last executing test programs:

78.991368ms ago: executing program 1 (id=127):
syz_open_dev$drirender(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$drirender(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$drirender(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$drirender(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$drirender(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$drirender(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$drirender(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$drirender(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$drirender(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$drirender(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$drirender(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$drirender(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$drirender(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$drirender(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$drirender(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$drirender(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$drirender(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$drirender(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$drirender(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$drirender(&(0x7f0000000500), 0x4, 0x800)

78.924688ms ago: executing program 2 (id=128):
munmap(0x0, 0x0)

78.796208ms ago: executing program 3 (id=129):
sched_setscheduler(0x0, 0x0, &(0x7f0000000000))

78.724308ms ago: executing program 4 (id=130):
inotify_init1(0x0)

78.625668ms ago: executing program 1 (id=131):
setregid(0x0, 0x0)

78.536648ms ago: executing program 3 (id=132):
sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

58.165118ms ago: executing program 2 (id=134):
msync(0x0, 0x0, 0x0)

58.042869ms ago: executing program 4 (id=135):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/logging', 0x2, 0x0)

57.979478ms ago: executing program 1 (id=136):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control', 0x800, 0x0)

57.880549ms ago: executing program 3 (id=137):
mq_timedsend(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)

57.779429ms ago: executing program 0 (id=138):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptp1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptp1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptp1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptp1', 0x800, 0x0)

57.721849ms ago: executing program 2 (id=139):
dup(0xffffffffffffffff)

57.659269ms ago: executing program 4 (id=140):
io_uring_setup(0x0, &(0x7f0000000000))

29.731649ms ago: executing program 0 (id=141):
socket$qrtr(0x2a, 0x2, 0x0)

29.529229ms ago: executing program 1 (id=142):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dma_heap/system', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dma_heap/system', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dma_heap/system', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dma_heap/system', 0x800, 0x0)

29.360709ms ago: executing program 3 (id=143):
syz_init_net_socket$ax25(0x3, 0x2, 0x0)

29.277549ms ago: executing program 0 (id=144):
listns(&(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0)

29.175249ms ago: executing program 4 (id=145):
syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0)

29.103049ms ago: executing program 2 (id=146):
clock_adjtime(0x0, &(0x7f0000000000))

28.966099ms ago: executing program 0 (id=147):
mbind(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0)

28.844009ms ago: executing program 1 (id=148):
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

28.786589ms ago: executing program 3 (id=149):
semop(0x0, &(0x7f0000000000), 0x0)

757.64µs ago: executing program 2 (id=150):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

563.99µs ago: executing program 4 (id=151):
statx(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000))

499.58µs ago: executing program 1 (id=152):
msgget(0xffffffffffffffff, 0x0)

446.97µs ago: executing program 3 (id=153):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx', 0x800, 0x0)

375.36µs ago: executing program 0 (id=154):
socket$vsock_dgram(0x28, 0x2, 0x0)

277.63µs ago: executing program 0 (id=155):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0)

204.57µs ago: executing program 4 (id=156):
setrlimit(0x0, &(0x7f0000000000))

0s ago: executing program 2 (id=157):
cachestat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0)

0s ago: executing program 4 (id=162):
io_destroy(0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.35' (ED25519) to the list of known hosts.
[   29.342123][ T4035] cgroup: Unknown subsys name 'net'
[   29.601397][ T4035] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   29.888677][ T4035] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k SSFS
[   31.126880][ T4213] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP
[   31.128139][ T4213] Modules linked in:
[   31.128853][ T4213] CPU: 0 PID: 4213 Comm: syz.4.162 Not tainted syzkaller #0
[   31.130021][ T4213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
[   31.131685][ T4213] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc)
[   31.132959][ T4213] pc : lookup_ioctx+0x10c/0x7c0
[   31.133809][ T4213] lr : lookup_ioctx+0xe8/0x7c0
[   31.134658][ T4213] sp : ffff80001fca7c40
[   31.135425][ T4213] x29: ffff80001fca7c40 x28: ffff0000cc5c3680 x27: 0000000000000000
[   31.136759][ T4213] x26: 1fffe000198b86d0 x25: 1ffff00003f94fd6 x24: ffff0000ce9f5080
[   31.137995][ T4213] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000
[   31.139258][ T4213] x20: ffff0000cc5c3680 x19: 0000000000000000 x18: 0000000000000000
[   31.140536][ T4213] x17: 0000000000000000 x16: ffff800008a30084 x15: 0000000000000000
[   31.141746][ T4213] x14: 0000000000000003 x13: 1ffff0000287002b x12: 0000000097863b1e
[   31.142873][ T4213] x11: ff80800008a30060 x10: 0000000000000000 x9 : 0000ffffffffffff
[   31.144091][ T4213] x8 : 0000000000000000 x7 : ffff800008762410 x6 : 0000000000000000
[   31.145361][ T4213] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
[   31.146570][ T4213] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
[   31.147782][ T4213] Call trace:
[   31.148306][ T4213]  lookup_ioctx+0x10c/0x7c0
[   31.149030][ T4213]  __arm64_sys_io_destroy+0x9c/0x1d8
[   31.149881][ T4213]  invoke_syscall+0x98/0x2b0
[   31.150591][ T4213]  el0_svc_common+0x13c/0x258
[   31.151351][ T4213]  do_el0_svc+0x5c/0x140
[   31.152060][ T4213]  el0_svc+0x78/0x1d0
[   31.152695][ T4213]  el0t_64_sync_handler+0xcc/0xe4
[   31.153475][ T4213]  el0t_64_sync+0x1a0/0x1a4
[   31.154163][ T4213] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) 
[   31.155248][ T4213] ---[ end trace e1f566e513909cac ]---
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   31.347803][ T4213] Kernel panic - not syncing: Oops - BTI: Fatal exception
[   31.348972][ T4213] SMP: stopping secondary CPUs
[   31.349754][ T4213] Kernel Offset: disabled
[   31.350438][ T4213] CPU features: 0x8,000003c1,7d33ffd9
[   31.351318][ T4213] Memory Limit: none
[   31.534605][ T4213] Rebooting in 86400 seconds..