for ni_at_ao driver are: [ 352.927886][ T8648] at-ao-6 [ 352.935832][ T8648] at-ao-10 [ 352.952832][ T8648] comedi: valid board names for ni_at_a2150 driver are: [ 352.994409][ T8648] ni_at_a2150 [ 353.010184][ T8648] comedi: valid board names for adq12b driver are: [ 353.023968][ T8648] adq12b [ 353.036237][ T8648] comedi: valid board names for mpc624 driver are: [ 353.055494][ T8648] mpc624 [ 353.062319][ T8648] comedi: valid board names for c6xdigio driver are: [ 353.087121][ T8648] c6xdigio [ 353.095368][ T8648] comedi: valid board names for aio_iiro_16 driver are: [ 353.106056][ T8648] aio_iiro_16 [ 353.111538][ T8648] comedi: valid board names for aio_aio12_8 driver are: [ 353.111578][ T8648] aio_aio12_8 [ 353.111585][ T8648] aio_ai12_8 [ 353.111591][ T8648] aio_ao12_4 [ 353.111689][ T8648] comedi: valid board names for fl512 driver are: [ 353.111700][ T8648] fl512 [ 353.111707][ T8648] comedi: valid board names for dmm32at driver are: [ 353.111868][ T8648] dmm32at [ 353.111876][ T8648] comedi: valid board names for dt282x driver are: [ 353.111885][ T8648] dt2821 [ 353.111892][ T8648] dt2821-f [ 353.111898][ T8648] dt2821-g [ 353.111904][ T8648] dt2823 [ 353.112031][ T8648] dt2824-pgh [ 353.112039][ T8648] dt2824-pgl [ 353.112046][ T8648] dt2825 [ 353.112052][ T8648] dt2827 [ 353.112059][ T8648] dt2828 [ 353.112065][ T8648] dt2829 [ 353.112072][ T8648] dt21-ez [ 353.112078][ T8648] dt23-ez [ 353.112085][ T8648] dt24-ez [ 353.112091][ T8648] dt24-ez-pgl [ 353.112098][ T8648] comedi: valid board names for dt2817 driver are: [ 353.112107][ T8648] dt2817 [ 353.112113][ T8648] comedi: valid board names for dt2815 driver are: [ 353.112121][ T8648] dt2815 [ 353.112128][ T8648] comedi: valid board names for dt2814 driver are: [ 353.112136][ T8648] dt2814 [ 353.112143][ T8648] comedi: valid board names for dt2811 driver are: [ 353.112151][ T8648] dt2811-pgh [ 353.112158][ T8648] dt2811-pgl [ 353.112165][ T8648] comedi: valid board names for dt2801 driver are: [ 353.112173][ T8648] dt2801 [ 353.112180][ T8648] comedi: valid board names for das6402 driver are: [ 353.112187][ T8648] das6402-12 [ 353.112194][ T8648] das6402-16 [ 353.112200][ T8648] comedi: valid board names for das1800 driver are: [ 353.112208][ T8648] das-1701st [ 353.112215][ T8648] das-1701st-da [ 353.112222][ T8648] das-1702st [ 353.112228][ T8648] das-1702st-da [ 353.112234][ T8648] das-1702hr [ 353.112240][ T8648] das-1702hr-da [ 353.112532][ T8648] das-1701ao [ 353.113585][ T8648] das-1702ao [ 353.113921][ T8648] das-1801st [ 353.113927][ T8648] das-1801st-da [ 353.113931][ T8648] das-1802st [ 353.113935][ T8648] das-1802st-da [ 353.113938][ T8648] das-1802hr [ 353.113942][ T8648] das-1802hr-da [ 353.113946][ T8648] das-1801hc [ 353.113949][ T8648] das-1802hc [ 353.113953][ T8648] das-1801ao [ 353.113957][ T8648] das-1802ao [ 353.113961][ T8648] comedi: valid board names for das800 driver are: [ 353.113966][ T8648] das-800 [ 353.113970][ T8648] cio-das800 [ 353.113973][ T8648] das-801 [ 353.113977][ T8648] cio-das801 [ 353.113980][ T8648] das-802 [ 353.113984][ T8648] cio-das802 [ 353.113987][ T8648] cio-das802/16 [ 353.113991][ T8648] comedi: valid board names for isa-das08 driver are: [ 353.113995][ T8648] isa-das08 [ 353.113998][ T8648] das08-pgm [ 353.114002][ T8648] das08-pgh [ 353.114006][ T8648] das08-pgl [ 353.114009][ T8648] das08-aoh [ 353.114013][ T8648] das08-aol [ 353.114016][ T8648] das08-aom [ 353.114020][ T8648] das08/jr-ao [ 353.114023][ T8648] das08jr-16-ao [ 353.114027][ T8648] pc104-das08 [ 353.114031][ T8648] das08jr/16 [ 353.114034][ T8648] comedi: valid board names for das16m1 driver are: [ 353.114039][ T8648] das16m1 [ 353.114043][ T8648] comedi: valid board names for dac02 driver are: [ 353.114047][ T8648] dac02 [ 353.114051][ T8648] comedi: valid board names for rti802 driver are: [ 353.114055][ T8648] rti802 [ 353.114058][ T8648] comedi: valid board names for rti800 driver are: [ 353.114063][ T8648] rti800 [ 353.114066][ T8648] rti815 [ 353.114070][ T8648] comedi: valid board names for pcm3724 driver are: [ 353.114075][ T8648] pcm3724 [ 353.114078][ T8648] comedi: valid board names for pcl818 driver are: [ 353.114083][ T8648] pcl818l [ 353.114086][ T8648] pcl818h [ 353.114090][ T8648] pcl818hd [ 353.114093][ T8648] pcl818hg [ 353.114097][ T8648] pcl818 [ 353.114100][ T8648] pcl718 [ 353.114103][ T8648] pcm3718 [ 353.114107][ T8648] comedi: valid board names for pcl816 driver are: [ 353.114112][ T8648] pcl816 [ 353.114115][ T8648] pcl814b [ 353.114119][ T8648] comedi: valid board names for pcl812 driver are: [ 353.114124][ T8648] pcl812 [ 353.114127][ T8648] pcl812pg [ 353.114131][ T8648] acl8112pg [ 353.114134][ T8648] acl8112dg [ 353.114137][ T8648] acl8112hg [ 353.114140][ T8648] a821pgl [ 353.114143][ T8648] a821pglnda [ 353.114147][ T8648] a821pgh [ 353.114150][ T8648] a822pgl [ 353.114153][ T8648] a822pgh [ 353.114157][ T8648] a823pgl [ 353.114160][ T8648] a823pgh [ 353.114163][ T8648] pcl813 [ 353.114166][ T8648] pcl813b [ 353.114169][ T8648] acl8113 [ 353.114173][ T8648] iso813 [ 353.114176][ T8648] acl8216 [ 353.114179][ T8648] a826pg [ 353.114182][ T8648] comedi: valid board names for pcl730 driver are: [ 353.114187][ T8648] pcl730 [ 353.114190][ T8648] iso730 [ 353.114193][ T8648] acl7130 [ 353.114196][ T8648] pcm3730 [ 353.114200][ T8648] pcl725 [ 353.114203][ T8648] p8r8dio [ 353.114206][ T8648] acl7225b [ 353.114209][ T8648] p16r16dio [ 353.114213][ T8648] pcl733 [ 353.114216][ T8648] pcl734 [ 353.114219][ T8648] opmm-1616-xt [ 353.114223][ T8648] pearl-mm-p [ 353.114226][ T8648] ir104-pbf [ 353.114230][ T8648] comedi: valid board names for pcl726 driver are: [ 353.114234][ T8648] pcl726 [ 353.114237][ T8648] pcl727 [ 353.114241][ T8648] pcl728 [ 353.114244][ T8648] acl6126 [ 353.114247][ T8648] acl6128 [ 353.114250][ T8648] comedi: valid board names for pcl724 driver are: [ 353.114255][ T8648] pcl724 [ 353.114258][ T8648] pcl722 [ 353.114261][ T8648] pcl731 [ 353.114264][ T8648] acl7122 [ 353.114268][ T8648] acl7124 [ 353.114271][ T8648] pet48dio [ 353.114274][ T8648] pcmio48 [ 353.114277][ T8648] onyx-mm-dio [ 353.114281][ T8648] comedi: valid board names for pcl711 driver are: [ 353.114285][ T8648] pcl711 [ 353.114288][ T8648] pcl711b [ 353.114291][ T8648] acl8112hg [ 353.114295][ T8648] acl8112dg [ 353.114298][ T8648] comedi: valid board names for amplc_pc263 driver are: [ 353.114302][ T8648] pc263 [ 353.114306][ T8648] comedi: valid board names for amplc_pc236 driver are: [ 353.114317][ T8648] pc36at [ 353.114321][ T8648] comedi: valid board names for amplc_dio200 driver are: [ 353.114325][ T8648] pc212e [ 353.114329][ T8648] pc214e [ 353.114332][ T8648] pc215e [ 353.114335][ T8648] pc218e [ 353.114339][ T8648] pc272e [ 353.114343][ T8648] comedi: valid board names for comedi_parport driver are: [ 353.114347][ T8648] comedi_parport [ 353.114351][ T8648] comedi: valid board names for comedi_test driver are: [ 353.114356][ T8648] comedi_test [ 353.114359][ T8648] comedi: valid board names for comedi_bond driver are: [ 353.114364][ T8648] comedi_bond [ 356.046141][ T8662] tty tty1: ldisc open failed (-12), clearing slot 0 [ 356.065988][ T8671] pty pty26: ldisc open failed (-12), clearing slot 26 [ 357.880378][ T23] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 358.249176][ T23] usb 4-1: config 84 has an invalid interface number: 116 but max is 0 [ 358.272366][ T23] usb 4-1: config 84 has no interface number 0 [ 358.289393][ T23] usb 4-1: config 84 interface 116 has no altsetting 0 [ 358.309938][ T23] usb 4-1: New USB device found, idVendor=18ec, idProduct=3290, bcdDevice= a.66 [ 358.333411][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.397610][ T23] usb 4-1: Product: syz [ 358.406071][ T23] usb 4-1: Manufacturer: syz [ 358.454249][ T23] usb 4-1: SerialNumber: syz [ 358.564346][ T8703] loop4: detected capacity change from 0 to 4096 [ 358.750988][ T8710] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 358.942707][ T23] usb 4-1: USB disconnect, device number 10 [ 359.208628][ T5762] udevd[5762]: setting owner of /dev/bus/usb/004/010 to uid=0, gid=0 failed: No such file or directory [ 359.369160][ T8709] loop2: detected capacity change from 0 to 4096 [ 359.648508][ T8714] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 360.598330][ T8723] ptrace attach of "./syz-executor exec"[5774] was attempted by "./syz-executor exec"[8723] [ 363.463278][ T8745] loop4: detected capacity change from 0 to 4096 [ 363.471695][ T8747] warning: `syz.2.684' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 363.669805][ T8748] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 364.591403][ T8758] netlink: 24 bytes leftover after parsing attributes in process `syz.2.685'. [ 364.915688][ T8756] loop4: detected capacity change from 0 to 4096 [ 365.194958][ T8762] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 365.506626][ T8766] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[8766] [ 366.754818][ T8777] loop1: detected capacity change from 0 to 131072 [ 366.847778][ T8777] F2FS-fs (loop1): invalid crc value [ 366.872653][ T8777] F2FS-fs (loop1): Found nat_bits in checkpoint [ 366.903695][ T8777] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 366.986560][ T8783] loop2: detected capacity change from 0 to 512 [ 367.121922][ T8783] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 367.678728][ T8783] ext4 filesystem being mounted at /183/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 367.754938][ T8783] fs-verity (loop2, inode 15): Unrecognized descriptor size: 0 bytes [ 369.321621][ T5774] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 369.627482][ T8806] netlink: 24 bytes leftover after parsing attributes in process `syz.4.698'. [ 372.086026][ T8826] IPVS: length: 24 != 24159191448 [ 372.337383][ T27] audit: type=1326 audit(1773871019.666:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8827 comm="syz.1.703" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0796b9c799 code=0x0 [ 372.966769][ T5769] block nbd1: Receive control failed (result -32) [ 372.967047][ T8828] block nbd1: shutting down sockets [ 373.519764][ T8838] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[8838] [ 377.260246][ T27] audit: type=1326 audit(1773871024.636:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8864 comm="syz.2.714" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8f2f9c799 code=0x0 [ 377.973481][ T51] block nbd2: Receive control failed (result -32) [ 377.981097][ T8865] block nbd2: shutting down sockets [ 378.382101][ T8871] loop1: detected capacity change from 0 to 4096 [ 378.640833][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 378.814680][ T8869] IPVS: length: 24 != 24159191448 [ 379.109630][ T8880] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 379.198974][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.280170][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.837342][ T5804] libceph: connect (1)[c::]:6789 error -101 [ 380.843622][ T5804] libceph: mon0 (1)[c::]:6789 connect error [ 380.854088][ T8897] ceph: No mds server is up or the cluster is laggy [ 381.078086][ T8906] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[8906] [ 385.438176][ T8937] loop1: detected capacity change from 0 to 4096 [ 385.522011][ T8942] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 386.707378][ T8956] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 389.255295][ T8981] IPVS: length: 24 != 24159191448 [ 390.259160][ T8985] loop4: detected capacity change from 0 to 4096 [ 390.454459][ T8988] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 390.558293][ T8991] syzkaller1: entered promiscuous mode [ 390.646143][ T8991] syzkaller1: entered allmulticast mode [ 393.880591][ T9023] netlink: 'syz.4.757': attribute type 32 has an invalid length. [ 394.426815][ T9026] loop2: detected capacity change from 0 to 4096 [ 394.520213][ T9024] IPVS: length: 24 != 24159191448 [ 395.589714][ T9036] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 396.808002][ T9054] loop2: detected capacity change from 0 to 512 [ 396.905265][ T9054] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 396.919915][ T9054] ext4 filesystem being mounted at /199/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 396.944617][ T9054] fs-verity (loop2, inode 15): Unrecognized descriptor size: 0 bytes [ 397.411975][ T9064] netlink: 'syz.4.769': attribute type 32 has an invalid length. [ 397.742404][ T5774] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 398.089921][ T9072] loop4: detected capacity change from 0 to 4096 [ 398.349254][ T9082] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 398.976024][ T9084] IPVS: length: 24 != 24159191448 [ 401.191038][ T9103] loop3: detected capacity change from 0 to 512 [ 401.295641][ T9102] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 401.328674][ T9103] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 401.350852][ T9103] ext4 filesystem being mounted at /181/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 401.441661][ T9103] fs-verity (loop3, inode 15): Unrecognized descriptor size: 0 bytes [ 402.021984][ T9111] loop1: detected capacity change from 0 to 4096 [ 402.124652][ T9116] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 402.168666][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 403.219561][ T9122] IPVS: length: 24 != 24159191448 [ 404.161895][ T9140] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 405.476436][ T9156] loop4: detected capacity change from 0 to 4096 [ 405.545217][ T788] libceph: connect (1)[c::]:6789 error -101 [ 405.560399][ T788] libceph: mon0 (1)[c::]:6789 connect error [ 405.568437][ T9155] ceph: No mds server is up or the cluster is laggy [ 405.744008][ T9164] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 405.830705][ T788] libceph: connect (1)[c::]:6789 error -101 [ 405.974482][ T788] libceph: mon0 (1)[c::]:6789 connect error [ 407.464569][ T9180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.804'. [ 408.389083][ T9189] netlink: 4 bytes leftover after parsing attributes in process `syz.2.806'. [ 408.445685][ T9189] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.659405][ T9189] bridge_slave_1 (unregistering): left allmulticast mode [ 408.680397][ T9189] bridge_slave_1 (unregistering): left promiscuous mode [ 408.702456][ T9189] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.116650][ T5778] libceph: connect (1)[c::]:6789 error -101 [ 409.135541][ T5778] libceph: mon0 (1)[c::]:6789 connect error [ 409.162194][ T9195] ceph: No mds server is up or the cluster is laggy [ 409.548506][ T9200] loop4: detected capacity change from 0 to 4096 [ 410.949277][ T9216] loop1: detected capacity change from 0 to 32768 [ 411.237313][ T9216] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 411.509125][ T9216] XFS (loop1): Ending clean mount [ 411.522511][ T9216] XFS (loop1): Quotacheck needed: Please wait. [ 411.602669][ T9216] XFS (loop1): Quotacheck: Done. [ 412.198389][ T5767] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 414.054653][ T5778] libceph: connect (1)[c::]:6789 error -101 [ 414.084170][ T5778] libceph: mon0 (1)[c::]:6789 connect error [ 414.190250][ T9240] ceph: No mds server is up or the cluster is laggy [ 414.721133][ T9254] netlink: 24 bytes leftover after parsing attributes in process `syz.3.819'. [ 415.521935][ T9263] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 415.826245][ T9269] ptrace attach of "./syz-executor exec"[6013] was attempted by "./syz-executor exec"[9269] [ 417.180681][ T9275] loop3: detected capacity change from 0 to 4096 [ 418.135862][ T9286] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 418.936149][ T9297] IPVS: length: 24 != 24159191448 [ 420.584572][ T51] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 420.666448][ T9314] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[9314] [ 424.663270][ T9363] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[9363] [ 425.294322][ T5769] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 426.691085][ T9383] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 427.060537][ T9389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.857'. [ 427.629442][ T9399] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[9399] [ 428.119886][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 428.129692][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 428.137188][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 428.147473][ T51] Workqueue: hci1 hci_rx_work [ 428.152388][ T51] Call Trace: [ 428.155686][ T51] [ 428.158853][ T51] dump_stack_lvl+0x18c/0x250 [ 428.163749][ T51] ? show_regs_print_info+0x20/0x20 [ 428.169076][ T51] ? load_image+0x400/0x400 [ 428.173624][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 428.178780][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 428.183488][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 428.188717][ T51] kobject_add_internal+0x61c/0xcc0 [ 428.193976][ T51] kobject_add+0x164/0x240 [ 428.198409][ T51] ? __rwlock_init+0x150/0x150 [ 428.203228][ T51] ? kobject_init+0x1e0/0x1e0 [ 428.208038][ T51] ? _raw_spin_unlock+0x28/0x40 [ 428.212977][ T51] ? get_device_parent+0x366/0x390 [ 428.218126][ T51] device_add+0x408/0xc20 [ 428.222581][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 428.227814][ T51] le_conn_complete_evt+0xf5d/0x1540 [ 428.233166][ T51] ? hci_event_packet+0x4cb/0x1270 [ 428.238508][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 428.245824][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 428.251686][ T51] ? skb_pull_data+0xfb/0x200 [ 428.256591][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 428.262641][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 428.269301][ T51] hci_event_packet+0x7ba/0x1270 [ 428.274350][ T51] ? bis_list+0x290/0x290 [ 428.278887][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 428.284272][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 428.289662][ T51] hci_rx_work+0x43a/0xd60 [ 428.294111][ T51] ? process_scheduled_works+0x96f/0x15d0 [ 428.299921][ T51] process_scheduled_works+0xa5d/0x15d0 [ 428.305588][ T51] ? worker_attach_to_pool+0x380/0x380 [ 428.311161][ T51] ? assign_work+0x3d2/0x5d0 [ 428.315957][ T51] worker_thread+0xa55/0xfc0 [ 428.320680][ T51] kthread+0x2fa/0x390 [ 428.324755][ T51] ? pr_cont_work+0x560/0x560 [ 428.329440][ T51] ? kthread_blkcg+0xd0/0xd0 [ 428.334028][ T51] ret_from_fork+0x48/0x80 [ 428.338459][ T51] ? kthread_blkcg+0xd0/0xd0 [ 428.343089][ T51] ret_from_fork_asm+0x11/0x20 [ 428.347953][ T51] [ 428.361724][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 428.376152][ T51] Bluetooth: hci1: failed to register connection device [ 428.472996][ T5823] libceph: connect (1)[c::]:6789 error -101 [ 428.489734][ T5823] libceph: mon0 (1)[c::]:6789 connect error [ 428.519735][ T9407] ceph: No mds server is up or the cluster is laggy [ 428.632535][ T9418] loop2: detected capacity change from 0 to 512 [ 428.693626][ T9418] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 428.744253][ T9418] ext4 filesystem being mounted at /223/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 428.780708][ T9418] fs-verity (loop2, inode 15): Unrecognized descriptor size: 0 bytes [ 429.082864][ T5774] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 429.486120][ T9437] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[9437] [ 430.491470][ T9429] loop4: detected capacity change from 0 to 131072 [ 430.512354][ T9429] F2FS-fs (loop4): invalid crc value [ 430.529371][ T9429] F2FS-fs (loop4): Found nat_bits in checkpoint [ 430.640243][ T9429] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 431.194509][ T9448] loop3: detected capacity change from 0 to 512 [ 431.362249][ T9450] loop1: detected capacity change from 0 to 4096 [ 431.411549][ T9448] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 431.500973][ T9448] ext4 filesystem being mounted at /200/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 431.913704][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 432.139967][ T9458] loop1: detected capacity change from 0 to 512 [ 432.790408][ T9458] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 432.856073][ T9458] ext4 filesystem being mounted at /236/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 432.887758][ T5769] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 433.116806][ T9458] fs-verity (loop1, inode 15): Unrecognized descriptor size: 0 bytes [ 433.520959][ T5767] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 433.781756][ T9479] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[9479] [ 434.470536][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 434.705861][ T9493] loop4: detected capacity change from 0 to 4096 [ 435.759352][ T9501] loop3: detected capacity change from 0 to 512 [ 435.822708][ T5769] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 435.854288][ T9501] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 435.870738][ T9501] ext4 filesystem being mounted at /206/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 435.920519][ T9501] fs-verity (loop3, inode 15): Unrecognized descriptor size: 0 bytes [ 436.332415][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 436.518045][ T9516] loop2: detected capacity change from 0 to 8192 [ 436.660220][ T9519] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[9519] [ 437.030565][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 437.725913][ T9531] loop4: detected capacity change from 0 to 4096 [ 438.648976][ T9540] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 438.854364][ T9539] loop3: detected capacity change from 0 to 4096 [ 439.056501][ T5769] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 440.150144][ T5769] Bluetooth: hci1: command 0x0406 tx timeout [ 440.635305][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.642726][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.808855][ T9558] ptrace attach of "./syz-executor exec"[5774] was attempted by "./syz-executor exec"[9558] [ 442.732937][ T5769] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 442.901135][ T9572] loop4: detected capacity change from 0 to 8192 [ 444.160121][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 444.233698][ T9591] loop2: detected capacity change from 0 to 4096 [ 444.320184][ T9593] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 444.540346][ T9597] ptrace attach of "./syz-executor exec"[5775] was attempted by "./syz-executor exec"[9597] [ 446.457637][ T51] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 447.850247][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 448.405670][ T9629] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[9629] [ 448.854898][ T9623] loop3: detected capacity change from 0 to 8192 [ 450.713721][ T5769] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 452.108110][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 453.883235][ T9670] syzkaller1: entered promiscuous mode [ 453.888936][ T9670] syzkaller1: entered allmulticast mode [ 457.268361][ T9690] loop3: detected capacity change from 0 to 4096 [ 457.412644][ T5769] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 457.811245][ T5769] Bluetooth: hci1: command 0x0406 tx timeout [ 458.669563][ T9710] netlink: 24 bytes leftover after parsing attributes in process `syz.4.948'. [ 459.825512][ T9724] IPVS: length: 24 != 24159191448 [ 462.983848][ T5769] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 463.225002][ T9761] netlink: 24 bytes leftover after parsing attributes in process `syz.4.959'. [ 463.465395][ T9751] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 463.952399][ T9772] netlink: 8 bytes leftover after parsing attributes in process `syz.1.963'. [ 466.310200][ T5778] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 466.530656][ T5778] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 466.570249][ T5778] usb 3-1: config 2 has no interface number 0 [ 466.585978][ T5778] usb 3-1: config 2 interface 88 altsetting 7 endpoint 0x6 has invalid maxpacket 256, setting to 64 [ 466.616798][ T5823] libceph: connect (1)[c::]:6789 error -101 [ 466.640434][ T9789] ceph: No mds server is up or the cluster is laggy [ 466.648482][ T5778] usb 3-1: config 2 interface 88 altsetting 7 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 466.660675][ T5823] libceph: mon0 (1)[c::]:6789 connect error [ 466.718199][ T5778] usb 3-1: config 2 interface 88 has no altsetting 0 [ 466.784927][ T5778] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 466.796954][ T5778] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.818442][ T5778] usb 3-1: Product: syz [ 466.830125][ T5778] usb 3-1: Manufacturer: syz [ 466.835237][ T5778] usb 3-1: SerialNumber: syz [ 466.883142][ T9784] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 466.909445][ T9784] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 467.170826][ T9784] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 467.178277][ T9784] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 467.641784][ T9796] netlink: 24 bytes leftover after parsing attributes in process `syz.4.969'. [ 468.270216][ T5778] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 468.294337][ T5778] asix: probe of 3-1:2.88 failed with error -32 [ 468.342831][ T5778] usb 3-1: USB disconnect, device number 9 [ 468.431507][ T5769] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 470.192863][ T9812] netlink: 8 bytes leftover after parsing attributes in process `syz.3.973'. [ 470.276440][ T9813] loop1: detected capacity change from 0 to 4096 [ 470.413900][ T9816] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 470.843717][ T9826] ptrace attach of "./syz-executor exec"[5767] was attempted by "./syz-executor exec"[9826] [ 470.880463][ T5823] libceph: connect (1)[c::]:6789 error -101 [ 470.894587][ T5823] libceph: mon0 (1)[c::]:6789 connect error [ 470.912539][ T9821] ceph: No mds server is up or the cluster is laggy [ 471.013896][ T9829] netlink: 24 bytes leftover after parsing attributes in process `syz.3.976'. [ 471.780729][ T9837] syzkaller1: entered promiscuous mode [ 472.392204][ T9837] syzkaller1: entered allmulticast mode [ 473.416926][ T51] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 473.471469][ T9844] loop4: detected capacity change from 0 to 8192 [ 474.380509][ T9857] loop2: detected capacity change from 0 to 4096 [ 474.545195][ T9859] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 474.587519][ T9860] netlink: 24 bytes leftover after parsing attributes in process `syz.4.985'. [ 476.752957][ T9887] loop4: detected capacity change from 0 to 8192 [ 477.292772][ T5769] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 477.627811][ T9899] netlink: 8 bytes leftover after parsing attributes in process `syz.4.997'. [ 477.684615][ T9900] loop1: detected capacity change from 0 to 4096 [ 477.862599][ T9903] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 478.001736][ T9905] netlink: 24 bytes leftover after parsing attributes in process `syz.4.998'. [ 479.467940][ T9918] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1001'. [ 481.209133][ T9929] loop1: detected capacity change from 0 to 131072 [ 481.456884][ T9929] F2FS-fs (loop1): invalid crc value [ 481.717902][ T9929] F2FS-fs (loop1): Found nat_bits in checkpoint [ 481.811066][ T9929] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 483.337124][ T51] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 484.653794][ T9961] loop9: detected capacity change from 0 to 7 [ 484.877006][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 484.886735][ C1] buffer_io_error: 7 callbacks suppressed [ 484.886750][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 484.911833][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 484.921241][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 484.943267][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 484.952791][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 484.993592][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.003175][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.013290][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.022659][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.117695][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.127146][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.136604][ T9961] ldm_validate_partition_table(): Disk read failed. [ 485.224008][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.233329][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.250310][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.259766][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.389247][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.398525][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.406734][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 485.416198][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 485.426839][ T9961] Dev loop9: unable to read RDB block 0 [ 485.457008][ T9961] loop9: unable to read partition table [ 485.463422][ T9961] loop9: partition table beyond EOD, truncated [ 485.506974][ T9961] loop_reread_partitions: partition scan of loop9 (þ被xüŸÑø éÚ¬§½dG¤´à–ƒÝ¡¯ â·û [ 485.506974][ T9961] ) failed (rc=-5) [ 485.775433][ T9970] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1013'. [ 486.055317][ T9972] loop1: detected capacity change from 0 to 4096 [ 486.689682][ T9974] IPVS: length: 24 != 24159191448 [ 486.829839][ T9982] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1015'. [ 487.022577][ T9984] syzkaller1: entered promiscuous mode [ 487.053391][ T9984] syzkaller1: entered allmulticast mode [ 487.379648][ T9986] loop4: detected capacity change from 0 to 32768 [ 487.453539][ T9986] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 487.505879][ T9986] XFS (loop4): Ending clean mount [ 487.521117][ T9986] XFS (loop4): Quotacheck needed: Please wait. [ 487.615070][ T9986] XFS (loop4): Quotacheck: Done. [ 488.382837][ T6013] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 490.793249][T10012] loop2: detected capacity change from 0 to 4096 [ 491.299701][ T5769] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 491.457307][T10028] syzkaller1: entered promiscuous mode [ 491.464178][T10028] syzkaller1: entered allmulticast mode [ 492.017418][T10033] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1027'. [ 492.230177][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 493.512079][T10047] loop1: detected capacity change from 0 to 131072 [ 493.548009][T10047] F2FS-fs (loop1): invalid crc value [ 493.558280][T10047] F2FS-fs (loop1): Found nat_bits in checkpoint [ 493.602520][T10047] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 494.393937][ T27] audit: type=1326 audit(1773871141.756:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10053 comm="syz.4.1030" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5d4e99c799 code=0x0 [ 495.683066][T10063] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 495.824534][T10067] syzkaller1: entered promiscuous mode [ 495.850142][T10067] syzkaller1: entered allmulticast mode [ 497.272469][ T51] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 497.648900][T10080] loop2: detected capacity change from 0 to 512 [ 497.765681][T10080] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 497.820408][T10080] ext4 filesystem being mounted at /267/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 497.866883][T10080] fs-verity (loop2, inode 15): Unrecognized descriptor size: 0 bytes [ 498.538864][T10091] loop1: detected capacity change from 0 to 4096 [ 498.648769][ T5774] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 498.765955][T10091] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 499.258812][ T27] audit: type=1326 audit(1773871146.636:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10102 comm="syz.3.1044" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2e5b79c799 code=0x0 [ 499.285168][T10106] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1041'. [ 500.448519][ T51] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 501.001388][T10111] loop1: detected capacity change from 0 to 32768 [ 501.032168][T10111] [ 501.032168][T10111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.032168][T10111] [ 501.231465][T10111] [ 501.231465][T10111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.231465][T10111] [ 501.284382][T10111] [ 501.284382][T10111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.284382][T10111] [ 501.348056][T10120] [ 501.348056][T10120] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.348056][T10120] [ 501.412221][T10111] [ 501.412221][T10111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.412221][T10111] [ 501.476204][T10111] [ 501.476204][T10111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.476204][T10111] [ 501.548178][T10126] loop4: detected capacity change from 0 to 512 [ 501.550156][T10120] [ 501.550156][T10120] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.550156][T10120] [ 501.588696][T10125] loop3: detected capacity change from 0 to 4096 [ 501.594706][T10111] [ 501.594706][T10111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.594706][T10111] [ 501.678011][T10126] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 501.702740][ T113] [ 501.702740][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 501.702740][ T113] [ 501.742467][T10126] ext4 filesystem being mounted at /246/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 501.829594][T10126] fs-verity (loop4, inode 15): Unrecognized descriptor size: 0 bytes [ 502.082143][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.096657][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.370340][ T39] [ 502.370340][ T39] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 502.370340][ T39] [ 502.460171][ T39] [ 502.460171][ T39] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 502.460171][ T39] [ 502.472929][ T5767] [ 502.472929][ T5767] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 502.472929][ T5767] [ 502.487933][ T5767] [ 502.487933][ T5767] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 502.487933][ T5767] [ 502.508625][ T112] [ 502.508625][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 502.508625][ T112] [ 502.540079][ T112] ================================================================== [ 502.548369][ T112] BUG: KASAN: slab-use-after-free in lmLogSync+0x952/0x9f0 [ 502.555680][ T112] Write of size 4 at addr ffff888079cc5a20 by task jfsCommit/112 [ 502.563507][ T112] [ 502.565913][ T112] CPU: 1 PID: 112 Comm: jfsCommit Not tainted syzkaller #0 [ 502.573385][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 502.583438][ T112] Call Trace: [ 502.586723][ T112] [ 502.589746][ T112] dump_stack_lvl+0x18c/0x250 [ 502.594527][ T112] ? __lock_acquire+0x7d40/0x7d40 [ 502.599685][ T112] ? show_regs_print_info+0x20/0x20 [ 502.604890][ T112] ? load_image+0x400/0x400 [ 502.609401][ T112] ? __virt_addr_valid+0x469/0x540 [ 502.614597][ T112] print_report+0xa8/0x210 [ 502.619011][ T112] ? lmLogSync+0x952/0x9f0 [ 502.623511][ T112] kasan_report+0x117/0x150 [ 502.628095][ T112] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 502.636281][ T112] ? lmLogSync+0x952/0x9f0 [ 502.642062][ T112] lmLogSync+0x952/0x9f0 [ 502.646847][ T112] ? lmWriteRecord+0x1ac0/0x1ac0 [ 502.652671][ T112] ? __rwlock_init+0x150/0x150 [ 502.658425][ T112] jfs_syncpt+0x7b/0x90 [ 502.662798][ T112] txEnd+0x2e5/0x520 [ 502.666990][ T112] jfs_lazycommit+0x5a4/0xa70 [ 502.671902][ T112] ? txFreelock+0x5a0/0x5a0 [ 502.676970][ T112] ? do_task_dead+0xd0/0xd0 [ 502.681859][ T112] ? __kthread_parkme+0x7a/0x1c0 [ 502.687347][ T112] kthread+0x2fa/0x390 [ 502.691714][ T112] ? txFreelock+0x5a0/0x5a0 [ 502.696681][ T112] ? kthread_blkcg+0xd0/0xd0 [ 502.701273][ T112] ret_from_fork+0x48/0x80 [ 502.705778][ T112] ? kthread_blkcg+0xd0/0xd0 [ 502.710464][ T112] ret_from_fork_asm+0x11/0x20 [ 502.715250][ T112] [ 502.718351][ T112] [ 502.720665][ T112] Allocated by task 10111: [ 502.725059][ T112] kasan_set_track+0x4e/0x70 [ 502.729726][ T112] __kasan_kmalloc+0x8f/0xa0 [ 502.734301][ T112] lmLogOpen+0x2df/0xfb0 [ 502.738613][ T112] jfs_mount_rw+0xef/0x670 [ 502.743193][ T112] jfs_fill_super+0x598/0xad0 [ 502.748024][ T112] mount_bdev+0x221/0x2d0 [ 502.752441][ T112] legacy_get_tree+0xea/0x180 [ 502.757228][ T112] vfs_get_tree+0x8c/0x280 [ 502.761717][ T112] do_new_mount+0x24b/0xa40 [ 502.766297][ T112] __se_sys_mount+0x2e7/0x3d0 [ 502.771135][ T112] do_syscall_64+0x55/0xa0 [ 502.775666][ T112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 502.781593][ T112] [ 502.783901][ T112] Freed by task 5767: [ 502.787866][ T112] kasan_set_track+0x4e/0x70 [ 502.792690][ T112] kasan_save_free_info+0x2e/0x50 [ 502.797878][ T112] ____kasan_slab_free+0x126/0x1e0 [ 502.803479][ T112] slab_free_freelist_hook+0x130/0x1a0 [ 502.809105][ T112] __kmem_cache_free+0xba/0x1e0 [ 502.813954][ T112] lmLogClose+0x297/0x520 [ 502.818274][ T112] jfs_umount+0x2ef/0x3c0 [ 502.822790][ T112] jfs_put_super+0x8c/0x190 [ 502.827290][ T112] generic_shutdown_super+0x134/0x2b0 [ 502.832781][ T112] kill_block_super+0x44/0x90 [ 502.837458][ T112] deactivate_locked_super+0x97/0x100 [ 502.843174][ T112] cleanup_mnt+0x43b/0x4d0 [ 502.847673][ T112] task_work_run+0x1d4/0x260 [ 502.852443][ T112] exit_to_user_mode_loop+0xe6/0x110 [ 502.857893][ T112] exit_to_user_mode_prepare+0xee/0x180 [ 502.863605][ T112] syscall_exit_to_user_mode+0x1a/0x50 [ 502.869060][ T112] do_syscall_64+0x61/0xa0 [ 502.873467][ T112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 502.879346][ T112] [ 502.882007][ T112] Last potentially related work creation: [ 502.888404][ T112] kasan_save_stack+0x3e/0x60 [ 502.893878][ T112] __kasan_record_aux_stack+0xaf/0xc0 [ 502.900332][ T112] kvfree_call_rcu+0xee/0x790 [ 502.905310][ T112] neigh_remove_one+0x5f1/0x700 [ 502.910623][ T112] ___neigh_create+0x467/0x2440 [ 502.917237][ T112] ip6_finish_output2+0x1581/0x1630 [ 502.923163][ T112] ndisc_send_skb+0xc26/0x14f0 [ 502.928188][ T112] addrconf_rs_timer+0x2d5/0x630 [ 502.933226][ T112] call_timer_fn+0x189/0x540 [ 502.938000][ T112] __run_timers+0x542/0x800 [ 502.942569][ T112] run_timer_softirq+0x67/0xf0 [ 502.947386][ T112] handle_softirqs+0x280/0x820 [ 502.952238][ T112] __irq_exit_rcu+0xd3/0x190 [ 502.956991][ T112] irq_exit_rcu+0x9/0x20 [ 502.961582][ T112] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 502.967649][ T112] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 502.973713][ T112] [ 502.976047][ T112] The buggy address belongs to the object at ffff888079cc5800 [ 502.976047][ T112] which belongs to the cache kmalloc-1k of size 1024 [ 502.990894][ T112] The buggy address is located 544 bytes inside of [ 502.990894][ T112] freed 1024-byte region [ffff888079cc5800, ffff888079cc5c00) [ 503.005571][ T112] [ 503.008316][ T112] The buggy address belongs to the physical page: [ 503.015303][ T112] page:ffffea0001e73000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79cc0 [ 503.026326][ T112] head:ffffea0001e73000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 503.035618][ T112] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 503.044074][ T112] page_type: 0xffffffff() [ 503.048434][ T112] raw: 00fff00000000840 ffff888017c41dc0 dead000000000100 dead000000000122 [ 503.057185][ T112] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 503.065930][ T112] page dumped because: kasan: bad access detected [ 503.072362][ T112] page_owner tracks the page as allocated [ 503.078407][ T112] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9, tgid 9 (kworker/0:1), ts 73093933228, free_ts 73022871551 [ 503.097590][ T112] post_alloc_hook+0x1c1/0x200 [ 503.102448][ T112] get_page_from_freelist+0x1951/0x19e0 [ 503.108412][ T112] __alloc_pages+0x1f0/0x460 [ 503.112989][ T112] alloc_slab_page+0x5d/0x160 [ 503.117737][ T112] new_slab+0x87/0x2d0 [ 503.121974][ T112] ___slab_alloc+0xc5d/0x12f0 [ 503.126913][ T112] __kmem_cache_alloc_node+0x19e/0x250 [ 503.133742][ T112] __kmalloc+0xa4/0x230 [ 503.141378][ T112] ___neigh_create+0x6d2/0x2440 [ 503.146974][ T112] ip6_finish_output2+0x1581/0x1630 [ 503.153218][ T112] NF_HOOK+0x167/0x4a0 [ 503.158321][ T112] mld_sendpack+0x7f5/0xd50 [ 503.164380][ T112] mld_ifc_work+0x835/0xb40 [ 503.170135][ T112] process_scheduled_works+0xa5d/0x15d0 [ 503.175861][ T112] worker_thread+0xa55/0xfc0 [ 503.180557][ T112] kthread+0x2fa/0x390 [ 503.184987][ T112] page last free stack trace: [ 503.189786][ T112] free_unref_page_prepare+0x7b2/0x8c0 [ 503.195237][ T112] free_unref_page+0x32/0x2e0 [ 503.200113][ T112] __unfreeze_partials+0x1cf/0x210 [ 503.205425][ T112] put_cpu_partial+0x17c/0x250 [ 503.210530][ T112] __slab_free+0x319/0x400 [ 503.215048][ T112] qlist_free_all+0x75/0xd0 [ 503.219559][ T112] kasan_quarantine_reduce+0x143/0x160 [ 503.225385][ T112] __kasan_slab_alloc+0x22/0x80 [ 503.230355][ T112] slab_post_alloc_hook+0x6e/0x4b0 [ 503.235719][ T112] kmem_cache_alloc_node+0x14c/0x320 [ 503.241135][ T112] __alloc_skb+0x103/0x2c0 [ 503.245765][ T112] mld_newpack+0x154/0xbe0 [ 503.250261][ T112] add_grhead+0x5a/0x2a0 [ 503.254589][ T112] add_grec+0x13ad/0x1660 [ 503.258958][ T112] mld_ifc_work+0x6e6/0xb40 [ 503.263446][ T112] process_scheduled_works+0xa5d/0x15d0 [ 503.269066][ T112] [ 503.271386][ T112] Memory state around the buggy address: [ 503.277258][ T112] ffff888079cc5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 503.285401][ T112] ffff888079cc5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 503.293534][ T112] >ffff888079cc5a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 503.301788][ T112] ^ [ 503.306941][ T112] ffff888079cc5a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 503.315001][ T112] ffff888079cc5b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 503.323141][ T112] ================================================================== [ 503.331381][ C1] vkms_vblank_simulate: vblank timer overrun [ 503.567200][ T112] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 503.574694][ T112] CPU: 1 PID: 112 Comm: jfsCommit Not tainted syzkaller #0 [ 503.582166][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 503.592534][ T112] Call Trace: [ 503.595908][ T112] [ 503.598983][ T112] dump_stack_lvl+0x18c/0x250 [ 503.603766][ T112] ? show_regs_print_info+0x20/0x20 [ 503.609250][ T112] ? load_image+0x400/0x400 [ 503.613869][ T112] panic+0x2dc/0x730 [ 503.617778][ T112] ? bpf_jit_dump+0xd0/0xd0 [ 503.622460][ T112] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 503.628624][ T112] ? _raw_spin_unlock+0x40/0x40 [ 503.635615][ T112] ? print_memory_metadata+0x314/0x400 [ 503.642207][ T112] ? lmLogSync+0x952/0x9f0 [ 503.648144][ T112] check_panic_on_warn+0x84/0xa0 [ 503.654541][ T112] ? lmLogSync+0x952/0x9f0 [ 503.660483][ T112] end_report+0x6f/0x130 [ 503.665183][ T112] kasan_report+0x128/0x150 [ 503.670471][ T112] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 503.676561][ T112] ? lmLogSync+0x952/0x9f0 [ 503.680994][ T112] lmLogSync+0x952/0x9f0 [ 503.685437][ T112] ? lmWriteRecord+0x1ac0/0x1ac0 [ 503.691704][ T112] ? __rwlock_init+0x150/0x150 [ 503.696675][ T112] jfs_syncpt+0x7b/0x90 [ 503.701351][ T112] txEnd+0x2e5/0x520 [ 503.705442][ T112] jfs_lazycommit+0x5a4/0xa70 [ 503.710492][ T112] ? txFreelock+0x5a0/0x5a0 [ 503.715297][ T112] ? do_task_dead+0xd0/0xd0 [ 503.719816][ T112] ? __kthread_parkme+0x7a/0x1c0 [ 503.724853][ T112] kthread+0x2fa/0x390 [ 503.728929][ T112] ? txFreelock+0x5a0/0x5a0 [ 503.733441][ T112] ? kthread_blkcg+0xd0/0xd0 [ 503.738032][ T112] ret_from_fork+0x48/0x80 [ 503.742455][ T112] ? kthread_blkcg+0xd0/0xd0 [ 503.747050][ T112] ret_from_fork_asm+0x11/0x20 [ 503.752107][ T112] [ 503.755553][ T112] Kernel Offset: disabled [ 503.760170][ T112] Rebooting in 86400 seconds..