#!/bin/sh

# Kernel page fault with the following non-sleepable locks held:
# exclusive sleep mutex CAM device lock (CAM device lock) r = 0 (0xfffff80006bd2cd0) locked @ cam/scsi/scsi_pass.c:1766
# stack backtrace:
# #0 0xffffffff80c4787c at witness_debugger+0x6c
# #1 0xffffffff80c49189 at witness_warn+0x4c9
# #2 0xffffffff81131d8c at trap_pfault+0x8c
# #3 0xffffffff811015a8 at calltrap+0x8
# #4 0xffffffff803d9061 at passsendccb+0x61
# #5 0xffffffff803d8821 at passdoioctl+0x3a1
# #6 0xffffffff803d8102 at passioctl+0x22
# #7 0xffffffff80a413b1 at devfs_ioctl+0xd1
# #8 0xffffffff81204821 at VOP_IOCTL_APV+0x51
# #9 0xffffffff80cf0890 at vn_ioctl+0x160
# #10 0xffffffff80a41a7e at devfs_ioctl_f+0x1e
# #11 0xffffffff80c4e3c1 at kern_ioctl+0x2a1
# #12 0xffffffff80c4e0bf at sys_ioctl+0x12f
# #13 0xffffffff811327d9 at amd64_syscall+0x169
# #14 0xffffffff81101e9b at fast_syscall_common+0xf8
# 
# 
# Fatal trap 12: page fault while in kernel mode
# cpuid = 4; apic id = 04
# fault virtual address   = 0x800000006
# fault code              = supervisor read data, page not present
# instruction pointer     = 0x20:0xffffffff8112edf5
# frame pointer           = 0x28:0xfffffe010003fab0
# code segment            = base 0x0, limit 0xfffff, type 0x1b
#                         = DPL 0, pres 1, long 1, def32 0, gran 1
# processor eflags        = interrupt enabled, resume, IOPL = 0
# current process         = 5440 (syzkaller95)
# rdi: fffffe010003fac0 rsi: 0000000800000006 rdx: 0000000000000002
# rcx: 0000000000000002  r8: 0000000800000006  r9: 06eb28196e3b02c0
# rax: 0000000000000000 rbx: fffff80003e97800 rbp: fffffe010003fab0
# r10: fffff80003e978c8 r11: fffff800048e5550 r12: fffffe010003fac0
# r13: fffff80006350d80 r14: fffff80306280800 r15: fffff80006bd6100
# trap number             = 12
# panic: page fault
# cpuid = 4
# time = 1773848380
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe010003f7e0
# vpanic() at vpanic+0x136/frame 0xfffffe010003f910
# panic() at panic+0x43/frame 0xfffffe010003f970
# trap_pfault() at trap_pfault+0x422/frame 0xfffffe010003f9e0
# calltrap() at calltrap+0x8/frame 0xfffffe010003f9e0
# --- trap 0xc, rip = 0xffffffff8112edf5, rsp = 0xfffffe010003fab0, rbp = 0xfffffe010003fab0 ---
# copyin_nosmap_erms() at copyin_nosmap_erms+0x115/frame 0xfffffe010003fab0
# passsendccb() at passsendccb+0x61/frame 0xfffffe010003fb30
# passdoioctl() at passdoioctl+0x3a1/frame 0xfffffe010003fb80
# passioctl() at passioctl+0x22/frame 0xfffffe010003fbc0
# devfs_ioctl() at devfs_ioctl+0xd1/frame 0xfffffe010003fc10
# VOP_IOCTL_APV() at VOP_IOCTL_APV+0x51/frame 0xfffffe010003fc40
# vn_ioctl() at vn_ioctl+0x160/frame 0xfffffe010003fcb0
# devfs_ioctl_f() at devfs_ioctl_f+0x1e/frame 0xfffffe010003fcd0
# kern_ioctl() at kern_ioctl+0x2a1/frame 0xfffffe010003fd40
# sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe010003fe00
# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe010003ff30
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe010003ff30
# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x823c07eca, rsp = 0x8209c6ce8, rbp = 0x8209c6d10 ---
# KDB: enter: panic
# [ thread pid 5440 tid 100235 ]
# Stopped at      kdb_enter+0x33: movq    $0,0x15e9d32(%rip)
# db> x/s version
# version: FreeBSD 16.0-CURRENT #0 main-n284537-a8b9a05d3cad-dirty: Tue Mar 17 09:39:44 CET 2026
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
# db>

# Reproducer obtained from: Jiaming Zhang <r772577952@gmail.com>
# Bug 293892 - Fatal trap NUM: page fault while in kernel mode in passsendccb 

[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1

. ../default.cfg
set -u
prog=$(basename "$0" .sh)
cat > /tmp/$prog.c <<EOF
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  ioctl\$MDIOCDETACH arguments: [
  //    fd: fd_md (resource)
  //    cmd: const = 0xc1c06d01 (8 bytes)
  //    arg: ptr[inout, md_ioctl] {
  //      md_ioctl {
  //        md_version: int32 = 0xe (4 bytes)
  //        md_unit: int32 = 0x3 (4 bytes)
  //        md_type: md_types_flags = 0x0 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //        md_file: nil
  //        md_mediasize: int64 = 0x81 (8 bytes)
  //        md_sectorsize: int32 = 0x4 (4 bytes)
  //        md_options: int32 = 0x5 (4 bytes)
  //        md_base: int64 = 0x6 (8 bytes)
  //        md_fwheads: int32 = 0x4 (4 bytes)
  //        md_fwsectors: int32 = 0x1 (4 bytes)
  //        md_label: nil
  //        md_pad: array[int32] {
  //          int32 = 0x8 (4 bytes)
  //          int32 = 0x5 (4 bytes)
  //          int32 = 0x6 (4 bytes)
  //          int32 = 0xc3b (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0xa (4 bytes)
  //          int32 = 0xfffffffe (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x80 (4 bytes)
  //          int32 = 0xd22 (4 bytes)
  //          int32 = 0xa1a5 (4 bytes)
  //          int32 = 0x0 (4 bytes)
  //          int32 = 0xfffffff8 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0xffffffff (4 bytes)
  //          int32 = 0x100 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0x8 (4 bytes)
  //          int32 = 0x5b8f6f5f (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0xfffffffb (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x3 (4 bytes)
  //          int32 = 0x6 (4 bytes)
  //          int32 = 0x1 (4 bytes)
  //          int32 = 0x800 (4 bytes)
  //          int32 = 0x6b0000 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0x7ff (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x7 (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0x8000 (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x5be (4 bytes)
  //          int32 = 0xf0000000 (4 bytes)
  //          int32 = 0x1db (4 bytes)
  //          int32 = 0x3 (4 bytes)
  //          int32 = 0x0 (4 bytes)
  //          int32 = 0x8 (4 bytes)
  //          int32 = 0x18000000 (4 bytes)
  //          int32 = 0xfd6 (4 bytes)
  //          int32 = 0x1 (4 bytes)
  //          int32 = 0x8 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0x0 (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0xe2 (4 bytes)
  //          int32 = 0x0 (4 bytes)
  //          int32 = 0x5 (4 bytes)
  //          int32 = 0x1cd (4 bytes)
  //          int32 = 0xcf58 (4 bytes)
  //          int32 = 0x6 (4 bytes)
  //          int32 = 0x2e7 (4 bytes)
  //          int32 = 0x64d (4 bytes)
  //          int32 = 0x2a4 (4 bytes)
  //          int32 = 0x7 (4 bytes)
  //          int32 = 0x6 (4 bytes)
  //          int32 = 0x8 (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0x7 (4 bytes)
  //          int32 = 0x6 (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0xfffffff8 (4 bytes)
  //          int32 = 0x5 (4 bytes)
  //          int32 = 0xe53 (4 bytes)
  //          int32 = 0x81 (4 bytes)
  //          int32 = 0x3 (4 bytes)
  //          int32 = 0x0 (4 bytes)
  //          int32 = 0x80000001 (4 bytes)
  //          int32 = 0x5 (4 bytes)
  //          int32 = 0x54 (4 bytes)
  //          int32 = 0x401 (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0x3 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x1 (4 bytes)
  //          int32 = 0x9 (4 bytes)
  //          int32 = 0xed (4 bytes)
  //          int32 = 0x1f (4 bytes)
  //          int32 = 0x5 (4 bytes)
  //          int32 = 0xd (4 bytes)
  //          int32 = 0x8001 (4 bytes)
  //          int32 = 0xfff (4 bytes)
  //          int32 = 0x2 (4 bytes)
  //          int32 = 0x7fffffff (4 bytes)
  //          int32 = 0xd (4 bytes)
  //          int32 = 0x1 (4 bytes)
  //          int32 = 0x401 (4 bytes)
  //          int32 = 0x4 (4 bytes)
  //          int32 = 0xa043 (4 bytes)
  //        }
  //      }
  //    }
  //  ]
  *(uint32_t*)0x200000000300 = 0xe;
  *(uint32_t*)0x200000000304 = 3;
  *(uint32_t*)0x200000000308 = 0;
  *(uint64_t*)0x200000000310 = 0;
  *(uint64_t*)0x200000000318 = 0x81;
  *(uint32_t*)0x200000000320 = 4;
  *(uint32_t*)0x200000000324 = 5;
  *(uint64_t*)0x200000000328 = 6;
  *(uint32_t*)0x200000000330 = 4;
  *(uint32_t*)0x200000000334 = 1;
  *(uint64_t*)0x200000000338 = 0;
  *(uint32_t*)0x200000000340 = 8;
  *(uint32_t*)0x200000000344 = 5;
  *(uint32_t*)0x200000000348 = 6;
  *(uint32_t*)0x20000000034c = 0xc3b;
  *(uint32_t*)0x200000000350 = 2;
  *(uint32_t*)0x200000000354 = 4;
  *(uint32_t*)0x200000000358 = 0xa;
  *(uint32_t*)0x20000000035c = 0xfffffffe;
  *(uint32_t*)0x200000000360 = 2;
  *(uint32_t*)0x200000000364 = 0x80;
  *(uint32_t*)0x200000000368 = 0xd22;
  *(uint32_t*)0x20000000036c = 0xa1a5;
  *(uint32_t*)0x200000000370 = 0;
  *(uint32_t*)0x200000000374 = 0xfffffff8;
  *(uint32_t*)0x200000000378 = 4;
  *(uint32_t*)0x20000000037c = -1;
  *(uint32_t*)0x200000000380 = 0x100;
  *(uint32_t*)0x200000000384 = 4;
  *(uint32_t*)0x200000000388 = 8;
  *(uint32_t*)0x20000000038c = 0x5b8f6f5f;
  *(uint32_t*)0x200000000390 = 9;
  *(uint32_t*)0x200000000394 = 0xfffffffb;
  *(uint32_t*)0x200000000398 = 2;
  *(uint32_t*)0x20000000039c = 3;
  *(uint32_t*)0x2000000003a0 = 6;
  *(uint32_t*)0x2000000003a4 = 1;
  *(uint32_t*)0x2000000003a8 = 0x800;
  *(uint32_t*)0x2000000003ac = 0x6b0000;
  *(uint32_t*)0x2000000003b0 = 4;
  *(uint32_t*)0x2000000003b4 = 4;
  *(uint32_t*)0x2000000003b8 = 0x7ff;
  *(uint32_t*)0x2000000003bc = 2;
  *(uint32_t*)0x2000000003c0 = 7;
  *(uint32_t*)0x2000000003c4 = 9;
  *(uint32_t*)0x2000000003c8 = 9;
  *(uint32_t*)0x2000000003cc = 0x8000;
  *(uint32_t*)0x2000000003d0 = 2;
  *(uint32_t*)0x2000000003d4 = 0x5be;
  *(uint32_t*)0x2000000003d8 = 0xf0000000;
  *(uint32_t*)0x2000000003dc = 0x1db;
  *(uint32_t*)0x2000000003e0 = 3;
  *(uint32_t*)0x2000000003e4 = 0;
  *(uint32_t*)0x2000000003e8 = 8;
  *(uint32_t*)0x2000000003ec = 0x18000000;
  *(uint32_t*)0x2000000003f0 = 0xfd6;
  *(uint32_t*)0x2000000003f4 = 1;
  *(uint32_t*)0x2000000003f8 = 8;
  *(uint32_t*)0x2000000003fc = 4;
  *(uint32_t*)0x200000000400 = 0;
  *(uint32_t*)0x200000000404 = 2;
  *(uint32_t*)0x200000000408 = 0xe2;
  *(uint32_t*)0x20000000040c = 0;
  *(uint32_t*)0x200000000410 = 5;
  *(uint32_t*)0x200000000414 = 0x1cd;
  *(uint32_t*)0x200000000418 = 0xcf58;
  *(uint32_t*)0x20000000041c = 6;
  *(uint32_t*)0x200000000420 = 0x2e7;
  *(uint32_t*)0x200000000424 = 0x64d;
  *(uint32_t*)0x200000000428 = 0x2a4;
  *(uint32_t*)0x20000000042c = 7;
  *(uint32_t*)0x200000000430 = 6;
  *(uint32_t*)0x200000000434 = 8;
  *(uint32_t*)0x200000000438 = 9;
  *(uint32_t*)0x20000000043c = 7;
  *(uint32_t*)0x200000000440 = 6;
  *(uint32_t*)0x200000000444 = 9;
  *(uint32_t*)0x200000000448 = 2;
  *(uint32_t*)0x20000000044c = 0xfffffff8;
  *(uint32_t*)0x200000000450 = 5;
  *(uint32_t*)0x200000000454 = 0xe53;
  *(uint32_t*)0x200000000458 = 0x81;
  *(uint32_t*)0x20000000045c = 3;
  *(uint32_t*)0x200000000460 = 0;
  *(uint32_t*)0x200000000464 = 0x80000001;
  *(uint32_t*)0x200000000468 = 5;
  *(uint32_t*)0x20000000046c = 0x54;
  *(uint32_t*)0x200000000470 = 0x401;
  *(uint32_t*)0x200000000474 = 9;
  *(uint32_t*)0x200000000478 = 3;
  *(uint32_t*)0x20000000047c = 4;
  *(uint32_t*)0x200000000480 = 2;
  *(uint32_t*)0x200000000484 = 1;
  *(uint32_t*)0x200000000488 = 9;
  *(uint32_t*)0x20000000048c = 0xed;
  *(uint32_t*)0x200000000490 = 0x1f;
  *(uint32_t*)0x200000000494 = 5;
  *(uint32_t*)0x200000000498 = 0xd;
  *(uint32_t*)0x20000000049c = 0x8001;
  *(uint32_t*)0x2000000004a0 = 0xfff;
  *(uint32_t*)0x2000000004a4 = 2;
  *(uint32_t*)0x2000000004a8 = 0x7fffffff;
  *(uint32_t*)0x2000000004ac = 0xd;
  *(uint32_t*)0x2000000004b0 = 1;
  *(uint32_t*)0x2000000004b4 = 0x401;
  *(uint32_t*)0x2000000004b8 = 4;
  *(uint32_t*)0x2000000004bc = 0xa043;
  syscall(SYS_ioctl, /*fd=*/0xffffff9c, /*cmd=*/0xc1c06d01ul,
          /*arg=*/0x200000000300ul);
  //  openat\$pass_pass_cdevsw arguments: [
  //    fd: const = 0xffffffffffffff9c (8 bytes)
  //    file: ptr[in, buffer] {
  //      buffer: {2f 64 65 76 2f 70 61 73 73 30 00} (length 0xb)
  //    }
  //    flags: open_flags = 0x2 (4 bytes)
  //    mode: const = 0x0 (4 bytes)
  //  ]
  //  returns fd_pass_pass_cdevsw
  memcpy((void*)0x200000000100, "/dev/pass0\000", 11);
  res = syscall(SYS_openat, /*fd=*/0xffffffffffffff9cul,
                /*file=*/0x200000000100ul, /*flags=O_RDWR*/ 2, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  ioctl\$CAMIOCOMMAND_pass_cdevsw arguments: [
  //    fd: fd_pass_pass_cdevsw (resource)
  //    cmd: const = 0xc4e01a02 (8 bytes)
  //    arg: ptr[inout, ccb\$pass_cdevsw] {
  //      union ccb\$pass_cdevsw {
  //        cqa: ccb_que_ais\$pass_cdevsw {
  //          ccb_h: ccb_hdr\$pass_cdevsw {
  //            pinfo: cam_pinfo\$pass_cdevsw {
  //              priority: int32 = 0x2 (4 bytes)
  //              generation: int32 = 0x1 (4 bytes)
  //              index: int32 = 0x2000000 (4 bytes)
  //            }
  //            pad = 0x0 (4 bytes)
  //            xpt_links: camq_entry\$pass_cdevsw {
  //              links_next: intptr = 0xfec (8 bytes)
  //              priority: int32 = 0xfffffffc (4 bytes)
  //              pad = 0x0 (4 bytes)
  //            }
  //            sim_links: camq_entry\$pass_cdevsw {
  //              links_next: intptr = 0x5 (8 bytes)
  //              priority: int32 = 0x7 (4 bytes)
  //              pad = 0x0 (4 bytes)
  //            }
  //            periph_links: camq_entry\$pass_cdevsw {
  //              links_next: intptr = 0x80 (8 bytes)
  //              priority: int32 = 0x2 (4 bytes)
  //              pad = 0x0 (4 bytes)
  //            }
  //            retry_count: int16 = 0x1 (2 bytes)
  //            alloc_flags: int16 = 0x6b4 (2 bytes)
  //            pad = 0x0 (4 bytes)
  //            cbfcnp: intptr = 0x0 (8 bytes)
  //            func_code: int32 = 0x8 (4 bytes)
  //            status: int32 = 0x4 (4 bytes)
  //            path: intptr = 0xfffffffffffffffc (8 bytes)
  //            path_id: int32 = 0x9 (4 bytes)
  //            target_id: int32 = 0x8 (4 bytes)
  //            target_lun: int64 = 0x7d44 (8 bytes)
  //            flags: int32 = 0x1 (4 bytes)
  //            xflags: int32 = 0xfffffff8 (4 bytes)
  //            periph_priv: buffer: {69 32 82 68 e7 3f ef 85 2d 76 56 88 e5 d9
  //            10 17} (length 0x10) sim_priv: buffer: {19 45 5e bb 27 da 45 05
  //            43 c5 32 70 9e cb 83 a1} (length 0x10) qos: buffer: {f6 7d 0f 00
  //            10 00 00 00 00 32 e5 67 b7 bc 75 2d} (length 0x10) timeout:
  //            int32 = 0x7 (4 bytes) pad = 0x0 (4 bytes) softtimeout: timeval {
  //              sec: intptr = 0x5 (8 bytes)
  //              usec: intptr = 0x4 (8 bytes)
  //            }
  //          }
  //          payload: buffer: {f5 6a 42 5c 52 66 05 e3 50 a5 72 71 cd 88 ce 58
  //          c0 02 3b 6e 19 28 eb 06 ee d4 11 85 f4 29 8a 46 09 8a 1d be bf 87
  //          fb 73 a4 9e 3f 64 4f f0 18 b6 64 8f ab 32 a0 7b 8f 4a ba a5 02 ba
  //          96 f8 1d fc} (length 0x40)
  //        }
  //      }
  //    }
  //  ]
  *(uint32_t*)0x200000000240 = 2;
  *(uint32_t*)0x200000000244 = 1;
  *(uint32_t*)0x200000000248 = 0x2000000;
  *(uint64_t*)0x200000000250 = 0xfec;
  *(uint32_t*)0x200000000258 = 0xfffffffc;
  *(uint64_t*)0x200000000260 = 5;
  *(uint32_t*)0x200000000268 = 7;
  *(uint64_t*)0x200000000270 = 0x80;
  *(uint32_t*)0x200000000278 = 2;
  *(uint16_t*)0x200000000280 = 1;
  *(uint16_t*)0x200000000282 = 0x6b4;
  *(uint64_t*)0x200000000288 = 0;
  *(uint32_t*)0x200000000290 = 8;
  *(uint32_t*)0x200000000294 = 4;
  *(uint64_t*)0x200000000298 = 0xfffffffffffffffc;
  *(uint32_t*)0x2000000002a0 = 9;
  *(uint32_t*)0x2000000002a4 = 8;
  *(uint64_t*)0x2000000002a8 = 0x7d44;
  *(uint32_t*)0x2000000002b0 = 1;
  *(uint32_t*)0x2000000002b4 = 0xfffffff8;
  memcpy((void*)0x2000000002b8,
         "\x69\x32\x82\x68\xe7\x3f\xef\x85\x2d\x76\x56\x88\xe5\xd9\x10\x17",
         16);
  memcpy((void*)0x2000000002c8,
         "\x19\x45\x5e\xbb\x27\xda\x45\x05\x43\xc5\x32\x70\x9e\xcb\x83\xa1",
         16);
  memcpy((void*)0x2000000002d8,
         "\xf6\x7d\x0f\x00\x10\x00\x00\x00\x00\x32\xe5\x67\xb7\xbc\x75\x2d",
         16);
  *(uint32_t*)0x2000000002e8 = 7;
  *(uint64_t*)0x2000000002f0 = 5;
  *(uint64_t*)0x2000000002f8 = 4;
  memcpy((void*)0x200000000300,
         "\xf5\x6a\x42\x5c\x52\x66\x05\xe3\x50\xa5\x72\x71\xcd\x88\xce\x58\xc0"
         "\x02\x3b\x6e\x19\x28\xeb\x06\xee\xd4\x11\x85\xf4\x29\x8a\x46\x09\x8a"
         "\x1d\xbe\xbf\x87\xfb\x73\xa4\x9e\x3f\x64\x4f\xf0\x18\xb6\x64\x8f\xab"
         "\x32\xa0\x7b\x8f\x4a\xba\xa5\x02\xba\x96\xf8\x1d\xfc",
         64);
  syscall(SYS_ioctl, /*fd=*/r[0], /*cmd=*/0xc4e01a02ul,
          /*arg=*/0x200000000240ul);
  return 0;
}
EOF
mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1

timeout 3m /tmp/$prog > /dev/null 2>&1

rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core
exit 0