Warning: Permanently added '10.128.1.218' (ED25519) to the list of known hosts.
2026/02/13 02:38:36 parsed 1 programs
[ 74.564385][ T5823] cgroup: Unknown subsys name 'net'
[ 74.671694][ T5823] cgroup: Unknown subsys name 'cpuset'
[ 74.681949][ T5823] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 76.158753][ T5823] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 79.327199][ T5838] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 79.903303][ T5849] chnl_net:caif_netlink_parms(): no params data found
[ 80.048673][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.056258][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.064164][ T5849] bridge_slave_0: entered allmulticast mode
[ 80.072047][ T5849] bridge_slave_0: entered promiscuous mode
[ 80.087247][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.096203][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.104652][ T5849] bridge_slave_1: entered allmulticast mode
[ 80.114100][ T5849] bridge_slave_1: entered promiscuous mode
[ 80.154828][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 80.172086][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 80.209699][ T5849] team0: Port device team_slave_0 added
[ 80.220156][ T5849] team0: Port device team_slave_1 added
[ 80.251241][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 80.258916][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.287734][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 80.303899][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 80.312568][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.342076][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 80.390637][ T5849] hsr_slave_0: entered promiscuous mode
[ 80.398897][ T5849] hsr_slave_1: entered promiscuous mode
[ 80.582177][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 80.600312][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 80.615179][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.627470][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.676555][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.684622][ T5849] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 80.694273][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.703373][ T5849] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.791346][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0
[ 80.816936][ T141] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.828935][ T141] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.846603][ T5849] 8021q: adding VLAN 0 to HW filter on device team0
[ 80.862243][ T1101] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.871154][ T1101] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.891201][ T1101] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.900685][ T1101] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.105219][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 81.163620][ T5849] veth0_vlan: entered promiscuous mode
[ 81.180797][ T5849] veth1_vlan: entered promiscuous mode
[ 81.223986][ T5849] veth0_macvtap: entered promiscuous mode
[ 81.238466][ T5849] veth1_macvtap: entered promiscuous mode
[ 81.264003][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 81.285708][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 81.307034][ T49] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.320691][ T49] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.332901][ T49] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.342578][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.507326][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.598542][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.709962][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.729787][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 81.748002][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 81.801691][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.838536][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 81.847487][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.510173][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 83.522028][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 83.531339][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 83.542307][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 83.552871][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 83.715201][ T49] bridge_slave_1: left allmulticast mode
[ 83.724750][ T49] bridge_slave_1: left promiscuous mode
[ 83.732356][ T49] bridge0: port 2(bridge_slave_1) entered disabled state
[ 83.750010][ T49] bridge_slave_0: left allmulticast mode
[ 83.757191][ T49] bridge_slave_0: left promiscuous mode
[ 83.763724][ T49] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.019103][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 84.035890][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 84.049018][ T49] bond0 (unregistering): Released all slaves
[ 84.169982][ T49] hsr_slave_0: left promiscuous mode
[ 84.188071][ T49] hsr_slave_1: left promiscuous mode
[ 84.196482][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 84.208692][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 84.219314][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 84.231804][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 84.271001][ T49] veth1_macvtap: left promiscuous mode
[ 84.288451][ T49] veth0_macvtap: left promiscuous mode
[ 84.296658][ T49] veth1_vlan: left promiscuous mode
[ 84.327760][ T49] veth0_vlan: left promiscuous mode
[ 84.676711][ T49] team0 (unregistering): Port device team_slave_1 removed
[ 84.693380][ T49] team0 (unregistering): Port device team_slave_0 removed
[ 86.675681][ T10] cfg80211: failed to load regulatory.db
2026/02/13 02:38:51 executed programs: 0
[ 87.214778][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 87.228722][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 87.238516][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 87.246718][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 87.256964][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 87.607369][ T5983] chnl_net:caif_netlink_parms(): no params data found
[ 87.767035][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.775428][ T5983] bridge0: port 1(bridge_slave_0) entered disabled state
[ 87.784672][ T5983] bridge_slave_0: entered allmulticast mode
[ 87.796599][ T5983] bridge_slave_0: entered promiscuous mode
[ 87.806598][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.816180][ T5983] bridge0: port 2(bridge_slave_1) entered disabled state
[ 87.825736][ T5983] bridge_slave_1: entered allmulticast mode
[ 87.834591][ T5983] bridge_slave_1: entered promiscuous mode
[ 87.886118][ T5983] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 87.906421][ T5983] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 87.955804][ T5983] team0: Port device team_slave_0 added
[ 87.974853][ T5983] team0: Port device team_slave_1 added
[ 88.022586][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 88.030040][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 88.066316][ T5983] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 88.083848][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 88.092470][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 88.127079][ T5983] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 88.186907][ T5983] hsr_slave_0: entered promiscuous mode
[ 88.196268][ T5983] hsr_slave_1: entered promiscuous mode
[ 88.725459][ T5983] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 88.754086][ T5983] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 88.769129][ T5983] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 88.786338][ T5983] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 88.929757][ T5983] 8021q: adding VLAN 0 to HW filter on device bond0
[ 88.968209][ T5983] 8021q: adding VLAN 0 to HW filter on device team0
[ 88.990396][ T49] bridge0: port 1(bridge_slave_0) entered blocking state
[ 88.999737][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 89.030722][ T49] bridge0: port 2(bridge_slave_1) entered blocking state
[ 89.040906][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 89.309503][ T51] Bluetooth: hci0: command tx timeout
[ 89.500580][ T5983] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 89.630102][ T5983] veth0_vlan: entered promiscuous mode
[ 89.651868][ T5983] veth1_vlan: entered promiscuous mode
[ 89.720509][ T5983] veth0_macvtap: entered promiscuous mode
[ 89.746324][ T5983] veth1_macvtap: entered promiscuous mode
[ 89.793884][ T5983] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 89.815693][ T5983] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 89.839749][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.850014][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.862122][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.885405][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.980684][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.996998][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.046891][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.059737][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.130042][ T51] ==================================================================
[ 90.138666][ T51] BUG: KASAN: stack-out-of-bounds in l2cap_send_cmd+0x2a3/0xb90
[ 90.147591][ T51] Read of size 22 at addr ffffc90000bb7540 by task kworker/u9:0/51
[ 90.157076][ T51]
[ 90.160079][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 90.160109][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[ 90.160121][ T51] Workqueue: hci0 hci_rx_work
[ 90.160159][ T51] Call Trace:
[ 90.160167][ T51]
[ 90.160178][ T51] dump_stack_lvl+0xe8/0x150
[ 90.160207][ T51] print_report+0xba/0x230
[ 90.160231][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 90.160250][ T51] kasan_report+0x117/0x150
[ 90.160271][ T51] ? trace_kmem_cache_alloc+0x29/0xf0
[ 90.160298][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 90.160318][ T51] kasan_check_range+0x264/0x2c0
[ 90.160336][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 90.160353][ T51] __asan_memcpy+0x29/0x70
[ 90.160376][ T51] l2cap_send_cmd+0x2a3/0xb90
[ 90.160397][ T51] l2cap_recv_frame+0xd352/0x10110
[ 90.160421][ T51] ? lock_release+0x4b/0x3d0
[ 90.160441][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 90.160463][ T51] ? unwind_next_frame+0xa5/0x23c0
[ 90.160487][ T51] ? rcu_is_watching+0x15/0xb0
[ 90.160510][ T51] ? lock_release+0x4b/0x3d0
[ 90.160529][ T51] ? unwind_next_frame+0x1aaf/0x23c0
[ 90.160553][ T51] ? unwind_next_frame+0xa5/0x23c0
[ 90.160575][ T51] ? unwind_next_frame+0x1aaf/0x23c0
[ 90.160599][ T51] ? __pfx_l2cap_recv_frame+0x10/0x10
[ 90.160619][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 90.160642][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 90.160664][ T51] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 90.160686][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 90.160711][ T51] ? stack_trace_save+0xa9/0x100
[ 90.160727][ T51] ? __pfx_stack_trace_save+0x10/0x10
[ 90.160749][ T51] ? check_path+0x21/0x40
[ 90.160772][ T51] ? check_noncircular+0xda/0x150
[ 90.160796][ T51] ? add_lock_to_list+0xc7/0x100
[ 90.160821][ T51] ? lockdep_unlock+0x5d/0xd0
[ 90.160838][ T51] ? __lock_acquire+0x146e/0x2cf0
[ 90.160874][ T51] ? __mutex_trylock_common+0x158/0x260
[ 90.160901][ T51] ? __pfx___mutex_trylock_common+0x10/0x10
[ 90.160926][ T51] ? rcu_is_watching+0x15/0xb0
[ 90.160948][ T51] ? trace_contention_end+0x3d/0x150
[ 90.160974][ T51] ? __mutex_lock+0x319/0x1300
[ 90.160998][ T51] ? l2cap_recv_acldata+0x2e3/0x13e0
[ 90.161022][ T51] ? l2cap_recv_acldata+0x30b/0x13e0
[ 90.161044][ T51] ? __mutex_unlock_slowpath+0x1bd/0x7d0
[ 90.161064][ T51] ? __pfx___mutex_lock+0x10/0x10
[ 90.161085][ T51] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 90.161104][ T51] ? l2cap_conn_hold_unless_zero+0x179/0x2b0
[ 90.161127][ T51] ? __pfx_l2cap_conn_hold_unless_zero+0x10/0x10
[ 90.161150][ T51] ? l2cap_recv_acldata+0x41/0x13e0
[ 90.161174][ T51] l2cap_recv_acldata+0x7e9/0x13e0
[ 90.161200][ T51] hci_rx_work+0x4f9/0x1040
[ 90.161224][ T51] ? process_one_work+0x87c/0x1650
[ 90.161247][ T51] process_one_work+0x949/0x1650
[ 90.161277][ T51] ? __pfx_process_one_work+0x10/0x10
[ 90.161297][ T51] ? do_raw_spin_lock+0x12b/0x2f0
[ 90.161321][ T51] worker_thread+0xb46/0x1140
[ 90.161353][ T51] kthread+0x388/0x470
[ 90.161370][ T51] ? __pfx_worker_thread+0x10/0x10
[ 90.161390][ T51] ? __pfx_kthread+0x10/0x10
[ 90.161407][ T51] ret_from_fork+0x51e/0xb90
[ 90.161431][ T51] ? __pfx_ret_from_fork+0x10/0x10
[ 90.161452][ T51] ? __switch_to+0xc7d/0x1450
[ 90.161474][ T51] ? __pfx_kthread+0x10/0x10
[ 90.161490][ T51] ret_from_fork_asm+0x1a/0x30
[ 90.161519][ T51]
[ 90.161526][ T51]
[ 90.558182][ T51] The buggy address belongs to stack of task kworker/u9:0/51
[ 90.565831][ T51] and is located at offset 128 in frame:
[ 90.572451][ T51] l2cap_recv_frame+0x0/0x10110
[ 90.577636][ T51]
[ 90.580238][ T51] This frame has 26 objects:
[ 90.586524][ T51] [32, 34) 'rsp.i238.i.i'
[ 90.586543][ T51] [48, 88) 'chan.i.i.i'
[ 90.592590][ T51] [128, 146) 'pdu_u.i.i.i'
[ 90.597315][ T51] [192, 202) 'rsp.i94.i.i'
[ 90.602817][ T51] [224, 226) 'rsp.i.i.i111'
[ 90.608387][ T51] [240, 242) 'rej.i'
[ 90.614571][ T51] [256, 258) 'rej.i145.i'
[ 90.620385][ T51] [272, 274) 'rej.i143.i'
[ 90.626722][ T51] [288, 290) 'req.i229.i.i'
[ 90.631929][ T51] [304, 312) 'buf.i222.i.i'
[ 90.638101][ T51] [336, 348) 'buf29.i.i.i'
[ 90.643087][ T51] [368, 372) 'rsp49.i.i.i'
[ 90.648034][ T51] [384, 393) 'rfc.i.i118.i.i'
[ 90.652809][ T51] [416, 480) 'buf.i119.i.i'
[ 90.658367][ T51] [512, 576) 'req.i120.i.i'
[ 90.664230][ T51] [608, 617) 'rfc.i.i.i.i'
[ 90.670296][ T51] [640, 656) 'efs.i.i.i.i'
[ 90.674995][ T51] [672, 678) 'rej.i371.i.i.i'
[ 90.680117][ T51] [704, 710) 'rej.i.i.i.i'
[ 90.687156][ T51] [736, 800) 'rsp.i.i.i'
[ 90.692811][ T51] [832, 896) 'buf.i.i.i'
[ 90.699580][ T51] [928, 1056) 'req.i.i.i'
[ 90.705786][ T51] [1088, 1096) 'rsp.i.i.i.i'
[ 90.711440][ T51] [1120, 1122) 'info.i.i.i.i'
[ 90.718583][ T51] [1136, 1264) 'buf.i.i.i.i'
[ 90.724328][ T51] [1296, 1298) 'rej.i.i'
[ 90.731480][ T51]
[ 90.739751][ T51] The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90000bb0000 allocated at copy_process+0x508/0x3cf0
[ 90.756234][ T51] The buggy address belongs to the physical page:
[ 90.764954][ T51] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bf87
[ 90.774076][ T51] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 90.783210][ T51] raw: 00fff00000000000 ffffea00006fe1c8 ffffea00006fe1c8 0000000000000000
[ 90.793113][ T51] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 90.803075][ T51] page dumped because: kasan: bad access detected
[ 90.810286][ T51] page_owner tracks the page as allocated
[ 90.816829][ T51] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 2, tgid 2 (kthreadd), ts 3686034072, free_ts 0
[ 90.838573][ T51] post_alloc_hook+0x231/0x280
[ 90.843366][ T51] get_page_from_freelist+0x24dc/0x2580
[ 90.849106][ T51] __alloc_frozen_pages_noprof+0x18d/0x380
[ 90.855287][ T51] __alloc_pages_noprof+0xa/0x30
[ 90.860877][ T51] __vmalloc_node_range_noprof+0x7be/0x1730
[ 90.867702][ T51] __vmalloc_node_noprof+0xc2/0x100
[ 90.873547][ T51] dup_task_struct+0x228/0x9a0
[ 90.878919][ T51] copy_process+0x508/0x3cf0
[ 90.884040][ T51] kernel_clone+0x248/0x8e0
[ 90.888995][ T51] kernel_thread+0x13f/0x1b0
[ 90.893666][ T51] kthreadd+0x4ec/0x6e0
[ 90.897832][ T51] ret_from_fork+0x51e/0xb90
[ 90.902560][ T51] ret_from_fork_asm+0x1a/0x30
[ 90.908384][ T51] page_owner free stack trace missing
[ 90.913933][ T51]
[ 90.916243][ T51] Memory state around the buggy address:
[ 90.922064][ T51] ffffc90000bb7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 90.930486][ T51] ffffc90000bb7480: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 f8 f8
[ 90.939862][ T51] >ffffc90000bb7500: f8 f8 f8 f2 f2 f2 f2 f2 00 00 02 f2 f2 f2 f2 f2
[ 90.948198][ T51] ^
[ 90.954879][ T51] ffffc90000bb7580: f8 f8 f2 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2
[ 90.964612][ T51] ffffc90000bb7600: f2 f2 f8 f8 f2 f2 f8 f2 f8 f8 f2 f2 f8 f8 f8 f8
[ 90.973826][ T51] ==================================================================
[ 90.991682][ T51] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 90.999686][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 91.011745][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[ 91.024404][ T51] Workqueue: hci0 hci_rx_work
[ 91.029493][ T51] Call Trace:
[ 91.034100][ T51]
[ 91.037758][ T51] vpanic+0x56c/0xa60
[ 91.043178][ T51] ? __pfx_vpanic+0x10/0x10
[ 91.049049][ T51] panic+0xc5/0xd0
[ 91.053079][ T51] ? __pfx_panic+0x10/0x10
[ 91.057692][ T51] ? preempt_schedule_thunk+0x16/0x30
[ 91.063771][ T51] ? preempt_schedule_thunk+0x16/0x30
[ 91.069292][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 91.075346][ T51] check_panic_on_warn+0x89/0xb0
[ 91.080835][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 91.086335][ T51] end_report+0x73/0x180
[ 91.091978][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 91.097534][ T51] kasan_report+0x128/0x150
[ 91.102760][ T51] ? trace_kmem_cache_alloc+0x29/0xf0
[ 91.109531][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 91.115311][ T51] kasan_check_range+0x264/0x2c0
[ 91.122098][ T51] ? l2cap_send_cmd+0x2a3/0xb90
[ 91.128296][ T51] __asan_memcpy+0x29/0x70
[ 91.133645][ T51] l2cap_send_cmd+0x2a3/0xb90
[ 91.139045][ T51] l2cap_recv_frame+0xd352/0x10110
[ 91.146295][ T51] ? lock_release+0x4b/0x3d0
[ 91.151703][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 91.157997][ T51] ? unwind_next_frame+0xa5/0x23c0
[ 91.164091][ T51] ? rcu_is_watching+0x15/0xb0
[ 91.169969][ T51] ? lock_release+0x4b/0x3d0
[ 91.174889][ T51] ? unwind_next_frame+0x1aaf/0x23c0
[ 91.181525][ T51] ? unwind_next_frame+0xa5/0x23c0
[ 91.188594][ T51] ? unwind_next_frame+0x1aaf/0x23c0
[ 91.195014][ T51] ? __pfx_l2cap_recv_frame+0x10/0x10
[ 91.200918][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 91.206935][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 91.213297][ T51] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 91.221358][ T51] ? ret_from_fork_asm+0x1a/0x30
[ 91.227285][ T51] ? stack_trace_save+0xa9/0x100
[ 91.233090][ T51] ? __pfx_stack_trace_save+0x10/0x10
[ 91.239903][ T51] ? check_path+0x21/0x40
[ 91.244912][ T51] ? check_noncircular+0xda/0x150
[ 91.251206][ T51] ? add_lock_to_list+0xc7/0x100
[ 91.257651][ T51] ? lockdep_unlock+0x5d/0xd0
[ 91.263250][ T51] ? __lock_acquire+0x146e/0x2cf0
[ 91.269079][ T51] ? __mutex_trylock_common+0x158/0x260
[ 91.276065][ T51] ? __pfx___mutex_trylock_common+0x10/0x10
[ 91.283459][ T51] ? rcu_is_watching+0x15/0xb0
[ 91.288502][ T51] ? trace_contention_end+0x3d/0x150
[ 91.294410][ T51] ? __mutex_lock+0x319/0x1300
[ 91.302058][ T51] ? l2cap_recv_acldata+0x2e3/0x13e0
[ 91.308595][ T51] ? l2cap_recv_acldata+0x30b/0x13e0
[ 91.314935][ T51] ? __mutex_unlock_slowpath+0x1bd/0x7d0
[ 91.321726][ T51] ? __pfx___mutex_lock+0x10/0x10
[ 91.327904][ T51] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 91.334722][ T51] ? l2cap_conn_hold_unless_zero+0x179/0x2b0
[ 91.343251][ T51] ? __pfx_l2cap_conn_hold_unless_zero+0x10/0x10
[ 91.351257][ T51] ? l2cap_recv_acldata+0x41/0x13e0
[ 91.359108][ T51] l2cap_recv_acldata+0x7e9/0x13e0
[ 91.364420][ T51] hci_rx_work+0x4f9/0x1040
[ 91.369382][ T51] ? process_one_work+0x87c/0x1650
[ 91.375883][ T51] process_one_work+0x949/0x1650
[ 91.381490][ T51] ? __pfx_process_one_work+0x10/0x10
[ 91.389228][ T51] ? do_raw_spin_lock+0x12b/0x2f0
[ 91.396016][ T51] worker_thread+0xb46/0x1140
[ 91.401331][ T51] kthread+0x388/0x470
[ 91.407527][ T51] ? __pfx_worker_thread+0x10/0x10
[ 91.413808][ T51] ? __pfx_kthread+0x10/0x10
[ 91.419034][ T51] ret_from_fork+0x51e/0xb90
[ 91.425321][ T51] ? __pfx_ret_from_fork+0x10/0x10
[ 91.432748][ T51] ? __switch_to+0xc7d/0x1450
[ 91.439126][ T51] ? __pfx_kthread+0x10/0x10
[ 91.444521][ T51] ret_from_fork_asm+0x1a/0x30
[ 91.450447][ T51]
[ 91.454147][ T51] Kernel Offset: disabled
[ 91.459647][ T51] Rebooting in 86400 seconds..