Google Git
Sign in
kernel / pub / scm / linux / kernel / git / shuah / linux-arts / fda3a6268584782d265ee38794c23e1b5b521eb1 / . / syzkaller-repros / linux / b723ac4eeadd7c7b8a881613a7f1a060fb6d3e22.c
blob: a58cb1d30fcd6e7f2f9f38d5e5313435f8d0cc3a [file] [log] [blame]
// KASAN: use-after-free Read in __video_do_ioctl
// https://syzkaller.appspot.com/bug?id=b723ac4eeadd7c7b8a881613a7f1a060fb6d3e22
// status:dup
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/futex.h>
#include <linux/if_addr.h>
#include <linux/if_ether.h>
#include <linux/if_link.h>
#include <linux/if_tun.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/tcp.h>
#include <linux/usb/ch9.h>
#include <linux/veth.h>
unsigned long long procid;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
(addr < prog_start || addr > prog_end)) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) \
{ \
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
if (_setjmp(segv_env) == 0) { \
__VA_ARGS__; \
} \
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
#define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \
*(type*)(addr) = \
htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \
(((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_RELAXED))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static struct {
char* pos;
int nesting;
struct nlattr* nested[8];
char buf[1024];
} nlmsg;
static void netlink_init(int typ, int flags, const void* data, int size)
{
memset(&nlmsg, 0, sizeof(nlmsg));
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf;
hdr->nlmsg_type = typ;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
memcpy(hdr + 1, data, size);
nlmsg.pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}
static void netlink_attr(int typ, const void* data, int size)
{
struct nlattr* attr = (struct nlattr*)nlmsg.pos;
attr->nla_len = sizeof(*attr) + size;
attr->nla_type = typ;
memcpy(attr + 1, data, size);
nlmsg.pos += NLMSG_ALIGN(attr->nla_len);
}
static void netlink_nest(int typ)
{
struct nlattr* attr = (struct nlattr*)nlmsg.pos;
attr->nla_type = typ;
nlmsg.pos += sizeof(*attr);
nlmsg.nested[nlmsg.nesting++] = attr;
}
static void netlink_done(void)
{
struct nlattr* attr = nlmsg.nested[--nlmsg.nesting];
attr->nla_len = nlmsg.pos - (char*)attr;
}
static int netlink_send(int sock)
{
if (nlmsg.pos > nlmsg.buf + sizeof(nlmsg.buf) || nlmsg.nesting)
exit(1);
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf;
hdr->nlmsg_len = nlmsg.pos - nlmsg.buf;
struct sockaddr_nl addr;
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
unsigned n = sendto(sock, nlmsg.buf, hdr->nlmsg_len, 0,
(struct sockaddr*)&addr, sizeof(addr));
if (n != hdr->nlmsg_len)
exit(1);
n = recv(sock, nlmsg.buf, sizeof(nlmsg.buf), 0);
if (n < sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))
exit(1);
if (hdr->nlmsg_type != NLMSG_ERROR)
exit(1);
return -((struct nlmsgerr*)(hdr + 1))->error;
}
static void netlink_add_device_impl(const char* type, const char* name)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
netlink_init(RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
if (name)
netlink_attr(IFLA_IFNAME, name, strlen(name));
netlink_nest(IFLA_LINKINFO);
netlink_attr(IFLA_INFO_KIND, type, strlen(type));
}
static void netlink_add_device(int sock, const char* type, const char* name)
{
netlink_add_device_impl(type, name);
netlink_done();
int err = netlink_send(sock);
(void)err;
}
static void netlink_add_veth(int sock, const char* name, const char* peer)
{
netlink_add_device_impl("veth", name);
netlink_nest(IFLA_INFO_DATA);
netlink_nest(VETH_INFO_PEER);
nlmsg.pos += sizeof(struct ifinfomsg);
netlink_attr(IFLA_IFNAME, peer, strlen(peer));
netlink_done();
netlink_done();
netlink_done();
int err = netlink_send(sock);
(void)err;
}
static void netlink_add_hsr(int sock, const char* name, const char* slave1,
const char* slave2)
{
netlink_add_device_impl("hsr", name);
netlink_nest(IFLA_INFO_DATA);
int ifindex1 = if_nametoindex(slave1);
netlink_attr(IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1));
int ifindex2 = if_nametoindex(slave2);
netlink_attr(IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2));
netlink_done();
netlink_done();
int err = netlink_send(sock);
(void)err;
}
static void netlink_device_change(int sock, const char* name, bool up,
const char* master, const void* mac,
int macsize)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
netlink_init(RTM_NEWLINK, 0, &hdr, sizeof(hdr));
netlink_attr(IFLA_IFNAME, name, strlen(name));
if (master) {
int ifindex = if_nametoindex(master);
netlink_attr(IFLA_MASTER, &ifindex, sizeof(ifindex));
}
if (macsize)
netlink_attr(IFLA_ADDRESS, mac, macsize);
int err = netlink_send(sock);
(void)err;
}
static int netlink_add_addr(int sock, const char* dev, const void* addr,
int addrsize)
{
struct ifaddrmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6;
hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120;
hdr.ifa_scope = RT_SCOPE_UNIVERSE;
hdr.ifa_index = if_nametoindex(dev);
netlink_init(RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr));
netlink_attr(IFA_LOCAL, addr, addrsize);
netlink_attr(IFA_ADDRESS, addr, addrsize);
return netlink_send(sock);
}
static void netlink_add_addr4(int sock, const char* dev, const char* addr)
{
struct in_addr in_addr;
inet_pton(AF_INET, addr, &in_addr);
int err = netlink_add_addr(sock, dev, &in_addr, sizeof(in_addr));
(void)err;
}
static void netlink_add_addr6(int sock, const char* dev, const char* addr)
{
struct in6_addr in6_addr;
inet_pton(AF_INET6, addr, &in6_addr);
int err = netlink_add_addr(sock, dev, &in6_addr, sizeof(in6_addr));
(void)err;
}
static void netlink_add_neigh(int sock, const char* name, const void* addr,
int addrsize, const void* mac, int macsize)
{
struct ndmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6;
hdr.ndm_ifindex = if_nametoindex(name);
hdr.ndm_state = NUD_PERMANENT;
netlink_init(RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
netlink_attr(NDA_DST, addr, addrsize);
netlink_attr(NDA_LLADDR, mac, macsize);
int err = netlink_send(sock);
(void)err;
}
static int tunfd = -1;
static int tun_frags_enabled;
#define SYZ_TUN_MAX_PACKET_SIZE 1000
#define TUN_IFACE "syz_tun"
#define LOCAL_MAC 0xaaaaaaaaaaaa
#define REMOTE_MAC 0xaaaaaaaaaabb
#define LOCAL_IPV4 "172.20.20.170"
#define REMOTE_IPV4 "172.20.20.187"
#define LOCAL_IPV6 "fe80::aa"
#define REMOTE_IPV6 "fe80::bb"
#define IFF_NAPI 0x0010
#define IFF_NAPI_FRAGS 0x0020
static void initialize_tun(void)
{
tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
if (tunfd == -1) {
printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
printf("otherwise fuzzing or reproducing might not work as intended\n");
return;
}
const int kTunFd = 240;
if (dup2(tunfd, kTunFd) < 0)
exit(1);
close(tunfd);
tunfd = kTunFd;
struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ);
ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS;
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0)
exit(1);
}
if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0)
exit(1);
tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0;
char sysctl[64];
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE);
write_file(sysctl, "0");
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE);
write_file(sysctl, "0");
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
netlink_add_addr4(sock, TUN_IFACE, LOCAL_IPV4);
netlink_add_addr6(sock, TUN_IFACE, LOCAL_IPV6);
uint64_t macaddr = REMOTE_MAC;
struct in_addr in_addr;
inet_pton(AF_INET, REMOTE_IPV4, &in_addr);
netlink_add_neigh(sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr,
ETH_ALEN);
struct in6_addr in6_addr;
inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr);
netlink_add_neigh(sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr,
ETH_ALEN);
macaddr = LOCAL_MAC;
netlink_device_change(sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN);
close(sock);
}
#define DEV_IPV4 "172.20.20.%d"
#define DEV_IPV6 "fe80::%02x"
#define DEV_MAC 0x00aaaaaaaaaa
static void initialize_netdevices(void)
{
char netdevsim[16];
sprintf(netdevsim, "netdevsim%d", (int)procid);
struct {
const char* type;
const char* dev;
} devtypes[] = {
{"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"},
{"vcan", "vcan0"}, {"bond", "bond0"},
{"team", "team0"}, {"dummy", "dummy0"},
{"nlmon", "nlmon0"}, {"caif", "caif0"},
{"batadv", "batadv0"}, {"vxcan", "vxcan1"},
{"netdevsim", netdevsim}, {"veth", 0},
};
const char* devmasters[] = {"bridge", "bond", "team"};
struct {
const char* name;
int macsize;
bool noipv6;
} devices[] = {
{"lo", ETH_ALEN},
{"sit0", 0},
{"bridge0", ETH_ALEN},
{"vcan0", 0, true},
{"tunl0", 0},
{"gre0", 0},
{"gretap0", ETH_ALEN},
{"ip_vti0", 0},
{"ip6_vti0", 0},
{"ip6tnl0", 0},
{"ip6gre0", 0},
{"ip6gretap0", ETH_ALEN},
{"erspan0", ETH_ALEN},
{"bond0", ETH_ALEN},
{"veth0", ETH_ALEN},
{"veth1", ETH_ALEN},
{"team0", ETH_ALEN},
{"veth0_to_bridge", ETH_ALEN},
{"veth1_to_bridge", ETH_ALEN},
{"veth0_to_bond", ETH_ALEN},
{"veth1_to_bond", ETH_ALEN},
{"veth0_to_team", ETH_ALEN},
{"veth1_to_team", ETH_ALEN},
{"veth0_to_hsr", ETH_ALEN},
{"veth1_to_hsr", ETH_ALEN},
{"hsr0", 0},
{"dummy0", ETH_ALEN},
{"nlmon0", 0},
{"vxcan1", 0, true},
{"caif0", ETH_ALEN},
{"batadv0", ETH_ALEN},
{netdevsim, ETH_ALEN},
};
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++)
netlink_add_device(sock, devtypes[i].type, devtypes[i].dev);
for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) {
char master[32], slave0[32], veth0[32], slave1[32], veth1[32];
sprintf(slave0, "%s_slave_0", devmasters[i]);
sprintf(veth0, "veth0_to_%s", devmasters[i]);
netlink_add_veth(sock, slave0, veth0);
sprintf(slave1, "%s_slave_1", devmasters[i]);
sprintf(veth1, "veth1_to_%s", devmasters[i]);
netlink_add_veth(sock, slave1, veth1);
sprintf(master, "%s0", devmasters[i]);
netlink_device_change(sock, slave0, false, master, 0, 0);
netlink_device_change(sock, slave1, false, master, 0, 0);
}
netlink_device_change(sock, "bridge_slave_0", true, 0, 0, 0);
netlink_device_change(sock, "bridge_slave_1", true, 0, 0, 0);
netlink_add_veth(sock, "hsr_slave_0", "veth0_to_hsr");
netlink_add_veth(sock, "hsr_slave_1", "veth1_to_hsr");
netlink_add_hsr(sock, "hsr0", "hsr_slave_0", "hsr_slave_1");
netlink_device_change(sock, "hsr_slave_0", true, 0, 0, 0);
netlink_device_change(sock, "hsr_slave_1", true, 0, 0, 0);
for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) {
char addr[32];
sprintf(addr, DEV_IPV4, i + 10);
netlink_add_addr4(sock, devices[i].name, addr);
if (!devices[i].noipv6) {
sprintf(addr, DEV_IPV6, i + 10);
netlink_add_addr6(sock, devices[i].name, addr);
}
uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40);
netlink_device_change(sock, devices[i].name, true, 0, &macaddr,
devices[i].macsize);
}
close(sock);
}
static void initialize_netdevices_init(void)
{
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
struct {
const char* type;
int macsize;
bool noipv6;
bool noup;
} devtypes[] = {
{"nr", 7, true},
{"rose", 5, true, true},
};
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) {
char dev[32], addr[32];
sprintf(dev, "%s%d", devtypes[i].type, (int)procid);
sprintf(addr, "172.30.%d.%d", i, (int)procid + 1);
netlink_add_addr4(sock, dev, addr);
if (!devtypes[i].noipv6) {
sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1);
netlink_add_addr6(sock, dev, addr);
}
int macsize = devtypes[i].macsize;
uint64_t macaddr = 0xbbbbbb +
((unsigned long long)i << (8 * (macsize - 2))) +
(procid << (8 * (macsize - 1)));
netlink_device_change(sock, dev, !devtypes[i].noup, 0, &macaddr, macsize);
}
close(sock);
}
static int read_tun(char* data, int size)
{
if (tunfd < 0)
return -1;
int rv = read(tunfd, data, size);
if (rv < 0) {
if (errno == EAGAIN)
return -1;
if (errno == EBADFD)
return -1;
exit(1);
}
return rv;
}
static void flush_tun()
{
char data[SYZ_TUN_MAX_PACKET_SIZE];
while (read_tun(&data[0], sizeof(data)) != -1) {
}
}
#define USB_MAX_EP_NUM 32
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
unsigned config_length;
struct usb_interface_descriptor* iface;
struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM];
unsigned eps_num;
};
static bool parse_usb_descriptor(char* buffer, size_t length,
struct usb_device_index* index)
{
if (length <
sizeof(*index->dev) + sizeof(*index->config) + sizeof(*index->iface))
return false;
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->config_length = length - sizeof(*index->dev);
index->iface =
(struct usb_interface_descriptor*)(buffer + sizeof(*index->dev) +
sizeof(*index->config));
index->eps_num = 0;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_ENDPOINT) {
index->eps[index->eps_num] =
(struct usb_endpoint_descriptor*)(buffer + offset);
index->eps_num++;
}
if (index->eps_num == USB_MAX_EP_NUM)
break;
offset += desc_length;
}
return true;
}
enum usb_fuzzer_event_type {
USB_FUZZER_EVENT_INVALID,
USB_FUZZER_EVENT_CONNECT,
USB_FUZZER_EVENT_DISCONNECT,
USB_FUZZER_EVENT_SUSPEND,
USB_FUZZER_EVENT_RESUME,
USB_FUZZER_EVENT_CONTROL,
};
struct usb_fuzzer_event {
uint32_t type;
uint32_t length;
char data[0];
};
struct usb_fuzzer_init {
uint64_t speed;
const char* driver_name;
const char* device_name;
};
struct usb_fuzzer_ep_io {
uint16_t ep;
uint16_t flags;
uint32_t length;
char data[0];
};
#define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init)
#define USB_FUZZER_IOCTL_RUN _IO('U', 1)
#define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event)
#define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9)
#define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t)
int usb_fuzzer_open()
{
return open("/sys/kernel/debug/usb-fuzzer", O_RDWR);
}
int usb_fuzzer_init(int fd, uint32_t speed, const char* driver,
const char* device)
{
struct usb_fuzzer_init arg;
arg.speed = speed;
arg.driver_name = driver;
arg.device_name = device;
return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg);
}
int usb_fuzzer_run(int fd)
{
return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0);
}
int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event)
{
return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event);
}
int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io)
{
return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io);
}
int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io)
{
return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io);
}
int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io)
{
return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io);
}
int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io)
{
return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io);
}
int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc);
}
int usb_fuzzer_configure(int fd)
{
return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0);
}
int usb_fuzzer_vbus_draw(int fd, uint32_t power)
{
return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power);
}
#define USB_MAX_PACKET_SIZE 1024
struct usb_fuzzer_control_event {
struct usb_fuzzer_event inner;
struct usb_ctrlrequest ctrl;
char data[USB_MAX_PACKET_SIZE];
};
struct usb_fuzzer_ep_io_data {
struct usb_fuzzer_ep_io inner;
char data[USB_MAX_PACKET_SIZE];
};
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char* default_string = "syzkaller";
static bool lookup_connect_response(struct vusb_connect_descriptors* descs,
struct usb_device_index* index,
struct usb_ctrlrequest* ctrl,
char** response_data,
uint32_t* response_length)
{
uint8_t str_idx;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (str_idx >= descs->strs_len) {
*response_data = (char*)default_string;
*response_length = strlen(default_string);
} else {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
}
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
exit(1);
return false;
}
break;
default:
exit(1);
return false;
}
break;
default:
exit(1);
return false;
}
return false;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
char* dev = (char*)a2;
struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3;
if (!dev) {
return -1;
}
struct usb_device_index index;
memset(&index, 0, sizeof(index));
int rv = 0;
NONFAILING(rv = parse_usb_descriptor(dev, dev_len, &index));
if (!rv) {
return rv;
}
int fd = usb_fuzzer_open();
if (fd < 0) {
return fd;
}
char device[32];
sprintf(&device[0], "dummy_udc.%llu", procid);
rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]);
if (rv < 0) {
return rv;
}
rv = usb_fuzzer_run(fd);
if (rv < 0) {
return rv;
}
bool done = false;
while (!done) {
struct usb_fuzzer_control_event event;
event.inner.type = 0;
event.inner.length = sizeof(event.ctrl);
rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
if (rv < 0) {
return rv;
}
if (event.inner.type != USB_FUZZER_EVENT_CONTROL)
continue;
bool response_found = false;
char* response_data = NULL;
uint32_t response_length = 0;
if (event.ctrl.bRequestType & USB_DIR_IN) {
NONFAILING(response_found =
lookup_connect_response(descs, &index, &event.ctrl,
&response_data, &response_length));
if (!response_found) {
return -1;
}
} else {
if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD ||
event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) {
exit(1);
return -1;
}
done = true;
}
if (done) {
rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower);
if (rv < 0) {
return rv;
}
rv = usb_fuzzer_configure(fd);
if (rv < 0) {
return rv;
}
unsigned ep;
for (ep = 0; ep < index.eps_num; ep++) {
rv = usb_fuzzer_ep_enable(fd, index.eps[ep]);
if (rv < 0) {
} else {
}
}
}
struct usb_fuzzer_ep_io_data response;
response.inner.ep = 0;
response.inner.flags = 0;
if (response_length > sizeof(response.data))
response_length = 0;
if (event.ctrl.wLength < response_length)
response_length = event.ctrl.wLength;
response.inner.length = response_length;
if (response_data)
memcpy(&response.data[0], response_data, response_length);
else
memset(&response.data[0], 0, response_length);
if (event.ctrl.bRequestType & USB_DIR_IN)
rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
else
rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
if (rv < 0) {
return rv;
}
}
sleep_ms(200);
return fd;
}
struct vusb_descriptor {
uint8_t req_type;
uint8_t desc_type;
uint32_t len;
char data[0];
} __attribute__((packed));
struct vusb_descriptors {
uint32_t len;
struct vusb_descriptor* generic;
struct vusb_descriptor* descs[0];
} __attribute__((packed));
struct vusb_response {
uint8_t type;
uint8_t req;
uint32_t len;
char data[0];
} __attribute__((packed));
struct vusb_responses {
uint32_t len;
struct vusb_response* generic;
struct vusb_response* resps[0];
} __attribute__((packed));
static bool lookup_control_io_response(struct vusb_descriptors* descs,
struct vusb_responses* resps,
struct usb_ctrlrequest* ctrl,
char** response_data,
uint32_t* response_length)
{
int descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) /
sizeof(descs->descs[0]);
int resps_num = (resps->len - offsetof(struct vusb_responses, resps)) /
sizeof(resps->resps[0]);
uint8_t req = ctrl->bRequest;
uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK;
uint8_t desc_type = ctrl->wValue >> 8;
if (req == USB_REQ_GET_DESCRIPTOR) {
int i;
for (i = 0; i < descs_num; i++) {
struct vusb_descriptor* desc = descs->descs[i];
if (!desc)
continue;
if (desc->req_type == req_type && desc->desc_type == desc_type) {
*response_length = desc->len;
if (*response_length != 0)
*response_data = &desc->data[0];
else
*response_data = NULL;
return true;
}
}
if (descs->generic) {
*response_data = &descs->generic->data[0];
*response_length = descs->generic->len;
return true;
}
} else {
int i;
for (i = 0; i < resps_num; i++) {
struct vusb_response* resp = resps->resps[i];
if (!resp)
continue;
if (resp->type == req_type && resp->req == req) {
*response_length = resp->len;
if (*response_length != 0)
*response_data = &resp->data[0];
else
*response_data = NULL;
return true;
}
}
if (resps->generic) {
*response_data = &resps->generic->data[0];
*response_length = resps->generic->len;
return true;
}
}
return false;
}
static volatile long syz_usb_control_io(volatile long a0, volatile long a1,
volatile long a2)
{
int fd = a0;
struct vusb_descriptors* descs = (struct vusb_descriptors*)a1;
struct vusb_responses* resps = (struct vusb_responses*)a2;
struct usb_fuzzer_control_event event;
event.inner.type = 0;
event.inner.length = USB_MAX_PACKET_SIZE;
int rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
if (rv < 0) {
return rv;
}
if (event.inner.type != USB_FUZZER_EVENT_CONTROL) {
return -1;
}
bool response_found = false;
char* response_data = NULL;
uint32_t response_length = 0;
if (event.ctrl.bRequestType & USB_DIR_IN) {
NONFAILING(
response_found = lookup_control_io_response(
descs, resps, &event.ctrl, &response_data, &response_length));
if (!response_found) {
return -1;
}
} else {
response_length = event.ctrl.wLength;
}
struct usb_fuzzer_ep_io_data response;
response.inner.ep = 0;
response.inner.flags = 0;
if (response_length > sizeof(response.data))
response_length = 0;
if (event.ctrl.wLength < response_length)
response_length = event.ctrl.wLength;
response.inner.length = response_length;
if (response_data)
memcpy(&response.data[0], response_data, response_length);
else
memset(&response.data[0], 0, response_length);
if (event.ctrl.bRequestType & USB_DIR_IN) {
rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
} else {
rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
}
if (rv < 0) {
return rv;
}
sleep_ms(200);
return 0;
}
#define XT_TABLE_SIZE 1536
#define XT_MAX_ENTRIES 10
struct xt_counters {
uint64_t pcnt, bcnt;
};
struct ipt_getinfo {
char name[32];
unsigned int valid_hooks;
unsigned int hook_entry[5];
unsigned int underflow[5];
unsigned int num_entries;
unsigned int size;
};
struct ipt_get_entries {
char name[32];
unsigned int size;
void* entrytable[XT_TABLE_SIZE / sizeof(void*)];
};
struct ipt_replace {
char name[32];
unsigned int valid_hooks;
unsigned int num_entries;
unsigned int size;
unsigned int hook_entry[5];
unsigned int underflow[5];
unsigned int num_counters;
struct xt_counters* counters;
char entrytable[XT_TABLE_SIZE];
};
struct ipt_table_desc {
const char* name;
struct ipt_getinfo info;
struct ipt_replace replace;
};
static struct ipt_table_desc ipv4_tables[] = {
{.name = "filter"}, {.name = "nat"}, {.name = "mangle"},
{.name = "raw"}, {.name = "security"},
};
static struct ipt_table_desc ipv6_tables[] = {
{.name = "filter"}, {.name = "nat"}, {.name = "mangle"},
{.name = "raw"}, {.name = "security"},
};
#define IPT_BASE_CTL 64
#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
#define IPT_SO_GET_INFO (IPT_BASE_CTL)
#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)
struct arpt_getinfo {
char name[32];
unsigned int valid_hooks;
unsigned int hook_entry[3];
unsigned int underflow[3];
unsigned int num_entries;
unsigned int size;
};
struct arpt_get_entries {
char name[32];
unsigned int size;
void* entrytable[XT_TABLE_SIZE / sizeof(void*)];
};
struct arpt_replace {
char name[32];
unsigned int valid_hooks;
unsigned int num_entries;
unsigned int size;
unsigned int hook_entry[3];
unsigned int underflow[3];
unsigned int num_counters;
struct xt_counters* counters;
char entrytable[XT_TABLE_SIZE];
};
struct arpt_table_desc {
const char* name;
struct arpt_getinfo info;
struct arpt_replace replace;
};
static struct arpt_table_desc arpt_tables[] = {
{.name = "filter"},
};
#define ARPT_BASE_CTL 96
#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
static void checkpoint_iptables(struct ipt_table_desc* tables, int num_tables,
int family, int level)
{
struct ipt_get_entries entries;
socklen_t optlen;
int fd, i;
fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (i = 0; i < num_tables; i++) {
struct ipt_table_desc* table = &tables[i];
strcpy(table->info.name, table->name);
strcpy(table->replace.name, table->name);
optlen = sizeof(table->info);
if (getsockopt(fd, level, IPT_SO_GET_INFO, &table->info, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->info.size > sizeof(table->replace.entrytable))
exit(1);
if (table->info.num_entries > XT_MAX_ENTRIES)
exit(1);
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
table->replace.valid_hooks = table->info.valid_hooks;
table->replace.num_entries = table->info.num_entries;
table->replace.size = table->info.size;
memcpy(table->replace.hook_entry, table->info.hook_entry,
sizeof(table->replace.hook_entry));
memcpy(table->replace.underflow, table->info.underflow,
sizeof(table->replace.underflow));
memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
}
close(fd);
}
static void reset_iptables(struct ipt_table_desc* tables, int num_tables,
int family, int level)
{
struct xt_counters counters[XT_MAX_ENTRIES];
struct ipt_get_entries entries;
struct ipt_getinfo info;
socklen_t optlen;
int fd, i;
fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (i = 0; i < num_tables; i++) {
struct ipt_table_desc* table = &tables[i];
if (table->info.valid_hooks == 0)
continue;
memset(&info, 0, sizeof(info));
strcpy(info.name, table->name);
optlen = sizeof(info);
if (getsockopt(fd, level, IPT_SO_GET_INFO, &info, &optlen))
exit(1);
if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
if (memcmp(table->replace.entrytable, entries.entrytable,
table->info.size) == 0)
continue;
}
table->replace.num_counters = info.num_entries;
table->replace.counters = counters;
optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
table->replace.size;
if (setsockopt(fd, level, IPT_SO_SET_REPLACE, &table->replace, optlen))
exit(1);
}
close(fd);
}
static void checkpoint_arptables(void)
{
struct arpt_get_entries entries;
socklen_t optlen;
unsigned i;
int fd;
fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
struct arpt_table_desc* table = &arpt_tables[i];
strcpy(table->info.name, table->name);
strcpy(table->replace.name, table->name);
optlen = sizeof(table->info);
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &table->info, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->info.size > sizeof(table->replace.entrytable))
exit(1);
if (table->info.num_entries > XT_MAX_ENTRIES)
exit(1);
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
table->replace.valid_hooks = table->info.valid_hooks;
table->replace.num_entries = table->info.num_entries;
table->replace.size = table->info.size;
memcpy(table->replace.hook_entry, table->info.hook_entry,
sizeof(table->replace.hook_entry));
memcpy(table->replace.underflow, table->info.underflow,
sizeof(table->replace.underflow));
memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
}
close(fd);
}
static void reset_arptables()
{
struct xt_counters counters[XT_MAX_ENTRIES];
struct arpt_get_entries entries;
struct arpt_getinfo info;
socklen_t optlen;
unsigned i;
int fd;
fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
struct arpt_table_desc* table = &arpt_tables[i];
if (table->info.valid_hooks == 0)
continue;
memset(&info, 0, sizeof(info));
strcpy(info.name, table->name);
optlen = sizeof(info);
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &info, &optlen))
exit(1);
if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
if (memcmp(table->replace.entrytable, entries.entrytable,
table->info.size) == 0)
continue;
} else {
}
table->replace.num_counters = info.num_entries;
table->replace.counters = counters;
optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
table->replace.size;
if (setsockopt(fd, SOL_IP, ARPT_SO_SET_REPLACE, &table->replace, optlen))
exit(1);
}
close(fd);
}
#define NF_BR_NUMHOOKS 6
#define EBT_TABLE_MAXNAMELEN 32
#define EBT_CHAIN_MAXNAMELEN 32
#define EBT_BASE_CTL 128
#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
#define EBT_SO_GET_INFO (EBT_BASE_CTL)
#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO + 1)
#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES + 1)
#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO + 1)
struct ebt_replace {
char name[EBT_TABLE_MAXNAMELEN];
unsigned int valid_hooks;
unsigned int nentries;
unsigned int entries_size;
struct ebt_entries* hook_entry[NF_BR_NUMHOOKS];
unsigned int num_counters;
struct ebt_counter* counters;
char* entries;
};
struct ebt_entries {
unsigned int distinguisher;
char name[EBT_CHAIN_MAXNAMELEN];
unsigned int counter_offset;
int policy;
unsigned int nentries;
char data[0] __attribute__((aligned(__alignof__(struct ebt_replace))));
};
struct ebt_table_desc {
const char* name;
struct ebt_replace replace;
char entrytable[XT_TABLE_SIZE];
};
static struct ebt_table_desc ebt_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "broute"},
};
static void checkpoint_ebtables(void)
{
socklen_t optlen;
unsigned i;
int fd;
fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
struct ebt_table_desc* table = &ebt_tables[i];
strcpy(table->replace.name, table->name);
optlen = sizeof(table->replace);
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_INFO, &table->replace,
&optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->replace.entries_size > sizeof(table->entrytable))
exit(1);
table->replace.num_counters = 0;
table->replace.entries = table->entrytable;
optlen = sizeof(table->replace) + table->replace.entries_size;
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_ENTRIES, &table->replace,
&optlen))
exit(1);
}
close(fd);
}
static void reset_ebtables()
{
struct ebt_replace replace;
char entrytable[XT_TABLE_SIZE];
socklen_t optlen;
unsigned i, j, h;
int fd;
fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
struct ebt_table_desc* table = &ebt_tables[i];
if (table->replace.valid_hooks == 0)
continue;
memset(&replace, 0, sizeof(replace));
strcpy(replace.name, table->name);
optlen = sizeof(replace);
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INFO, &replace, &optlen))
exit(1);
replace.num_counters = 0;
table->replace.entries = 0;
for (h = 0; h < NF_BR_NUMHOOKS; h++)
table->replace.hook_entry[h] = 0;
if (memcmp(&table->replace, &replace, sizeof(table->replace)) == 0) {
memset(&entrytable, 0, sizeof(entrytable));
replace.entries = entrytable;
optlen = sizeof(replace) + replace.entries_size;
if (getsockopt(fd, SOL_IP, EBT_SO_GET_ENTRIES, &replace, &optlen))
exit(1);
if (memcmp(table->entrytable, entrytable, replace.entries_size) == 0)
continue;
}
for (j = 0, h = 0; h < NF_BR_NUMHOOKS; h++) {
if (table->replace.valid_hooks & (1 << h)) {
table->replace.hook_entry[h] =
(struct ebt_entries*)table->entrytable + j;
j++;
}
}
table->replace.entries = table->entrytable;
optlen = sizeof(table->replace) + table->replace.entries_size;
if (setsockopt(fd, SOL_IP, EBT_SO_SET_ENTRIES, &table->replace, optlen))
exit(1);
}
close(fd);
}
static void checkpoint_net_namespace(void)
{
checkpoint_ebtables();
checkpoint_arptables();
checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]),
AF_INET, SOL_IP);
checkpoint_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]),
AF_INET6, SOL_IPV6);
}
static void reset_net_namespace(void)
{
reset_ebtables();
reset_arptables();
reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]),
AF_INET, SOL_IP);
reset_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]),
AF_INET6, SOL_IPV6);
}
static void setup_cgroups()
{
if (mkdir("/syzcgroup", 0777)) {
}
if (mkdir("/syzcgroup/unified", 0777)) {
}
if (mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL)) {
}
if (chmod("/syzcgroup/unified", 0777)) {
}
write_file("/syzcgroup/unified/cgroup.subtree_control",
"+cpu +memory +io +pids +rdma");
if (mkdir("/syzcgroup/cpu", 0777)) {
}
if (mount("none", "/syzcgroup/cpu", "cgroup", 0,
"cpuset,cpuacct,perf_event,hugetlb")) {
}
write_file("/syzcgroup/cpu/cgroup.clone_children", "1");
if (chmod("/syzcgroup/cpu", 0777)) {
}
if (mkdir("/syzcgroup/net", 0777)) {
}
if (mount("none", "/syzcgroup/net", "cgroup", 0,
"net_cls,net_prio,devices,freezer")) {
}
if (chmod("/syzcgroup/net", 0777)) {
}
}
static void setup_cgroups_loop()
{
int pid = getpid();
char file[128];
char cgroupdir[64];
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/pids.max", cgroupdir);
write_file(file, "32");
snprintf(file, sizeof(file), "%s/memory.low", cgroupdir);
write_file(file, "%d", 298 << 20);
snprintf(file, sizeof(file), "%s/memory.high", cgroupdir);
write_file(file, "%d", 299 << 20);
snprintf(file, sizeof(file), "%s/memory.max", cgroupdir);
write_file(file, "%d", 300 << 20);
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
}
static void setup_cgroups_test()
{
char cgroupdir[64];
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup")) {
}
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup.cpu")) {
}
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup.net")) {
}
}
static void setup_common()
{
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
setup_cgroups();
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}
int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}
static int do_sandbox_none(void)
{
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
setup_common();
sandbox_common();
initialize_netdevices_init();
if (unshare(CLONE_NEWNET)) {
}
initialize_tun();
initialize_netdevices();
loop();
exit(1);
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
int iter = 0;
retry:
while (umount2(dir, MNT_DETACH) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, MNT_DETACH) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0)
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, MNT_DETACH))
exit(1);
}
}
closedir(dp);
int i;
for (i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0)
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, MNT_DETACH))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
int i;
for (i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_loop()
{
setup_cgroups_loop();
checkpoint_net_namespace();
}
static void reset_loop()
{
reset_net_namespace();
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
setup_cgroups_test();
write_file("/proc/self/oom_score_adj", "1000");
flush_tun();
}
static void close_fds()
{
int fd;
for (fd = 3; fd < 30; fd++)
close(fd);
}
static void setup_binfmt_misc()
{
if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) {
}
write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:");
write_file("/proc/sys/fs/binfmt_misc/register",
":syz1:M:1:\x02::./file0:POC");
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
int collide = 0;
again:
for (call = 0; call < 7; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
if (collide && (call % 2) == 0)
break;
event_timedwait(&th->done,
45 + (call == 0 ? 2000 : 0) + (call == 1 ? 2000 : 0) +
(call == 2 ? 2000 : 0) + (call == 3 ? 300 : 0) +
(call == 4 ? 300 : 0) + (call == 5 ? 2000 : 0) +
(call == 6 ? 2000 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
close_fds();
if (!collide) {
collide = 1;
goto again;
}
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
setup_loop();
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
reset_loop();
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res;
switch (call) {
case 0:
NONFAILING(
memcpy((void*)0x20000000,
"\x12\x01\x00\x00\x73\xc5\x15\x08\xc4\x10\x8a\x81\xcd\x4c\x00"
"\x00\x00\x01\x09\x02\x1b\x00\x01\x00\x00\x00\x00\x09\x04\x0c"
"\x00\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
45));
res = syz_usb_connect(0, 0x2d, 0x20000000, 0);
if (res != -1)
r[0] = res;
break;
case 1:
syz_usb_connect(5, 0, 0, 0);
break;
case 2:
NONFAILING(*(uint8_t*)0x20002380 = 0x12);
NONFAILING(*(uint8_t*)0x20002381 = 1);
NONFAILING(*(uint16_t*)0x20002382 = 0x301);
NONFAILING(*(uint8_t*)0x20002384 = 0);
NONFAILING(*(uint8_t*)0x20002385 = 0);
NONFAILING(*(uint8_t*)0x20002386 = 0);
NONFAILING(*(uint8_t*)0x20002387 = 0x40);
NONFAILING(*(uint16_t*)0x20002388 = 0x46d);
NONFAILING(*(uint16_t*)0x2000238a = 0xc31c);
NONFAILING(*(uint16_t*)0x2000238c = 0x40);
NONFAILING(*(uint8_t*)0x2000238e = 0);
NONFAILING(*(uint8_t*)0x2000238f = 7);
NONFAILING(*(uint8_t*)0x20002390 = 0);
NONFAILING(*(uint8_t*)0x20002391 = 1);
NONFAILING(*(uint8_t*)0x20002392 = 9);
NONFAILING(*(uint8_t*)0x20002393 = 2);
NONFAILING(*(uint16_t*)0x20002394 = 0x86);
NONFAILING(*(uint8_t*)0x20002396 = 1);
NONFAILING(*(uint8_t*)0x20002397 = 0);
NONFAILING(*(uint8_t*)0x20002398 = 0);
NONFAILING(*(uint8_t*)0x20002399 = 0xa0);
NONFAILING(*(uint8_t*)0x2000239a = 6);
NONFAILING(*(uint8_t*)0x2000239b = 9);
NONFAILING(*(uint8_t*)0x2000239c = 4);
NONFAILING(*(uint8_t*)0x2000239d = 0);
NONFAILING(*(uint8_t*)0x2000239e = 9);
NONFAILING(*(uint8_t*)0x2000239f = 1);
NONFAILING(*(uint8_t*)0x200023a0 = 3);
NONFAILING(*(uint8_t*)0x200023a1 = 1);
NONFAILING(*(uint8_t*)0x200023a2 = 1);
NONFAILING(*(uint8_t*)0x200023a3 = 9);
NONFAILING(*(uint8_t*)0x200023a4 = 0xf);
NONFAILING(*(uint8_t*)0x200023a5 = 0x21);
NONFAILING(*(uint16_t*)0x200023a6 = 0x1f);
NONFAILING(*(uint8_t*)0x200023a8 = 9);
NONFAILING(*(uint8_t*)0x200023a9 = 3);
NONFAILING(*(uint8_t*)0x200023aa = 0x22);
NONFAILING(*(uint16_t*)0x200023ab = 0xd58);
NONFAILING(*(uint8_t*)0x200023ad = 0x23);
NONFAILING(*(uint16_t*)0x200023ae = 0xfbc);
NONFAILING(*(uint8_t*)0x200023b0 = 0x21);
NONFAILING(*(uint16_t*)0x200023b1 = 0x4b8);
NONFAILING(*(uint8_t*)0x200023b3 = 9);
NONFAILING(*(uint8_t*)0x200023b4 = 5);
NONFAILING(*(uint8_t*)0x200023b5 = 0x81);
NONFAILING(*(uint8_t*)0x200023b6 = 3);
NONFAILING(*(uint16_t*)0x200023b7 = 0);
NONFAILING(*(uint8_t*)0x200023b9 = 0xa8);
NONFAILING(*(uint8_t*)0x200023ba = 0);
NONFAILING(*(uint8_t*)0x200023bb = -1);
NONFAILING(*(uint8_t*)0x200023bc = 0x5c);
NONFAILING(*(uint8_t*)0x200023bd = 0x2f);
NONFAILING(
memcpy((void*)0x200023be,
"\x87\x90\x7e\xfd\x6b\xc1\x46\xd5\x10\x89\xce\x9a\x09\x8d\x5a"
"\xc4\x06\x00\x93\xa2\x01\x87\xc7\xd6\xb7\x5f\xcf\xad\xca\x9a"
"\xf2\xdb\xec\x5a\x6e\x60\x65\xa2\x01\x90\x7c\xc1\x1e\x82\xe1"
"\xe3\x13\xe3\x7c\x43\x20\x7f\x63\x22\x90\x3d\xfb\x57\xde\x17"
"\x14\x47\x19\xf8\x4a\x07\x7c\x29\xc2\xb2\xbc\xf0\xff\xcb\x64"
"\x60\xc2\xdb\xb4\x23\x14\x49\x1c\x4d\xe5\xb0\x54\x60\x46\x55",
90));
NONFAILING(*(uint32_t*)0x20002800 = 0xa);
NONFAILING(*(uint64_t*)0x20002804 = 0x20002440);
NONFAILING(*(uint8_t*)0x20002440 = 0xa);
NONFAILING(*(uint8_t*)0x20002441 = 6);
NONFAILING(*(uint16_t*)0x20002442 = 0x310);
NONFAILING(*(uint8_t*)0x20002444 = 0);
NONFAILING(*(uint8_t*)0x20002445 = 1);
NONFAILING(*(uint8_t*)0x20002446 = 1);
NONFAILING(*(uint8_t*)0x20002447 = 0x10);
NONFAILING(*(uint8_t*)0x20002448 = 0);
NONFAILING(*(uint8_t*)0x20002449 = 0);
NONFAILING(*(uint32_t*)0x2000280c = 0x16);
NONFAILING(*(uint64_t*)0x20002810 = 0x20002480);
NONFAILING(*(uint8_t*)0x20002480 = 5);
NONFAILING(*(uint8_t*)0x20002481 = 0xf);
NONFAILING(*(uint16_t*)0x20002482 = 0x16);
NONFAILING(*(uint8_t*)0x20002484 = 3);
NONFAILING(*(uint8_t*)0x20002485 = 3);
NONFAILING(*(uint8_t*)0x20002486 = 0x10);
NONFAILING(*(uint8_t*)0x20002487 = 0xb);
NONFAILING(*(uint8_t*)0x20002488 = 7);
NONFAILING(*(uint8_t*)0x20002489 = 0x10);
NONFAILING(*(uint8_t*)0x2000248a = 2);
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x2000248b, 0x10, 0, 8));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x2000248b, 3, 8, 4));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x2000248b, 2, 12, 4));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x2000248b, 6, 16, 16));
NONFAILING(*(uint8_t*)0x2000248f = 7);
NONFAILING(*(uint8_t*)0x20002490 = 0x10);
NONFAILING(*(uint8_t*)0x20002491 = 2);
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20002492, 0xa, 0, 8));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20002492, 0x230e, 8, 4));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20002492, 4, 12, 4));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20002492, 0x80000000, 16, 16));
NONFAILING(*(uint32_t*)0x20002818 = 9);
NONFAILING(*(uint32_t*)0x2000281c = 0);
NONFAILING(*(uint64_t*)0x20002820 = 0);
NONFAILING(*(uint32_t*)0x20002828 = 4);
NONFAILING(*(uint64_t*)0x2000282c = 0x20002500);
NONFAILING(*(uint8_t*)0x20002500 = 4);
NONFAILING(*(uint8_t*)0x20002501 = 3);
NONFAILING(*(uint16_t*)0x20002502 = 0xf4ff);
NONFAILING(*(uint32_t*)0x20002834 = 0x21);
NONFAILING(*(uint64_t*)0x20002838 = 0x20002540);
NONFAILING(*(uint8_t*)0x20002540 = 0x21);
NONFAILING(*(uint8_t*)0x20002541 = 3);
NONFAILING(*(uint16_t*)0x20002542 = 0);
NONFAILING(
memcpy((void*)0x20002544,
"\x49\x50\xd8\x4a\x9d\xa0\xde\x6b\x5f\x1f\x74\x37\xb5\x3b\x11"
"\xec\x06\x4b\x15\x7d\x38\x12\x91\x22\xf3\xa9\xfc\xcb\xe7",
29));
NONFAILING(*(uint32_t*)0x20002840 = 0);
NONFAILING(*(uint64_t*)0x20002844 = 0);
NONFAILING(*(uint32_t*)0x2000284c = 4);
NONFAILING(*(uint64_t*)0x20002850 = 0x200025c0);
NONFAILING(*(uint8_t*)0x200025c0 = 4);
NONFAILING(*(uint8_t*)0x200025c1 = 3);
NONFAILING(*(uint16_t*)0x200025c2 = 0x4001);
NONFAILING(*(uint32_t*)0x20002858 = 0x62);
NONFAILING(*(uint64_t*)0x2000285c = 0x20002680);
NONFAILING(*(uint8_t*)0x20002680 = 0x62);
NONFAILING(*(uint8_t*)0x20002681 = 3);
NONFAILING(*(uint16_t*)0x20002682 = 0x42e);
NONFAILING(memcpy(
(void*)0x20002684,
"\x06\x1f\xb6\x5a\x7a\x7d\x9b\x71\xd7\x75\xdc\xab\x13\x57\x48\x15\xe0"
"\xf1\x93\xb3\x9f\x21\xa5\x6a\x57\xf8\x5a\x23\xa3\xbe\x4a\xb3\xf2\xfc"
"\x5f\xe3\x98\x67\x1f\xe9\x5a\x15\x46\x35\x6c\x4d\x85\x27\x20\x39\x7f"
"\x06\x20\x64\x5e\x9f\x03\x96\x3c\x95\xdb\x37\xe6\x0a\x16\xb2\xfc\xe6"
"\x5a\x5d\x3a\x1f\x59\xc7\x87\x33\xd9\x0a\x1e\x4d\xc8\x02\xb9\x6d\x4a"
"\x34\x3b\x54\x37\x19\x93\x57\x49\x4e",
94));
NONFAILING(*(uint32_t*)0x20002864 = 0x40);
NONFAILING(*(uint64_t*)0x20002868 = 0x20002700);
NONFAILING(*(uint8_t*)0x20002700 = 0x40);
NONFAILING(*(uint8_t*)0x20002701 = 3);
NONFAILING(*(uint16_t*)0x20002702 = 0x418);
NONFAILING(
memcpy((void*)0x20002704,
"\xb4\x52\xd0\x77\xc7\xce\x7c\x1a\xfb\xd0\x7f\x7e\x48\x10\xea"
"\xd4\x02\xed\x9f\xcd\x17\x0c\x4b\x0b\x90\xe5\x35\x00\x80\x65"
"\xc6\x03\x4d\x70\xce\xac\x54\x1f\x83\xe9\xd0\xba\x45\x0c\xc3"
"\x64\xd6\x27\x6a\xa7\x44\xe6\x8b\x6e\xf9\xbd\x16\x8e\x27\x6f",
60));
NONFAILING(*(uint32_t*)0x20002870 = 4);
NONFAILING(*(uint64_t*)0x20002874 = 0x20002740);
NONFAILING(*(uint8_t*)0x20002740 = 4);
NONFAILING(*(uint8_t*)0x20002741 = 3);
NONFAILING(*(uint16_t*)0x20002742 = 0xf0ff);
NONFAILING(*(uint32_t*)0x2000287c = 0x65);
NONFAILING(*(uint64_t*)0x20002880 = 0x20002780);
NONFAILING(*(uint8_t*)0x20002780 = 0x65);
NONFAILING(*(uint8_t*)0x20002781 = 3);
NONFAILING(*(uint16_t*)0x20002782 = 0x40c);
NONFAILING(memcpy(
(void*)0x20002784,
"\x5d\x03\xa1\xba\xa9\xc7\x3f\xab\x36\xcf\xbc\x1f\xc3\x48\x95\xb9\x95"
"\x1a\x0d\x01\x7a\xae\xc8\xfc\xe5\x91\x57\x55\xd6\xe6\x57\x68\xef\x1f"
"\x4e\xd9\xac\x67\x78\x7b\xc0\x17\x8b\x26\x9e\xe9\x28\xcd\x0d\xe6\xc2"
"\x0d\xfc\xe6\x1c\x17\xc2\x14\x43\xd4\xfe\x1c\x9b\xfb\xca\xd8\x37\x3c"
"\xb6\x4b\xa9\x34\xb3\xfd\xd7\x64\x95\xdd\x52\xe7\xa2\xb0\x5e\x7c\x8a"
"\x27\x4f\xb3\x9e\x29\x83\x2b\xc0\x5d\xf7\xad\xa1",
97));
res = syz_usb_connect(4, 0x98, 0x20002380, 0x20002800);
if (res != -1)
r[1] = res;
break;
case 3:
NONFAILING(*(uint32_t*)0x20000340 = 0x34);
NONFAILING(*(uint64_t*)0x20000344 = 0);
NONFAILING(*(uint64_t*)0x2000034c = 0);
NONFAILING(*(uint64_t*)0x20000354 = 0);
NONFAILING(*(uint64_t*)0x2000035c = 0);
NONFAILING(*(uint64_t*)0x20000364 = 0);
NONFAILING(*(uint64_t*)0x2000036c = 0);
NONFAILING(*(uint32_t*)0x200007c0 = 0x54);
NONFAILING(*(uint64_t*)0x200007c4 = 0x20000480);
NONFAILING(*(uint8_t*)0x20000480 = 0);
NONFAILING(*(uint8_t*)0x20000481 = 0);
NONFAILING(*(uint32_t*)0x20000482 = 3);
NONFAILING(memcpy((void*)0x20000486, "\x32\x61\xb9", 3));
NONFAILING(*(uint64_t*)0x200007cc = 0);
NONFAILING(*(uint64_t*)0x200007d4 = 0);
NONFAILING(*(uint64_t*)0x200007dc = 0);
NONFAILING(*(uint64_t*)0x200007e4 = 0);
NONFAILING(*(uint64_t*)0x200007ec = 0);
NONFAILING(*(uint64_t*)0x200007f4 = 0);
NONFAILING(*(uint64_t*)0x200007fc = 0);
NONFAILING(*(uint64_t*)0x20000804 = 0);
NONFAILING(*(uint64_t*)0x2000080c = 0);
syz_usb_control_io(r[0], 0x20000340, 0x200007c0);
break;
case 4:
NONFAILING(*(uint32_t*)0x20002a80 = 0x34);
NONFAILING(*(uint64_t*)0x20002a84 = 0x200028c0);
NONFAILING(*(uint8_t*)0x200028c0 = 0x20);
NONFAILING(*(uint8_t*)0x200028c1 = 0xc);
NONFAILING(*(uint32_t*)0x200028c2 = 0x5c);
NONFAILING(*(uint8_t*)0x200028c6 = 0x5c);
NONFAILING(*(uint8_t*)0x200028c7 = 0xa);
NONFAILING(
memcpy((void*)0x200028c8,
"\x62\x92\x72\x6b\xee\xa5\x7c\x29\xe2\x69\xea\x68\xe0\x24\xcc"
"\x6a\xa9\x73\x0a\x72\x2a\x7f\x5d\x94\x64\x50\xa4\x8f\xec\xe7"
"\x30\x5d\x4f\x9b\x5e\x47\xb6\x40\x73\x99\xea\xac\x2f\x16\x94"
"\x75\x89\xe0\xaf\x00\x42\x04\xb1\x7e\x3e\x61\x8c\x68\x4d\x06"
"\xc3\x57\xe3\xe0\x4a\x8b\xad\x72\xb1\xf9\x72\xfc\x72\x3b\x2b"
"\x1d\x80\x41\xf1\x36\x7a\x5b\x8e\x13\xb9\xbc\x2a\x2e\x07\xe7",
90));
NONFAILING(*(uint64_t*)0x20002a8c = 0x20002940);
NONFAILING(*(uint8_t*)0x20002940 = 0);
NONFAILING(*(uint8_t*)0x20002941 = 3);
NONFAILING(*(uint32_t*)0x20002942 = 0x8a);
NONFAILING(*(uint8_t*)0x20002946 = 0x8a);
NONFAILING(*(uint8_t*)0x20002947 = 3);
NONFAILING(*(uint16_t*)0x20002948 = 0x42a);
NONFAILING(memcpy(
(void*)0x2000294a,
"\x15\xc0\x39\x0c\x9b\x54\x75\x31\xf5\x97\xa1\x5a\x86\x66\x7f\x02\xe5"
"\xa5\x58\x03\x84\xbb\x95\x2e\xed\xc4\x12\xb2\xea\xef\x36\x46\x75\xb0"
"\x91\x6f\x6c\x82\xa1\xf8\xa1\xaf\xa5\x99\x17\xe3\x66\x39\xa9\xed\x3b"
"\x8e\xf6\x95\x5d\x68\x71\x63\x13\x40\xcf\x62\xb0\x33\x2a\x8e\xa1\x2a"
"\xbd\x86\xe1\xc7\x0e\xca\xbf\x01\x67\xd4\xb5\xa9\x3a\x92\x9e\x80\x2b"
"\x18\x92\x64\x16\xfc\xe7\xef\x5a\xd2\xf5\xb6\x72\xc8\x68\xc7\x35\xab"
"\xb8\x70\x51\x66\xf7\x70\x54\xb0\x07\x55\x46\x81\x54\x94\x08\x57\x3c"
"\xc9\xa6\x91\x79\x25\x6d\x60\x5e\x1e\x9a\x4f\x58\xab\x86\xde",
134));
NONFAILING(*(uint64_t*)0x20002a94 = 0x20008480);
NONFAILING(*(uint8_t*)0x20008480 = 0);
NONFAILING(*(uint8_t*)0x20008481 = 0x22);
NONFAILING(*(uint32_t*)0x20008482 = 0x25f);
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008486, 0, 0, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008486, 0, 2, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008486, 0xb, 4, 4));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008487, -1, 0, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008487, 0x81, 2, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008487, 0xf, 4, 4));
NONFAILING(*(uint8_t*)0x20008488 = 0xbe);
NONFAILING(*(uint8_t*)0x20008489 = 0xb);
NONFAILING(memcpy(
(void*)0x2000848a,
"\x6e\x12\x29\x03\xcc\x39\x08\x4e\x17\x01\xfc\xc5\x3e\xc2\x5a\x7e\x1c"
"\x80\x46\x72\xd4\x00\x6c\x64\x96\xce\x3e\xa8\x47\x57\x4d\x03\x73\x84"
"\x4e\x50\x46\xaa\xb1\xa4\x7d\x23\x8d\xf9\xc0\x0a\xe6\xaf\x1c\xb5\xda"
"\xe7\x80\xb3\x97\x7e\x9a\x8c\xb5\x24\x6c\xa2\x1b\x4a\xed\x1d\xb4\x1e"
"\xff\xa4\x53\x34\xa6\x8b\x03\x91\x49\x3b\x3e\xe5\x8a\xcb\x76\x2d\x8a"
"\xb1\x74\x21\x6a\x02\x0b\xfe\x9a\x84\x42\x70\xb9\x3c\x79\xac\xfe\xdd"
"\x8e\xb5\x26\x96\x24\xf4\xaf\x3d\xa7\x8c\x2e\x88\x53\x1e\xd0\xfc\xb2"
"\xa3\x0f\x15\xa1\xcb\x2f\x6e\x29\xd9\xb5\x37\x5f\x05\xf2\xc9\xd0\x15"
"\x59\x3c\x3d\xe7\x04\x64\x13\x7b\xc0\x82\x8b\xaa\x1f\x35\x5c\x35\x4c"
"\x0d\x23\x84\xd7\x80\xd4\xf8\x5f\x36\x90\xac\xd5\xec\x99\xb4\x9c\x78"
"\x95\xb6\x16\x69\xbd\x6d\x66\xb9\xc3\xdd\x98\x8f\x19\xd2\xf3\xd7\x71"
"\x3b\x92\x83",
190));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008548, 0xc0, 0, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008548, 0xad, 2, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20008548, 0xf, 4, 4));
NONFAILING(*(uint8_t*)0x20008549 = 0xa7);
NONFAILING(*(uint8_t*)0x2000854a = 0xe);
NONFAILING(memcpy(
(void*)0x2000854b,
"\xdf\x58\x35\xc3\x00\x04\x08\x52\xc7\x49\xe2\x8c\x24\xa7\xb3\x53\xe4"
"\x73\xb9\x87\x59\xd6\x5d\x2e\x91\x2d\x0c\x50\x4d\xde\x60\x64\xdc\xe2"
"\x2d\x37\xe9\x1c\xdc\x34\xf4\xc6\x1b\x04\xdc\x21\xac\xa0\x11\xb1\x53"
"\x23\x0e\x54\x5a\x57\xf5\x91\x02\x42\x10\x46\x9e\xc7\x04\xe0\x86\x53"
"\xb8\x47\x6e\x73\x76\x58\x56\x80\x15\x24\xc5\xbb\xa3\x1c\xc3\x12\x58"
"\x66\xf8\xfb\xf5\x76\x86\x9e\x45\xab\x47\xf4\x4b\x84\x21\xe4\x69\x4f"
"\xcc\xee\x90\x8c\xfc\x7f\x7e\x9a\x4b\x17\xcf\x80\xd6\x69\x6e\xe2\x82"
"\x74\xb6\xb3\xf6\x54\x78\x16\xb0\x72\x0f\x41\xd9\x23\xb5\xe6\xfa\x34"
"\xa4\x1f\x0a\x57\x35\x1f\xa1\x95\x24\x9f\xa1\xc8\x97\x70\x4e\x3e\x13"
"\x2e\x57\xe9\x99\xc8\x48\x5c\x25\x45\xf5\x9a\x30\x0e\xa1",
167));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200085f2, 0, 0, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200085f2, 1, 2, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200085f2, 0xf, 4, 4));
NONFAILING(*(uint8_t*)0x200085f3 = 0xec);
NONFAILING(*(uint8_t*)0x200085f4 = 0xb);
NONFAILING(memcpy(
(void*)0x200085f5,
"\x30\x99\x18\xaa\x91\x9f\x3b\x82\x0f\xcc\x38\xaf\x23\x30\x82\x94\xbd"
"\xb2\xb8\x05\x05\xad\x48\x15\xf1\x77\x3b\x2b\x6b\x84\xfc\x5b\x1f\x3c"
"\xbd\xa6\x6d\x0e\xf9\x34\x08\x11\xaa\x8a\x4d\xb8\xc3\x43\xd4\xe5\xbc"
"\xa9\x83\xf0\x93\x9e\x8e\x89\x06\x5f\xff\xa5\x35\x0c\xc1\x5b\x5a\x84"
"\xf1\xbb\xc9\xf7\xa6\xa6\x75\x91\xc0\x9b\xd1\x3a\xb1\x87\xfe\x0e\xce"
"\x5a\x36\xd5\xed\x92\x2b\x72\x67\x1c\x93\x96\xac\x92\xc0\x4f\x36\x54"
"\x7e\xa2\xf9\x9a\x4f\x67\xa0\x1d\x30\xf9\x01\xc1\xfa\x87\x70\xfe\xe4"
"\x08\xfa\xbf\x9c\x00\x18\xc3\x23\x4e\x98\x10\xba\x4e\xea\x14\x67\x46"
"\x5c\x0b\x93\x5f\xbb\x51\xc8\x4a\x42\x0a\x98\x56\xc7\xf3\x5b\x0d\x38"
"\xc2\x1c\x5e\xd9\xe8\x98\xe3\xb8\xb4\x9e\xaf\x73\x1e\x67\x2a\xfb\xeb"
"\xa7\x8b\x12\x93\xb0\xf0\xed\x7e\xa7\x41\x99\x09\xd2\xa9\xc1\xd6\x48"
"\x23\x83\x7b\x7e\x6d\xca\x33\x02\x51\x9e\x15\xa8\xe5\x91\x44\xa6\xae"
"\x15\xff\x32\x24\xc5\x20\x57\x44\x50\xb8\xc1\x27\x43\xd5\xe8\xf4\xa9"
"\x55\xb3\xc0\xa0\x51\xc9\x09\x20\x0d\xf9\xba\x6d\xe0\x70\xdf",
236));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200086e1, 3, 0, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200086e1, 2, 2, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200086e1, 0xf, 4, 4));
NONFAILING(*(uint8_t*)0x200086e2 = 0);
NONFAILING(*(uint8_t*)0x200086e3 = 0xb);
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200086e4, 0, 0, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200086e4, 0, 2, 2));
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200086e4, 3, 4, 4));
NONFAILING(*(uint64_t*)0x20002a9c = 0x20008780);
NONFAILING(*(uint8_t*)0x20008780 = 0);
NONFAILING(*(uint8_t*)0x20008781 = 0xf);
NONFAILING(*(uint32_t*)0x20008782 = 0xf3);
NONFAILING(*(uint8_t*)0x20008786 = 5);
NONFAILING(*(uint8_t*)0x20008787 = 0xf);
NONFAILING(*(uint16_t*)0x20008788 = 0xf3);
NONFAILING(*(uint8_t*)0x2000878a = 1);
NONFAILING(*(uint8_t*)0x2000878b = 0xee);
NONFAILING(*(uint8_t*)0x2000878c = 0x10);
NONFAILING(*(uint8_t*)0x2000878d = 1);
NONFAILING(memcpy(
(void*)0x2000878e,
"\xb7\xfe\xa6\x4b\x91\xd0\x38\xc6\x25\xb0\xa1\x32\x7b\x70\xdc\x5c\x52"
"\x03\x57\x91\x20\xb2\x54\xc1\x05\xb9\xa4\xc0\xbd\x41\x3a\x5c\x07\xa5"
"\x76\xeb\x00\xe1\xab\xf2\x24\x57\x78\x42\x99\x72\xa6\x55\xaf\xf2\xb0"
"\xc6\xfb\x08\x9f\x98\x00\x06\x0b\x90\x34\x67\xd6\x67\xf6\x0c\x54\x98"
"\x47\x7a\xfc\x1d\x57\x67\x1f\xad\x09\x41\xb5\x75\x8f\xc4\xc4\x2a\xbc"
"\xcd\xc5\x46\x68\xdb\xbd\x12\xc9\x25\xf8\x51\x80\xd4\xbe\x7d\x23\x87"
"\xd3\xd3\x60\xe0\xa9\x14\x8b\xef\x6f\x76\xea\x02\x86\x36\x67\x04\x5e"
"\xbb\xf5\x57\x86\x03\xbe\xb6\x82\xfb\x67\x8a\x5f\x26\xad\x05\xc2\xf9"
"\x57\xb6\x8e\x81\x1f\x64\x94\x53\x81\xd8\xda\x18\x70\x7a\xaf\x6d\xc4"
"\x15\xc3\xdc\x4c\x9f\x31\x61\x30\x18\xaa\x42\xba\xba\xfb\x3b\xa7\x3a"
"\x1c\x31\x46\xa9\x35\x2a\x22\x9f\xa7\x99\xb6\xf0\x2b\x5d\x89\xb2\x41"
"\x16\xaf\x84\x5c\xcc\xf2\xec\x8a\x43\xe1\xef\x6c\x93\xb0\xa9\x78\x69"
"\xd4\x44\x75\x41\x38\xcb\x8b\x3f\x82\xfa\x1f\x3c\x82\x88\xef\x97\x34"
"\x2e\x8b\xe3\xac\xa5\x35\x04\x11\x2c\xc5\x1a\x9e\x1f\x95",
235));
NONFAILING(*(uint64_t*)0x20002aa4 = 0x20002a00);
NONFAILING(*(uint8_t*)0x20002a00 = 0);
NONFAILING(*(uint8_t*)0x20002a01 = 0x29);
NONFAILING(*(uint32_t*)0x20002a02 = 0xf);
NONFAILING(*(uint8_t*)0x20002a06 = 0xf);
NONFAILING(*(uint8_t*)0x20002a07 = 0x29);
NONFAILING(*(uint8_t*)0x20002a08 = 7);
NONFAILING(*(uint16_t*)0x20002a09 = 0x18);
NONFAILING(*(uint8_t*)0x20002a0b = 4);
NONFAILING(*(uint8_t*)0x20002a0c = 0);
NONFAILING(memcpy((void*)0x20002a0d, "\xbc\x2d\x42\x9f", 4));
NONFAILING(memcpy((void*)0x20002a11, "\x12\x38\xdd\xdd", 4));
NONFAILING(*(uint64_t*)0x20002aac = 0);
NONFAILING(*(uint32_t*)0x20008b80 = 0x54);
NONFAILING(*(uint64_t*)0x20008b84 = 0);
NONFAILING(*(uint64_t*)0x20008b8c = 0x20008940);
NONFAILING(*(uint8_t*)0x20008940 = 0);
NONFAILING(*(uint8_t*)0x20008941 = 0xb);
NONFAILING(*(uint32_t*)0x20008942 = 0);
NONFAILING(*(uint64_t*)0x20008b94 = 0x20008980);
NONFAILING(*(uint8_t*)0x20008980 = 0x20);
NONFAILING(*(uint8_t*)0x20008981 = 0xa);
NONFAILING(*(uint32_t*)0x20008982 = 1);
NONFAILING(*(uint8_t*)0x20008986 = 1);
NONFAILING(*(uint64_t*)0x20008b9c = 0x200089c0);
NONFAILING(*(uint8_t*)0x200089c0 = 0);
NONFAILING(*(uint8_t*)0x200089c1 = 9);
NONFAILING(*(uint32_t*)0x200089c2 = 0);
NONFAILING(*(uint64_t*)0x20008ba4 = 0x20008a00);
NONFAILING(*(uint8_t*)0x20008a00 = 0x20);
NONFAILING(*(uint8_t*)0x20008a01 = 8);
NONFAILING(*(uint32_t*)0x20008a02 = 1);
NONFAILING(*(uint8_t*)0x20008a06 = 9);
NONFAILING(*(uint64_t*)0x20008bac = 0x20008a40);
NONFAILING(*(uint8_t*)0x20008a40 = 0x20);
NONFAILING(*(uint8_t*)0x20008a41 = 0);
NONFAILING(*(uint32_t*)0x20008a42 = 4);
NONFAILING(*(uint16_t*)0x20008a46 = 2);
NONFAILING(*(uint16_t*)0x20008a48 = 1);
NONFAILING(*(uint64_t*)0x20008bb4 = 0x20008a80);
NONFAILING(*(uint8_t*)0x20008a80 = 0x20);
NONFAILING(*(uint8_t*)0x20008a81 = 0);
NONFAILING(*(uint32_t*)0x20008a82 = 4);
NONFAILING(*(uint16_t*)0x20008a86 = 2);
NONFAILING(*(uint16_t*)0x20008a88 = 0x40);
NONFAILING(*(uint64_t*)0x20008bbc = 0x20008ac0);
NONFAILING(*(uint8_t*)0x20008ac0 = 0x40);
NONFAILING(*(uint8_t*)0x20008ac1 = 1);
NONFAILING(*(uint32_t*)0x20008ac2 = 3);
NONFAILING(memcpy((void*)0x20008ac6, "\xbf\x85\xc9", 3));
NONFAILING(*(uint64_t*)0x20008bc4 = 0x20008b00);
NONFAILING(*(uint8_t*)0x20008b00 = 0x40);
NONFAILING(*(uint8_t*)0x20008b01 = 9);
NONFAILING(*(uint32_t*)0x20008b02 = 3);
NONFAILING(memcpy((void*)0x20008b06, "\xb1\x9a\x3e", 3));
NONFAILING(*(uint64_t*)0x20008bcc = 0);
syz_usb_control_io(r[1], 0x20002a80, 0x20008b80);
break;
case 5:
NONFAILING(*(uint8_t*)0x20005380 = 0x12);
NONFAILING(*(uint8_t*)0x20005381 = 1);
NONFAILING(*(uint16_t*)0x20005382 = 0x300);
NONFAILING(*(uint8_t*)0x20005384 = 0x4e);
NONFAILING(*(uint8_t*)0x20005385 = 0x56);
NONFAILING(*(uint8_t*)0x20005386 = 0x59);
NONFAILING(*(uint8_t*)0x20005387 = 8);
NONFAILING(*(uint16_t*)0x20005388 = 0x13d3);
NONFAILING(*(uint16_t*)0x2000538a = 0x3341);
NONFAILING(*(uint16_t*)0x2000538c = 0x90e4);
NONFAILING(*(uint8_t*)0x2000538e = 4);
NONFAILING(*(uint8_t*)0x2000538f = 4);
NONFAILING(*(uint8_t*)0x20005390 = 2);
NONFAILING(*(uint8_t*)0x20005391 = 1);
NONFAILING(*(uint8_t*)0x20005392 = 9);
NONFAILING(*(uint8_t*)0x20005393 = 2);
NONFAILING(*(uint16_t*)0x20005394 = 0x207e);
NONFAILING(*(uint8_t*)0x20005396 = 1);
NONFAILING(*(uint8_t*)0x20005397 = 3);
NONFAILING(*(uint8_t*)0x20005398 = 2);
NONFAILING(*(uint8_t*)0x20005399 = 0x40);
NONFAILING(*(uint8_t*)0x2000539a = 5);
NONFAILING(*(uint8_t*)0x2000539b = 9);
NONFAILING(*(uint8_t*)0x2000539c = 4);
NONFAILING(*(uint8_t*)0x2000539d = 0xa3);
NONFAILING(*(uint8_t*)0x2000539e = 0);
NONFAILING(*(uint8_t*)0x2000539f = 1);
NONFAILING(*(uint8_t*)0x200053a0 = 0x5a);
NONFAILING(*(uint8_t*)0x200053a1 = 0xbd);
NONFAILING(*(uint8_t*)0x200053a2 = 0xfe);
NONFAILING(*(uint8_t*)0x200053a3 = 8);
NONFAILING(*(uint8_t*)0x200053a4 = 2);
NONFAILING(*(uint8_t*)0x200053a5 = 0x2f);
NONFAILING(memcpy(
(void*)0x200053a6,
"\x42\x58\xd3\x9e\x51\xa3\x5f\xa7\x73\x66\x72\x83\x7e\x4c\x90\x1b\x77"
"\xcb\x77\xb4\x62\xae\x6c\x82\xd7\x4c\x2f\x83\x34\xfc\x26\xc2\x32\xa6"
"\xed\xa9\xe4\x89\xfe\xcc\x99\x81\xb4\xd5\x94\x78\x36\xe5\x08\x5a\x19"
"\xf3\x7e\x7e\x90\x75\x1b\x70\x61\x70\x90\xa6\x94\x7e\x8a\xfa\xb7\xbb"
"\xa2\x3f\x9e\x2e\x0a\xbf\xbb\x9f\xec\xf5\x3f\xb7\x94\x32\x53\x1f\x39"
"\x24\x0e\x59\xd6\xdf\x84\x68\xb3\x6e\xbe\x4c\x56\x84\xe1\xa7\x8b\xd1"
"\x37\x0b\x6b\x77\xc0\x27\x57\x8d\x15\x8f\x67\x2e\x4f\xef\xdb\x0a\xcb"
"\xaa\x1d\x40\x3c\xf0\x88\xcf\x73\xff\x6a\xbb\x6f\x19\x24\xb2\xdd\x20"
"\x4b\x22\x26\xe7\xf3\xe3\x1c\xd6\x2c\x28\xc0\x35\x7a\x03\x53\x5a\xd3"
"\xcb\x3d\xde\x10\x6f\x7d\x22\x15\xf2\xbc\x43\xc9\x4e\x32\xf0\xad\x91"
"\x43\xad\x27\x30\xf2\x6f\xaa\x36\xc1\xa0\xe0\xd4\x6d\xf8\x75\x1f\xfd"
"\x51\x3e\xe8\xe5\x06\x9e\x4c\x3e\xaa\xe7\xc1\x25\xdc\xd9\xfc\x32\xa1"
"\xfb\xa5\x5e\xe0\x2a\x8e\xf6\x59\x86\xa2\xc0\x04\x8a\x69\xec\x7a\xb6"
"\xc7\xba\x1e\xc4\x6d\x1e\x58\x85\x58\xe3\xce\xac\xe0\x9c\x68\x4f\x62"
"\x6a\x38\x29\x50\x07\xdc\x58\xb1\x43\x86\x11\xbb\xdc\x76\x1a\x2c\xb0"
"\xa9\x2c\x21\xba\x60\x5f\xfa\x34\x50\x07\x6b\x2b\x96\xe9\x34\x54\x1c"
"\xac\x54\xc4\x32\xee\x9f\x63\x74\xd9\x6e\xde\x4a\x13\x51\x68\xef\x69"
"\x7c\x3a\x74\xe3\xb3\x2f\x60\x50\xcc\xa8\xfd\x60\x43\x8f\xcf\x11\x17"
"\x2b\x2c\x77\x30\x53\x59\x28\xdd\xae\x1a\xaa\x33\x18\xa6\xb8\x1e\xe7"
"\x37\xdd\x41\xa3\xa0\x69\xc2\x4b\x64\x93\x8d\xdd\x3c\xcf\x3f\xb3\x5e"
"\xe1\xd3\xa1\x17\x18\x9c\x30\x6e\xb6\x0d\x0b\xb4\x4a\xd6\x70\xcb\x72"
"\x65\x8a\x96\x36\x53\xdc\xeb\x66\xed\x8f\xed\xa3\xbc\x57\x14\xc1\xa0"
"\x04\x00\x56\xda\xc4\x0d\x6b\x84\x51\xaa\xda\x1c\x26\xa8\x40\x2b\x82"
"\x5d\xdf\x1b\x2e\x65\xf3\x87\x92\xb0\xa9\x22\x6e\xba\x8d\x4d\x8f\xf3"
"\xc4\xbd\xba\x4c\xa6\x6f\x94\xca\x12\xfd\x5c\x54\x5a\xfa\x95\xfb\x55"
"\x81\x1a\xda\x72\xf0\xae\x5a\x23\x4f\x42\xe0\xa9\x92\xff\xdd\xdd\x4e"
"\xb2\x73\x78\x26\xf6\xc1\x76\xdb\x9c\x01\x72\x0d\x5e\xc1\x30\xf5\xf3"
"\x4e\xdb\x68\x72\x07\xbc\x74\x88\x45\x1f\x93\x5d\x04\x8d\x26\x90\x46"
"\x7c\x18\xdf\x42\xea\xf3\x7d\x8b\xe5\xd7\x96\xd5\xdb\x96\x5b\x1b\x14"
"\x9e\xf1\xa8\x5a\xce\xee\xf2\x2a\x4e\x62\xe0\xa3\x87\xd4\xc0\x8c\x47"
"\x28\xeb\x13\xfa\x4d\xee\x89\xe2\x8f\x8d\x51\x42\xca\xc9\x34\x0e\xe5"
"\x34\x31\xcb\xfb\x4b\xe3\x19\xd5\x5d\xbf\xa1\xe2\xdd\x53\x65\x72\x11"
"\xb2\x26\x20\xda\x3f\xbe\x18\x91\x69\x39\x7d\xe4\xfe\x2f\x21\x82\x36"
"\xbf\xfe\x92\xb2\x39\xba\xfd\xc5\x7b\x2d\x4a\x71\xce\x97\x3c\xf2\x9d"
"\xca\x39\x85\x45\xc3\x86\x17\x4e\x97\x1d\x42\x82\x97\x97\x74\xfe\xca"
"\x0b\x8f\xb0\xe9\x4f\xaf\xe4\x4d\x5c\xd3\xfb\x28\x1f\x95\xa2\xdd\x04"
"\x01\x40\x7a\x15\x7e\x8a\x20\xae\xbb\x46\x29\x83\x7f\xc2\x8b\xd2\x79"
"\xdf\xe8\x61\xe2\x66\xd7\x11\xe8\x8c\xb0\xc2\x93\x91\x66\x3c\x9e\xc0"
"\x6c\x9d\x82\x0b\xaf\x59\x85\xa1\x6a\x59\x04\xf4\x10\xa4\x27\xd1\xa1"
"\x9e\xcd\x41\x8c\xbf\x0b\x87\x05\x1d\xab\x61\xdd\x10\xfa\x2c\x7c\x9a"
"\xb2\x7f\x5d\xa6\x41\xe5\x26\x28\xfc\x65\x1d\x96\x78\x68\x53\x6c\xdb"
"\xd9\xe9\xce\x48\x30\x3d\x04\xdf\x05\xf7\xce\xb1\xe0\x9d\x6b\x55\x9d"
"\x75\x0a\x01\x8e\xb6\x5e\xef\xc5\xca\x77\x0c\x3e\xb8\x7b\x01\x6c\xe5"
"\x7c\x1e\x4f\x68\xdd\xc2\x2b\x8d\xac\xf7\xfd\xb3\xa8\x26\xb4\x0d\x83"
"\x29\x99\xee\x0c\x6a\xab\x29\xf7\x8e\x39\x31\x69\xa1\x18\x75\x6c\x8a"
"\x91\xc1\x07\x9b\x17\x11\xb7\x40\x5d\x3e\x10\x72\xe6\x35\xfb\xf0\x7e"
"\xb6\xd3\x22\xd4\x9b\x2d\xc2\xf7\xda\x04\xac\x4e\x93\x09\xb2\x1a\x14"
"\x84\x80\x70\x76\xe3\x0d\x09\xf6\xae\x5a\xf2\x42\xdd\x83\xb1\x45\x9d"
"\x9f\xa9\x7f\xa6\x7d\x00\xc3\xa3\xfb\x56\xb4\x33\xab\xb9\x4d\xe5\xef"
"\x55\x17\x84\xeb\x96\x08\x66\xde\x62\xe4\x7d\xad\xdb\x07\xc1\x8d\xfa"
"\x79\x22\xea\xc8\xcb\xd5\x42\xf3\xc5\xb2\x49\xf3\x2b\xc3\xb9\x2e\x5e"
"\x29\x05\xc3\x00\xf0\xba\xdb\x7b\x37\x90\x28\x17\xd5\x74\x59\xd5\xcb"
"\xa4\x64\xb5\x54\x84\x5c\xd5\x33\xff\x23\x36\x92\x00\xba\x36\x6e\x86"
"\xa9\x3f\x38\x2e\x8a\x64\x37\x55\x77\x5c\xc1\xd9\xbf\xbd\xde\x6c\xf1"
"\x1a\x95\x7a\x30\x25\x5a\x8d\x9e\x47\x23\x78\xec\x2b\xee\xe6\xcb\x72"
"\x0a\x61\x19\xa5\x20\x4d\xe8\xc4\xd5\x5c\x5e\xbf\xbe\xe4\x9c\x44\x94"
"\x36\xe2\xee\x13\xb4\x4d\x9a\x71\xff\x6d\x30\x90\xfb\x03\xff\x8a\xbf"
"\xb8\xc5\x4f\xbc\xd8\x1d\xe1\xc0\x36\x1a\xb8\x6e\xb6\xe1\xf4\x45\x1a"
"\xaa\xe0\x8f\x52\x38\x90\x7b\x15\x6e\x0b\xa3\x8e\x9b\x98\x97\x30\xd1"
"\xd9\x03\xb1\xff\x12\xff\x31\xe5\x1b\xfa\x87\xf0\x78\x66\xe1\x00\xb4"
"\xf2\xbd\x64\x01\x0a\xc6\xff\x83\xf1\x24\x34\x87\xeb\xbc\xf2\xe7\x5c"
"\x39\xec\xe5\x56\xdd\xf8\xba\x49\x40\x3a\x1c\x5e\x24\x59\xae\x22\xe7"
"\x3f\x2c\xae\xbe\xd6\x0d\x3b\x21\xb9\x0b\xfa\xa0\x9d\x6f\x71\x24\x22"
"\xd0\xf8\x08\xb6\x96\x76\x6b\x0d\x83\xd5\xea\x38\xbf\xf5\x63\xf3\x30"
"\x90\x1d\x34\x65\x7e\x14\xd5\x9e\x39\x56\x71\xc8\xd1\x9d\x62\xa8\xb3"
"\xdd\x47\x41\xd2\x4e\x77\xab\xee\xb2\x22\x70\xc4\xd5\xc7\x1a\xbb\xda"
"\xe8\x03\x04\x79\x56\x1c\x17\x0d\xbd\xfa\xc0\x2f\x27\x5d\x8f\xb5\x7a"
"\x42\x42\xda\x21\xc0\x92\x9d\xb9\xce\x9c\x02\x39\xc9\xfb\x94\x34\x15"
"\x8a\xbc\xf5\x1f\x8e\x01\x40\xd3\x63\x21\xa6\x6c\x51\xff\x4c\xe9\xa8"
"\x40\xa6\x05\xb3\x5b\xd5\xd6\x06\xed\xb4\x4f\x5f\xa3\xf8\x43\x23\x30"
"\x78\x31\xe4\x12\x4e\x68\xdc\x24\x36\xbc\x21\x42\xf7\xbb\x9f\xd0\x1a"
"\x21\xef\xaf\x75\x78\x1b\x75\x08\x59\x77\x3a\x62\xc0\xff\x5f\xb1\xc2"
"\x1e\x57\x91\xa9\x5a\xde\xd1\x19\x33\x8a\x40\xaa\x70\xe3\x64\xe1\xf0"
"\x97\xc9\xad\xdc\x6c\x9a\xb0\x72\x27\x72\xb8\x79\xdb\x53\x63\xff\xf5"
"\x73\x30\x81\xf9\xac\x3d\x84\x8c\xba\x95\xdc\x44\x2d\x69\xd9\x23\xf0"
"\xdc\x60\x09\xcf\xaa\x73\xdc\x42\xe0\x47\x76\x21\xa3\xf8\xc3\x88\x41"
"\x9a\x19\xe6\x60\x66\x27\x5d\x77\xec\x45\x90\x0f\x61\xd5\x8b\x3b\x17"
"\x99\x3d\xcb\xea\x4d\xab\xaa\x9b\xe7\xac\x90\xb9\xd3\x2f\x5b\x3c\xd8"
"\x46\x2e\xf2\x79\x36\xe2\x4c\xf4\x9c\xbb\x77\xe0\x1c\xbb\xbe\xda\x01"
"\xe5\xfc\x86\xb5\xad\x93\x2a\x13\x34\x38\xe2\x6d\x61\x59\xe4\x6f\x5d"
"\xdb\xb9\x15\xc3\x9f\xb0\x7d\x77\xb6\xae\xc2\xfc\x5a\x93\xa4\xfd\xc0"
"\xc4\x95\x88\x9e\x11\x5e\xe9\x91\x24\xae\x13\xee\x7a\xa9\xe9\xef\x56"
"\x08\xab\xfa\xdf\x7e\x02\x6a\xab\x16\x6f\x14\xd4\xb4\xa8\xce\x05\x98"
"\x88\x4b\x39\x89\x7c\xb2\xd5\x7b\x3c\x7f\xe2\x9f\xd9\x72\x7b\x3b\xb1"
"\x15\x4d\x60\xf1\x75\x42\x34\xeb\x8d\xb0\x06\x96\xc1\x68\x83\x38\x7f"
"\xb0\xa6\x84\x68\x98\xd9\x82\xb2\x0d\xae\x41\x49\xd8\xc6\xe2\x0c\xef"
"\x06\xba\x25\xa9\xc4\x98\x5b\x08\xe8\xef\xea\x80\x6c\xfd\x7f\xa0\xc0"
"\xd5\xfd\x6a\xe6\x06\xa0\x33\x4b\x7c\xb2\x4d\x05\x06\x25\xb4\xb3\x36"
"\x1e\xf3\x8a\x91\xcd\x90\x70\xd2\xd3\x6a\xf8\xc6\x53\xb0\x1c\x92\x6c"
"\x55\xce\x1e\x24\x39\x2e\x74\x6f\x30\x05\xdf\xaa\x93\x71\xcd\x93\x25"
"\x4f\x00\xce\xc9\x1c\x25\x2a\xb0\x7b\xa1\x61\x4e\x4f\x8e\x82\x7e\x43"
"\x3d\xc5\x24\xde\x2c\x09\x33\x9b\x26\x7c\x8b\x0a\x58\x86\xe6\xd6\x3d"
"\x8f\x34\x8b\xe5\xcd\x97\xb8\x58\x7b\xeb\xcf\x50\xc8\x26\x24\x47\x13"
"\x34\x7b\xfe\x02\x04\x06\x1a\x60\x7c\xdb\xf1\xaa\x64\xb4\xbe\xae\x74"
"\x68\xc1\x44\x60\x84\xd9\x71\xe7\x8c\x33\xeb\x49\xb9\x1f\x6d\xbd\xec"
"\x00\x16\xe2\xa1\xaf\x34\x84\xa2\x79\x16\x38\x97\x60\x1f\xbd\xe6\x79"
"\x24\xda\x3c\x07\xe8\xd3\x37\x69\x34\xa8\x95\x1f\x35\x46\x78\xfa\xdb"
"\xb8\x7f\xdf\xc9\xd9\x2d\xbd\x0e\xeb\xd2\xd0\xfb\x2e\xa6\x57\xa8\xc5"
"\x64\x43\xcc\xb4\xeb\x78\xa2\x08\x1a\x88\x94\x37\xa5\xac\xb1\x84\x9b"
"\x0f\xf3\x59\xbc\x5e\x66\xea\x94\x71\x9f\x72\x12\x30\xf6\xa7\xe1\xb9"
"\xc5\xeb\xeb\x9a\x47\xe6\x0b\x06\x88\xf0\x58\xb9\x74\x08\xaa\x56\x86"
"\xf6\x5b\x95\x36\x8b\x08\x9d\x58\x79\x28\x69\x1c\x31\xdc\xcb\x5b\x62"
"\x0c\x1e\xc7\xe3\xa3\x84\xc7\x83\x66\x77\xa4\x65\xc2\xaf\xd7\xa1\x60"
"\x53\x73\xb6\x39\x83\x09\xda\xfd\x46\x10\xe6\x62\x90\xc3\x1b\xd3\x41"
"\x37\x5e\xc7\xed\xb2\x73\xfc\xc2\xd1\x20\x53\xa1\x06\xf9\xb6\xd0\xee"
"\x42\x2b\xd4\x0c\xd9\x88\x8d\x18\x67\x73\x29\x0f\x23\xc5\x55\xdf\xe2"
"\x8d\x2c\x25\x04\x85\x3e\x67\x21\x6b\x1a\x71\x7c\x70\x3e\x3d\xf8\xf7"
"\x5f\xb3\xcd\x7e\x56\x66\x6c\xf4\x9a\x85\x2e\x4e\x29\xaf\x17\x90\x30"
"\x1b\x60\x4e\xbf\x6f\x0d\x42\x28\x3c\xdf\xcd\xbf\xe7\x91\xd3\x01\xb4"
"\xae\xe5\xed\x25\x75\xbd\x7f\xf6\xb3\xe0\xda\xe6\x1e\x94\x36\xb8\x5a"
"\xb1\xed\x4e\xff\xf6\x61\x1e\x9e\x51\x65\x57\xdc\x25\x1a\x29\x3c\x68"
"\x60\xdd\x58\xc2\xe8\x26\x56\x27\x9b\x3c\x9f\x7a\x31\x7a\x05\x1e\x4c"
"\xa1\x81\x52\x28\x4c\x78\xe3\x98\x3e\xbf\xe4\xad\xb9\x73\x12\x63\x48"
"\x87\x62\x1b\xc6\x75\x69\xe7\x90\x3d\x47\x0e\xa9\x41\x5d\x99\xd1\xdf"
"\xa8\xb1\x37\x68\x6f\x62\x58\xbf\xc3\xd8\x62\x96\x1c\xa2\x33\x66\x32"
"\x2f\x39\x07\x8e\xf4\x41\xd4\x4c\xee\x55\x0f\xd0\xee\xea\x0b\x6b\x80"
"\x6a\x43\x63\xa1\x48\x0a\xe3\x65\x9a\x2c\xed\x18\x7e\x09\x91\x48\x68"
"\xe5\xe0\xed\xb9\xe4\x9f\xf6\x17\x01\x63\x17\xc0\x24\xdc\xd7\xaa\xd9"
"\x65\x76\xc9\xde\x52\xb8\x59\x7c\x2b\x35\x7d\x3d\xed\x0e\xe8\x60\x1d"
"\x12\x28\xee\xf3\xb8\x65\xa9\xb4\x70\xc2\x4b\x98\x78\xdd\x24\x0c\x49"
"\x83\x6c\x4a\x55\x9e\xb8\x0a\xbd\x2b\x55\x59\xd3\x51\xad\x7e\x1e\x68"
"\xc7\xc5\xdd\xe2\xba\x1b\xd1\x66\xde\x4a\x80\x18\x16\xdd\xeb\xff\xa4"
"\x7a\xe8\x35\x0d\xf3\x70\xbe\xd4\x1e\xeb\xba\x32\x51\x6d\xa9\x24\xff"
"\x98\x92\xfe\x4a\x30\xa3\x6c\x73\x19\x4f\x38\x64\x6c\x1d\x3a\xa8\x5e"
"\xc1\x8c\x33\x21\x29\x68\xd4\x95\xd8\x59\x72\x3a\x14\xb6\xb0\xf8\x3a"
"\xe2\x23\x55\x1d\x2b\x54\x67\x13\x68\x80\x74\xff\x36\x1f\x62\x00\xd4"
"\x80\xdb\x9d\xc9\xa0\x57\xb0\x6d\x2d\xd4\xe4\x9a\x19\xeb\x3e\x07\x69"
"\x71\x93\x78\x7f\x3f\x74\x30\xae\xae\x82\x13\xdc\x09\x66\x05\xeb\xeb"
"\xe4\x59\xda\xcd\x14\x1b\xc9\xab\xbf\x63\x06\xf8\xe2\x34\x71\x15\x67"
"\x4e\xa2\xc2\x98\xa2\x66\x14\x4c\x45\xfc\xf5\x82\x12\x03\xa1\xf9\x56"
"\xb9\x19\x98\xc4\x9c\x5b\xac\x12\xde\x31\x96\x4f\x97\x32\x84\xd4\x16"
"\x67\xb3\xdc\x80\xa4\x2d\xd8\x35\x6b\xab\x3b\x89\xf4\xc8\x26\x12\x53"
"\x54\xa1\xad\x97\x4a\xde\x29\x19\xac\x13\x27\xc9\xd1\xfe\xe9\x5a\x21"
"\x95\xa2\xee\xd9\x8b\xb5\x9a\x24\xbe\x59\x0b\xdd\x25\x68\xa8\x8b\x95"
"\x52\x08\x7e\xe4\x66\xe7\xef\xff\x28\xdc\xba\x19\x4c\xe1\x67\xa5\xbf"
"\x84\xfd\xbd\x5f\x93\x2b\x78\xda\xab\x18\xa3\x05\x5d\x63\xc9\xbe\x53"
"\x30\x8f\x72\xd2\x45\xf6\x72\x7e\xc6\xd5\xab\xdf\xc9\xad\x42\xb5\xa9"
"\x70\x64\x1d\x57\x0a\x24\x38\x03\x42\xa9\xa5\xe2\x24\x34\xa5\xce\xa2"
"\x28\x42\x6c\x9b\x85\x98\xd5\x81\x83\xf6\x8c\x1b\x85\xc5\x24\xe2\xa8"
"\x09\x73\x8f\x45\x5b\x16\x06\xfc\x36\x34\x23\x79\x9b\xcb\xe4\x27\x5a"
"\xd2\xbd\x4e\x04\x42\x7d\x0a\xda\x8f\x8e\x29\x61\x7c\x40\x8a\xbc\xd2"
"\xc2\x70\x3b\xbd\x91\x54\x64\x8a\xd9\xbd\x60\x56\x8d\x62\x44\x66\x85"
"\x12\xe8\xfd\x08\xe3\x12\xd4\x20\xab\x6b\xcc\xdc\xfa\xcd\xb8\xbc\x5e"
"\xcf\xde\x87\x13\x04\x6d\xc2\x59\x5e\xc6\x12\x44\xf8\x6a\xb4\xc5\x5b"
"\xf9\x26\x82\x17\xad\xe1\xdb\xb0\x3d\x92\x64\xbb\xa7\xc8\x21\x97\x8a"
"\x25\xce\x99\x75\x78\x7d\x4d\x33\xe0\x7b\xb4\x4f\x34\xff\x51\xa1\xf0"
"\xb7\xd7\xb8\xea\x29\xf4\x37\xd2\x2c\x07\x6e\xff\xaf\x74\x8b\x47\xbd"
"\x3d\xbd\xdb\x77\xbd\x43\xa7\x0a\xaf\x71\xc9\x88\x2b\x75\x1b\x4f\x5f"
"\xcc\x37\x3a\xeb\x56\x2f\x8c\xe3\x8c\xbe\x76\x6f\x51\x33\x19\xb0\xcf"
"\x8b\x7d\x33\x2c\x20\x9a\x5f\xdc\x82\x57\x2a\xeb\x85\xd6\xa0\x11\xfa"
"\xf8\xab\xc7\x42\xbd\xc9\x7e\x0b\xa1\x5c\x43\xec\x48\x86\xe8\xf6\x9a"
"\x00\x58\x4a\xab\xb5\xa2\xfb\x67\xc4\xb7\x83\x24\x6f\xa1\xc6\x6b\x07"
"\x5d\x13\xf4\x0c\xff\x33\x0f\xf0\x88\x57\x1d\x13\xc5\xaa\x9b\xfc\x9a"
"\x48\x67\x7c\x1f\xba\x21\xe4\x5c\xe0\x19\x54\x7f\x48\x9b\xfd\x84\x21"
"\x5b\x82\xbe\x97\xd1\x02\xd5\xc3\x8f\x6c\x57\xaa\x2e\xad\xb4\x17\x9a"
"\x0e\xb2\x28\x00\x07\xa7\xae\x7f\xda\x5b\x40\x6c\xfd\x07\x15\x3a\xc5"
"\x13\xdc\x7b\x79\x59\x9b\x50\x5b\x88\x0d\xac\x92\x28\x41\x1d\x6c\x76"
"\xed\x94\xd6\x19\x07\x11\x6d\x7b\x68\xc5\xbc\x05\xd0\x76\x97\x52\x5a"
"\xf5\xd1\xbc\x1c\xf4\x9e\x44\x25\x8e\x55\x8f\xcc\x75\x8c\xcb\x03\xed"
"\x02\x3b\x51\xa1\x63\x3d\xd2\x2f\x76\x98\x6f\x71\x05\x84\x9d\xd6\xef"
"\xc4\xce\xbc\x5a\x70\x1f\x1b\xef\x66\xee\x8b\x9f\x9d\xca\x1d\x3f\xc2"
"\xdf\x8d\xe2\x01\xf6\xec\x7d\x83\x52\x43\x7b\x88\xcf\x10\x9c\x1a\x42"
"\x48\x67\x45\xe5\xbe\x0e\x8f\x51\xbd\x6b\x0f\xd7\x71\x43\xed\x0a\x86"
"\x31\x6d\x6c\x89\xfa\xd1\x20\xb1\x70\xb5\x5d\xb5\x6d\x84\x4f\xe9\x64"
"\x7a\x95\xe3\xf9\x4e\x5d\x27\x6e\x17\xfe\xd3\xde\xbe\xf3\xf5\xb1\x52"
"\x36\x9f\xc9\x78\x28\x15\x1c\x72\xdf\x24\x51\x81\xa4\x9e\x6f\x64\xae"
"\x56\xa5\xbd\xa6\x74\x53\x18\x15\x3e\x25\x30\x5a\x54\xfb\x62\x69\x9a"
"\xc7\xd8\x8e\xb5\x57\xf1\x2c\xf0\x30\xea\xca\xd7\x78\x11\x4e\x5e\xb6"
"\xe5\x87\x2d\xa0\x1f\x26\xfd\xe0\xef\x71\xb2\x3f\xa9\x67\x99\x74\x88"
"\x50\xe3\x8c\x3a\x78\xc6\xfe\x0a\xc5\x89\xa5\xea\xd1\x50\x1a\xe1\xea"
"\x09\x4a\x81\xe7\x74\x8b\x1b\x21\xa4\xf7\x11\x16\x2f\x2c\x6b\x13\xaa"
"\xc6\x86\x8c\xd3\x18\xab\xac\x0c\xe2\xa3\x19\x94\x9c\x8c\x7a\xe8\x80"
"\xbc\x85\x5a\x41\x4e\x05\x7b\x1a\x09\xcb\xc2\x56\x03\x8d\x5f\x74\x76"
"\x9a\x25\x98\x18\xc2\xad\xf3\x92\xaf\x0e\x93\x5f\x2e\x12\xe2\x33\xd7"
"\xf2\xcb\x52\x40\x13\x81\xba\xc9\xeb\xb3\x37\x37\xd5\xe8\x1c\x11\x5e"
"\x04\x08\x38\x88\xd5\x86\xb7\x6e\xfa\x5b\xbf\xca\x43\xc3\xd2\xa2\x19"
"\x6c\xce\xa8\x4c\xe9\x9a\x81\x98\x2f\xf1\xaa\x5d\x62\x0e\x05\xdb\xd0"
"\x17\x44\x18\xbc\xbf\x57\x42\x0a\xe5\x97\xaa\x01\x9b\xb7\x0e\xa5\xfe"
"\x54\x1c\x88\xf1\x50\x8b\xea\x89\x1e\x76\x28\x6d\xa7\x4f\xcb\x01\x0f"
"\xf4\xf4\xc7\xca\x50\x0c\x15\x18\x1c\x25\x7b\xb9\xaf\x94\x07\x66\x96"
"\x45\x55\x46\x21\x8c\xb3\x18\xce\x36\x39\x95\x5e\x03\x8c\x8c\x6b\x2a"
"\xcf\x83\xd2\xaa\xf4\xdc\x65\x51\x71\x31\xc5\x41\x38\x7b\x56\x5a\x8e"
"\xa3\x8d\x77\xea\xae\xe3\x53\xc7\x8a\xca\x6d\xed\x97\x12\xd7\xda\x27"
"\xde\x6e\xe3\x3e\x27\x21\x79\x57\x65\x4b\x3a\x29\xa4\xb0\x4b\x3a\xb4"
"\xe5\x72\x6a\xb9\x5f\x96\x95\x4e\x14\x08\x21\x82\xca\x27\x9a\xc5\x95"
"\x22\xaf\xbf\x0e\x91\xa2\xb1\x84\xe1\x66\x9b\x9f\xe2\x7d\x18\x5d\x9e"
"\xb3\x87\x56\x22\x43\xb7\x78\x64\xa7\x8d\xee\xab\x16\x87\x76\x16\xc9"
"\x4d\xc2\xed\x50\x8a\x9b\xcf\x1c\xae\xa9\x0f\x20\xf2\xb0\x81\x87\xe8"
"\xb3\xcc\x76\xe2\x99\x6c\x19\x40\xc4\xa4\xc7\x5d\x9f\x6a\x0a\x7e\x2e"
"\x98\x7f\x82\x78\x32\x16\x2c\x3c\x2e\xac\x93\xb4\xba\xb0\xd0\x79\x04"
"\xd9\xc8\x8e\xe2\xac\x6a\x2b\xe8\x77\x9f\xca\xd2\x45\x88\x11\x1c\x18"
"\x05\xb3\x87\x13\xe3\x16\xf3\xb4\x76\x10\x96\x85\xdd\x1f\x3e\x4b\xfc"
"\xb4\xbc\x2a\x30\x59\x96\x2c\xa9\xda\x4d\x5e\x21\x4b\xf6\xe4\x1e\xe2"
"\xe2\x85\xbf\x80\x81\x7c\x5c\x12\x80\x7d\xe9\x04\xf7\x6c\x74\x2a\x9a"
"\x9d\x98\x42\x17\x46\xdf\x57\x5f\x16\xea\x79\x15\x6f\xe3\xa0\x6c\x64"
"\x4c\xc7\x23\x3e\x62\xbf\x7d\x1b\x9c\xb9\xfb\x6a\x7d\x7d\x50\x62\xd7"
"\xb6\x61\x45\xad\x0f\x18\x52\xb6\x98\x54\x78\x58\x3d\x90\x6f\x8d\x62"
"\x16\x4c\x06\x25\xed\x70\x65\x35\x61\x0e\x4c\x07\x8a\xa0\xc1\x3c\x18"
"\x9c\x32\xde\x34\x55\xbe\xba\xc4\x0b\x78\xd4\xf4\x1f\x05\x7e\x60\xd4"
"\xf8\xff\x20\x53\xf3\x85\xd7\xe7\xdc\xb5\x34\x9e\xa3\x39\x93\x45\x88"
"\x11\x0d\xe0\x82\xb7\x33\x74\x54\x41\x0a\xba\x73\xb8\x6a\xf0\x13\xed"
"\xaa\x3f\x21\x9e\x32\xe3\x23\x55\x22\x51\xca\x4a\xf5\x88\x3b\xbe\xd2"
"\xf2\xcb\x9d\x95\x48\x73\x12\xcc\x60\x0a\xf7\x89\x72\xef\x16\x2b\x6e"
"\xba\x79\xb2\x1d\x3b\x54\x73\x47\x2d\xfc\x08\xc5\x06\x79\xdd\x22\xa7"
"\x0e\xb1\xad\x65\x54\x4c\xab\xc3\xa8\x5d\x19\x4f\xad\x82\xf6\x44\xf6"
"\xf4\x97\x8a\x48\x01\xd7\x00\xfe\x8c\x49\x8e\x7d\xbd\x05\x31\xb7\xee"
"\x90\xf5\xe9\x33\xda\xbd\x81\x5a\x14\xe2\xb3\x75\x98\xcc\x14\xe4\x35"
"\xc4\xb2\xbf\x6a\xb7\xfc\xaa\x8f\x41\xf0\xf8\x16\x42\x62\x7a\x80\x9a"
"\x02\x30\xd6\x33\xfc\x1c\xec\x2f\x37\x3a\xc1\xd4\xbc\x71\x8e\xfd\xe0"
"\x8f\xd6\x17\x6e\x8f\x14\xdb\x8a\x25\x62\xb0\xc0\xf7\xc2\xbf\xb4\x3e"
"\x1b\x57\x62\x2d\xca\x7d\x17\x2d\x48\x32\xfb\xd8\x1a\x78\x1b\x28\x42"
"\xea\x03\x35\x1e\x9a\x22\x89\xc1\xde\x6f\x5c\x14\xd6\x4c\x26\x9c\x4b"
"\x71\x37\xfa\x75\x9e\xba\x75\xb4\xc4\x9e\x2f\x49\x70\x82\xa8\x2b\x4c"
"\xba\x59\x56\xec\xbc\x97\x72\x00\xed\x6f\xb4\x4a\x5b\xa6\x29\xb2\x8c"
"\xa3\x87\xbb\xfd\xab\x7e\x2b\x62\x13\xd6\x79\xe3\xe9\x13\xcc\x48\xb1"
"\xe1\x0e\x17\x3c\x78\x6e\x3e\x87\x7b\xe3\x1c\xcb\xe4\xf9\x80\xb5\xd1"
"\x3c\x29\xdb\x17\xbb\x4d\x91\x78\xe0\xce\x76\xe4\x43\x3c\x3c\x9a\x08"
"\xca\x0f\x90\x93\xd0\xf8\x24\x5c\xd1\x79\xab\x59\xed\x83\xff\x25\x6d"
"\xb5\x45\x93\x27\x5f\xb6\x61\xa9\xdf\x37\xe5\x1e\x67\xe1\xd2\x54\x53"
"\x90\x33\xd0\x17\x69\x76\x7d\x17\xf8\x79\x36\xbc\xaa\x78\xe4\x97\x81"
"\x3d\xa4\xff\xc1\x6e\x75\xce\x76\xea\x43\x23\xae\x72\x5c\x41\x05\xd6"
"\x99\xa5\x1b\x6b\xae\x9c\x77\xe3\x7b\xa4\xa6\x2d\x31\x45\x5c\x54\xfa"
"\xa5\x09\x5a\x91\xc1\xc8\x69\x98\xe2\x8a\xf9\x7c\xc2\x5a\xba\x65\x6e"
"\xd0\x94\xce\x6d\x14\xc6\x1d\x9c\x40\xc3\x78\xe1\xc9\x0e\xd8\x5d\x1a"
"\x07\x1b\x71\x9b\xd8\xc3\x79\x8b\x9a\x41\xb8\xf0\x6d\x3c\xf3\x07\x2f"
"\xf7\xbc\x12\x46\x1b\x22\xc9\x96\x3b\xf5\xdc\xb5\x9a\xbf\x51\xa2\x60"
"\xa9\x47\x3f\xda\xcc\x94\x4f\x5d\xb5\x59\x4f\x14\xde\xcd\x00\x2f\x0b"
"\x58\xdd\xb8\xab\x2e\x30\xa8\x66\xe0\x1d\xbb\x58\xc9\x93\x76\x57\xf6"
"\xe2\x9e\xe1\xd4\xc2\xfc\xdb\xc1\xab\xa8\xbc\x12\x2b\xf5\x41\x29\xad"
"\xc8\x16\x6c\xd7\x69\xa5\x9c\x69\x6d\x61\x9a\x4e\xe8\xf4\xe8\x40\xf8"
"\x6c\xfb\xe6\xd1\xe7\x24\x93\x9b\x45\xb4\x43\xdd\x30\xb0\x37\x0b\xab"
"\x70\x5f\x29\xb4\xf6\x74\xd9\xbc\x05\xcc\x45\xf3\x82\x45\x3e\x2d\xc4"
"\xe9\x8f\xe0\x74\x6c\x34\xa6\xcf\x08\x50\x5b\xd8\xfb\x8f\x42\x61\x87"
"\x79\x2f\x45\xf2\xa2\x1c\xff\xae\xfd\x92\xb6\xc3\xf5\x1f\x62\x34\x7b"
"\x2b\x70\x0a\x9f\xa0\x33\xaa\x80\xae\x5d\x98\xb9\x16\x67\x02\x26\x47"
"\xd8\x67\x1b\xac\xcd\x9e\x15\x21\x51\x8b\xbe\xbf\xce\xb8\x59\x66\x4f"
"\xb5\xb2\xf8\x41\xcc\x28\xe9\x86\xe0\xda\x57\x10\x59\xb1\x7e\xe0\x37"
"\xb9\xbd\xfb\x3e\xbd\x79\xe6\x6d\x6b\xb6\x63\x78\x20\xfd\xe2\xf1\x9d"
"\x6e\xb8\xd6\xba\x9b\xb8\x51\xdb\x87\xf9\xb6\x68\x36\x3b\x0d\xd8\xa1"
"\xc3\x44\xdc\xfc\x6a\x1c\x8b\x23\x16\x1d\xe5\x1f\xef\x7b\xbc\x3e\xb1"
"\x66\xb3\xde\x1a\xf8\xf2\x13\x26\x0d\x90\x86\xaf\xe4\x04\xc6\x3b",
4096));
NONFAILING(*(uint8_t*)0x200063a6 = 2);
NONFAILING(*(uint8_t*)0x200063a7 = 0x30);
NONFAILING(memcpy(
(void*)0x200063a8,
"\xaa\xa0\x87\x9b\x6d\xad\xca\x46\x8f\xa8\x85\x7c\x1e\x2a\xa2\x54\xbd"
"\x80\x09\xe8\x29\xca\x3e\x84\xd9\x90\x8d\x6a\xe6\x08\x03\x6d\xfa\x9c"
"\x27\x46\xea\xc9\x5b\x9e\x55\x5a\xf9\x69\xaa\x53\x13\xce\xce\x19\x0e"
"\x83\xd1\x98\x32\x3a\xa6\x9d\xa2\x01\x0d\xaf\xb9\xc2\xa4\xa1\x91\x3a"
"\x19\x66\x93\x2c\x2c\x16\xd9\x69\x3f\x57\x16\x0a\x75\x83\x28\x2f\x04"
"\xe3\xfd\xad\x13\x61\xdc\x86\xc8\x33\xe5\x55\xa6\xce\xfa\x20\x08\x23"
"\x52\x89\xaf\x08\x2c\x68\x90\x65\xba\x40\xb3\xcc\x7e\x5f\x44\xa4\x12"
"\x9c\x7d\x16\x51\xb1\x7b\xa8\x92\x55\xe6\x2f\x1e\x1f\xeb\x30\x32\x62"
"\x56\x67\x5b\x55\x27\x44\x42\x67\x7c\xda\x5f\xdf\xf9\x57\xd2\x1e\x76"
"\x19\x17\x93\x94\x7b\xa6\x49\x9b\x25\x7f\x3e\x9f\xb6\x17\xef\x96\x8f"
"\xe9\x6a\xf9\x1a\xd1\x41\x90\xfc\xf8\x93\x71\x22\x9c\x47\x2a\xd9\x0f"
"\x42\x0d\x2c\xc3\x1d\x75\x5f\xda\x69\x41\x12\xb0\x2f\xde\x1a\xcc\xb7"
"\x68\xd2\xd3\xf0\x6b\xdc\xd0\x2e\x66\x91\x0a\x50\x53\xcf\x61\xb5\xf2"
"\x80\xd6\xb9\xbd\x5a\x4d\x0a\xf8\x6a\x0b\x25\x42\x17\x41\x5b\xd4\x75"
"\xa1\xd9\x36\x9c\xfa\xb4\x67\x5d\x94\x7a\x7e\xac\x27\x34\x29\xc9\x5d"
"\x1b\xa1\x85\x83\x4f\x95\x5c\x49\x8a\x1f\x32\xea\xa5\x7e\xdb\x35\x43"
"\x35\xd7\xd1\xcd\xf8\xc1\xa8\x70\x4f\xea\x3a\x46\x45\x87\xc3\x84\xde"
"\xb6\xfc\xcc\x42\xe4\x30\xac\x55\x6d\x5f\xfb\x7f\xac\x25\x9f\xad\xbd"
"\x14\x08\x10\xf9\xa2\xb8\xb8\x5c\x76\x6b\x05\x83\x17\x8d\x5a\x68\x5a"
"\xc7\x73\x3f\xd4\x25\x42\xd5\x94\x5e\x13\x53\xcb\xdc\x8b\x3a\xdd\x87"
"\x16\xcf\x00\x52\x7e\xcf\x76\x82\xb0\x7f\x31\xe3\x9f\xc5\xe0\xde\x89"
"\x54\xf8\xdb\x7b\x14\x90\xe8\xdf\xa6\xec\x91\x83\xd6\x76\x61\x01\x25"
"\xde\xaa\x52\x43\x7f\x83\x5f\x73\x03\x9c\x14\x75\xc9\x5a\x20\xef\x4d"
"\xcf\xae\xa9\x0b\x93\xda\x28\x71\xa9\xc1\xbe\x98\xc3\xbb\x54\x9d\x94"
"\xfc\xa4\x4f\x50\x3e\x67\x3d\xae\x63\x63\xac\x47\x04\x8d\xf2\x18\xd2"
"\xb9\xf7\x47\x44\xcb\x87\x52\xba\xfa\x4e\x33\x34\x13\x90\xd3\xf4\x62"
"\xd5\xdd\xec\x3f\x58\xff\x05\x7a\x8b\xd8\x08\xdd\x56\x42\x16\x33\x29"
"\x6b\x1b\x09\xbc\x05\x7e\xfd\xd8\x0a\xae\x33\xb4\xcd\x2f\x8d\x18\x5f"
"\x6d\x2b\xc7\xf3\x53\x9f\x57\xfc\x9e\x70\x30\xaa\x84\xfd\x4f\x10\x12"
"\x8a\x3a\xed\x21\xbf\x80\x95\xe3\x60\x85\xb8\xf2\xe0\x2d\x62\xad\x60"
"\x34\x61\xa7\xee\xf5\x61\x03\x1c\x10\x8d\xbb\x4a\xd5\x10\xbb\x09\xa4"
"\xb5\x2c\xfa\x36\x02\x2f\xcd\x16\x07\x86\x5d\xef\x63\x8c\xeb\x47\xec"
"\xa7\xae\xf8\xcf\xaf\xe9\x5e\x16\x28\x25\xa4\xd5\xff\x97\x63\x4a\x7d"
"\x95\x1f\x32\x07\x4f\xbc\xd1\x70\x9a\x49\x5b\x65\x9c\x38\x49\xb6\xcb"
"\xa2\x34\xf8\x8b\xb5\xe0\x6a\x1e\x0f\x55\x85\xfd\x76\x2b\xb4\x68\xf8"
"\xe0\x77\x58\x43\x9a\x61\x4b\xdd\x8c\x18\xb2\xe2\x75\x7c\x13\xd6\x4a"
"\x35\xe1\x15\x90\xfb\x04\x4c\x95\xad\x53\xd3\xee\x63\xa9\xad\x0a\xa8"
"\xc7\xd9\xd1\x6b\x08\x7f\x76\xf0\xe2\x14\xe6\x2d\xab\x1d\x60\x2a\x5c"
"\xc3\x34\x05\x4c\xac\x29\xd7\x72\x42\xd1\xb5\x23\xf9\x9b\xf2\x52\x2a"
"\xf3\x6c\x51\xab\x19\x43\x94\xea\x15\x4b\x53\xf8\xb2\x2a\x4e\x81\xca"
"\xaa\xd6\x0e\x8e\xa7\x54\x72\xb3\x32\x8b\x93\xb1\x2b\x01\x3b\x06\x79"
"\xaf\x40\xc0\x7b\x29\x20\x2d\x20\xb4\x1b\x57\x57\x86\x9c\x3f\xdb\x20"
"\xcb\x66\x42\xa7\x7f\x0c\xcc\x84\xda\xcf\x7c\x1b\x79\xd4\x59\x68\xe5"
"\xa5\x13\xad\x5e\xa3\x35\x9d\x1c\xc4\x3a\xe1\x96\x0b\x34\x8b\xe2\x3f"
"\xa4\xb0\x93\x44\xce\xb3\x7e\x51\x53\x71\x8e\xa6\xc3\x9c\x91\xe4\x8c"
"\xb9\xd4\xd5\x12\xa0\xfe\x1f\x4c\xfa\x4f\x1b\x48\xdc\x4a\x26\x7d\x7f"
"\xa1\xc5\x5d\x9f\x82\x66\x83\xa0\x63\x3b\x66\xcb\x8d\xe2\x3d\x7e\x27"
"\x19\x14\x07\x63\x78\x15\xe0\xfd\xf4\x22\x53\x15\x57\x35\x60\xdc\xb2"
"\xc9\x78\xdd\x5e\x60\xb9\x3a\xb2\xe5\x8a\xda\x96\x56\xd6\x51\x20\xa5"
"\xcb\x9f\x18\x9c\x13\x75\xfe\xe9\xb1\xf6\x1e\xd1\x07\x75\x6f\xe5\xb1"
"\x80\x0a\x92\x8c\x06\x33\x8d\x91\x53\x39\x1e\xe3\x19\x17\xb0\x38\xb8"
"\x8e\x3d\xc1\xe3\x62\xcd\x4b\xf0\x5b\x67\x4e\xf6\x18\x4d\x4e\xe1\xce"
"\x0b\xdd\x51\x64\x7a\x35\x4a\x92\x1c\x70\xd7\xb2\xa5\x5f\x75\xf0\xee"
"\xd9\x74\x2f\x3e\xcb\x03\xfe\x23\x16\x82\xc2\xa3\x42\xb3\x2d\x5a\xcd"
"\x15\x7c\x91\x7b\xb7\xb1\xad\xee\x00\x9c\x39\x0f\xeb\x6d\xda\xc6\x78"
"\x6c\xc9\x01\xaf\xbe\x6c\x0e\x70\x76\x50\x28\xda\x0f\x81\x2a\xa0\x00"
"\x99\x21\x58\xbf\x0d\xd9\x38\x12\x78\x13\x6a\x1d\x05\x23\xdc\xb6\x1a"
"\x0a\x97\x1f\x66\x67\xbb\xa4\x04\x96\x15\x1c\x7c\x36\x31\xef\x82\x5a"
"\xa4\x2a\xd9\x46\x43\x94\x81\x95\xde\xfb\xbf\xc9\xea\x28\x7e\x65\xfc"
"\xc0\xce\x85\x57\x1f\x61\xcd\x61\xd7\x19\xd8\x75\x93\xb0\x83\xdb\x20"
"\xa7\xe1\x5f\xf6\xa8\x7a\xfb\x83\xde\x45\x89\x61\x60\xbb\xe3\xd5\xaf"
"\x13\x0b\x8e\xd0\x61\xd4\x32\x33\xdc\xcd\x44\x7e\x1d\xb9\x37\x66\xd6"
"\x7e\xa7\x40\xe9\x78\x8b\x44\xda\xe3\x7a\x6f\x90\x36\xa8\xec\xfa\x84"
"\xa6\x16\xed\x11\x12\xac\xca\xad\x2c\x81\x3a\xb2\x83\x83\xfd\x53\x2f"
"\x51\x20\x74\x7c\xcf\x91\x64\xbe\xb0\x35\x9b\xed\x21\x91\xc3\x72\xe0"
"\x25\x60\x82\x78\x22\xcb\x67\xdf\x16\x13\xa3\x7e\x06\x68\x1c\x5d\xdb"
"\x12\x84\x26\xa2\x19\xc1\x7e\x62\xa1\x0f\x43\xc2\x98\x46\x11\xe7\x3a"
"\xe7\x5c\x53\xc8\x69\xc0\xbc\xaf\x7d\x47\xaf\x3b\x9d\xc7\x46\x1d\x90"
"\xb8\x6a\xf3\x7a\x8a\x1e\x0b\x4a\x29\x7f\xba\x55\x47\xc5\x92\x7d\x40"
"\xab\xaa\xe4\xc9\x88\x27\x68\x9a\x5b\x5f\x38\x8d\x46\x77\xab\xb9\x0f"
"\xae\x7f\x9b\xa1\xd1\x3c\xaf\x23\x19\xb4\x05\x32\xf0\x62\xc6\x1d\x61"
"\xda\xb7\xa6\x8d\xc8\x71\x4f\x84\xed\x8a\x27\x72\x0f\xf0\x96\xba\x9c"
"\x04\xe5\xb6\x05\x12\xe1\xc8\x9c\xbb\x26\x1e\x13\xe5\xdf\xf5\x48\xbe"
"\x99\x81\x88\x02\x7a\x4d\xe9\x4f\x21\xf7\x40\x79\x40\x6b\x37\x3b\x2f"
"\x84\x7b\x9d\x1b\x17\xf8\xb7\x7b\x30\xd1\x4e\xea\xbd\x57\x79\x29\x7e"
"\x3f\x54\xb9\x9b\xa2\x72\x59\x7f\x8b\x26\x9a\xa2\x20\x69\xbe\x12\x83"
"\x75\x1a\x95\x91\x82\x3b\x2b\x26\x84\x19\x4c\x03\x10\xa1\x7b\x5e\xff"
"\xd0\x41\x2b\x42\xeb\xb8\x2c\xb9\xcf\x1c\xa9\x64\x49\x83\xfc\xde\xe5"
"\xe2\x4a\x2b\x1a\xb9\xf4\xa6\xbd\xae\x3c\xe3\x54\x36\x4a\x56\x4a\x9d"
"\xb9\x43\x33\xb2\x4c\xf3\x42\xd5\xe1\xb7\x64\x7a\x56\x33\x16\x42\x21"
"\xe2\xd0\x72\xc7\xed\x5e\x37\x28\x5a\x41\x19\x27\xa6\xf5\x66\xd6\x13"
"\xde\x45\xac\x7c\xc7\x3e\x13\x44\x29\x3d\x90\x22\x1f\xcb\xc6\xbc\xe0"
"\x42\x96\x24\x8a\xde\x80\x8d\x0b\x44\xdf\x8d\x6a\xdb\xad\x4e\x75\x5f"
"\x4f\xc8\x59\x48\xeb\xbd\xd5\x14\xe5\xdd\x24\x61\x04\x16\xa4\xa5\x7d"
"\x4a\xf2\x1c\xd9\x05\x65\xb5\x62\x20\x7b\xa0\x5f\x20\xe6\xdd\x2f\x90"
"\xb5\xaa\x94\x95\xbf\xa6\xf9\x70\x0f\xca\x45\xea\x0e\x50\x09\x38\xbf"
"\x43\x3b\x10\xef\xdb\xef\x20\xc9\x3a\xca\xec\xbd\xc1\x2d\x23\xaa\x80"
"\x2e\x26\xa8\x02\xf5\x17\x67\x68\xd1\x3b\x6c\xf5\x7e\xec\x42\xfb\x34"
"\xd1\x4f\x78\xd3\x75\xea\x93\x6e\xfc\x31\x16\x0d\xec\x59\x0e\x33\x13"
"\xc1\x98\xa4\x9e\x84\x3c\xf1\x2b\x03\x4f\x51\x0d\x8e\xbd\xfd\xb3\xf3"
"\xe1\x31\x6a\x9d\xb8\x51\x08\xa2\xe8\x0a\x97\xc6\x56\x86\x58\x29\xe8"
"\xeb\x4e\xc5\x30\xeb\xcb\x4d\x68\x01\xb5\xc7\x9a\x3c\x42\xc1\x7e\x20"
"\x5d\xae\x2c\x0d\xa4\xec\x58\x31\x4a\x60\xcf\x67\x0e\xa8\xc0\xe2\xc6"
"\xba\x74\x45\xc1\x58\x08\x35\x62\xea\xbe\x9e\x04\x08\x74\x5c\x42\x22"
"\x7a\x64\xe0\x0a\x15\x78\xbe\x91\xe6\x2c\xa2\xdf\x14\x04\xcf\xad\x6a"
"\xfe\x87\xa4\x0a\xcb\x24\x69\xd5\x85\x65\x93\x84\x21\x38\x92\x0d\xea"
"\x9c\xdd\x53\x50\x0d\x77\xbf\x98\xe3\x3e\x17\xc9\x3b\xb1\x84\x37\x38"
"\xe7\x11\x78\x88\x4a\x0b\xbc\x31\xfd\x61\xa3\x66\xa1\xc7\x0b\xaf\x34"
"\x6b\x86\x70\x08\x05\x4d\x11\xc3\xb3\x30\xd9\x12\x10\xf2\x9b\x60\x88"
"\x0c\x1a\x75\x86\xca\x26\x6f\x59\x97\xe2\x30\x53\xb2\x25\x8a\x21\x74"
"\x0e\xae\xb1\xcc\x0f\xa0\x52\xd7\xf3\xe4\xee\x81\x85\x81\x69\x55\x51"
"\x5c\x1c\x89\xab\xa9\x63\x25\xff\xd8\x2c\x28\x20\xfc\x92\x77\xab\x52"
"\x81\xc1\x9d\xb2\xfe\x1e\xb1\xb8\x10\x4c\xb1\x27\xa5\x1d\x81\xec\x13"
"\x41\xeb\xd5\x25\x49\xa4\x52\x05\x2f\x17\x58\xfc\xae\xe9\xe0\xbc\x85"
"\x53\xdc\x99\xa1\x52\x30\x40\xda\x33\x8e\xae\x56\xb8\x97\x3e\xd8\xbc"
"\x3b\x2a\x32\xff\xfe\xbd\xca\x37\xa2\xae\x08\x61\xbc\x0d\x58\x9f\x84"
"\x30\x91\x55\x84\x52\xbd\x84\xf8\x05\xaf\x28\xf9\xa0\x0e\x2c\xe6\xf2"
"\x59\x3a\xd2\xb2\xbb\x12\x3e\x5d\x58\x98\x70\x63\x9e\x22\xf8\xc7\x90"
"\x01\x25\x4a\xe8\x33\xc3\xff\x3e\x10\x3f\xa9\x8e\x00\x8f\x30\xc3\x5d"
"\x13\xa4\xc4\x66\xb9\x98\x81\x76\xce\x21\xfa\xce\x89\x84\x12\x77\x5a"
"\x1a\x31\xdf\x10\xdb\x63\x63\x7b\xe8\x5f\x56\x20\x1f\x69\xbe\x6b\x50"
"\xdd\x58\x07\x2f\x31\x65\xc7\x8a\x3f\x44\x77\x16\xfa\x3b\xcd\x24\x8f"
"\x25\xc8\x04\xd7\x6a\x59\x7b\xd0\x39\x5f\x9d\x17\x99\x7c\xdd\xc7\x22"
"\xf0\x13\xca\x47\xa4\xf4\x70\x06\xb4\xfa\x40\x89\x49\xeb\xf2\x26\x68"
"\x29\x12\x44\x1f\x45\xe9\xa1\x47\x0d\x09\x7b\x77\xcb\x53\x25\x4d\xac"
"\x7c\x4e\xef\x57\x3d\x2e\xa0\xc6\x8c\xae\x24\x52\x36\x83\x97\x52\x0e"
"\xd3\x46\xd6\x0c\x0e\x29\xc7\xf9\xcd\x5a\xba\x01\x60\xca\x2e\xe5\x1d"
"\x90\x70\x61\xb3\xe8\x3a\x85\x44\xcb\x9e\xe8\x08\x63\x93\xb7\x02\x89"
"\xd2\x0e\xcc\xe2\x91\x8c\x89\x8d\x65\x5e\xc2\x11\x77\x6d\x77\xc9\xd8"
"\xd0\x16\xff\xba\x03\x6d\x05\x57\x1b\xd4\xbc\xd6\x47\xa0\x05\xba\xc1"
"\xea\x09\x3e\xb9\x1d\xf2\x90\x61\xc1\x10\xbd\x3f\x0b\x62\x2b\xd4\x97"
"\x63\x34\x9a\x42\xca\x43\xa7\xd8\x88\xab\xe6\xc8\xa4\xf8\x1e\x48\x7a"
"\x73\x50\x5b\x8f\x4e\x3e\x7b\x45\x25\x29\x59\xa9\x28\xc7\xb6\x2e\xdb"
"\x09\xc1\xa2\xa3\xed\x27\x08\xbc\x49\x9b\x93\xa4\x34\xed\x9a\xcb\x3c"
"\x7b\x94\x93\x46\x19\x4a\xd0\xec\x97\x1f\x73\xbd\x4f\x99\x33\xcf\x47"
"\x99\x04\xcf\xc7\xb5\x0a\xa6\x0f\x33\xcb\xd4\xed\xb0\xbb\xee\xb0\x2f"
"\xab\x22\xd4\xc8\x1b\x73\x2a\xba\x02\x41\x89\x3e\x0b\x6d\x2e\xee\x56"
"\x1b\x2a\xc1\x08\xe5\xf8\x00\x04\xcc\x00\xc2\x97\x73\xa8\x68\xdb\xc9"
"\x7b\x7e\xf9\x4e\x38\x3a\xc0\x8a\x78\xfa\x41\x63\xd2\x0e\xc1\x9f\x1f"
"\x2a\x26\x76\xb4\x06\x43\xf9\x79\x7b\x10\x3c\x62\x03\xad\xcc\xfd\x3c"
"\xe1\xe7\xa4\x2a\x4c\xe7\xc9\xb6\x4c\xdd\xb7\xe5\x76\x53\xf8\x30\x18"
"\xd1\xe6\x24\x74\xbc\xd1\xb3\xc2\xff\x1f\xbb\x0e\xee\x13\xd6\xe8\x5f"
"\x86\x93\xdf\xba\x4a\x25\xf2\x02\xab\x51\x91\xf3\xe9\x71\x42\xb6\x30"
"\x29\x4d\xa1\x5f\x14\x8b\xa0\x27\x0c\xd7\x4e\x1c\x74\xea\x03\xc0\x07"
"\xd7\xe4\xd2\x80\x13\x6b\x9e\x99\x80\x00\xbe\x4a\x1e\x91\xe3\xfd\x93"
"\xfe\x40\x6f\x97\x9d\x34\xc1\xb8\x7c\xa6\xf5\x31\xe5\xf6\x52\xd2\xc9"
"\x61\x3d\xe0\x32\x9d\x0b\x74\x15\xe2\x2a\x66\x0f\x9b\x28\xec\xd6\x7d"
"\xfb\x88\x33\x72\x6f\xf2\x64\xa4\x6b\xff\x57\x38\x4a\x65\x96\xd0\x46"
"\x98\x25\x08\x6b\xdc\x00\x66\x21\x63\xa6\x15\x6d\xea\x13\x9c\xdc\x78"
"\x80\x5c\xc7\xd2\xbb\x46\x24\xb7\xa5\x2a\x57\x19\xf8\x11\x87\x3c\x1e"
"\x6d\xbb\x6f\xc7\xd4\xc8\xa0\x88\x83\xd6\xf7\x30\xf8\x79\xcc\x33\xce"
"\x05\x64\x3c\x72\x76\xbe\x6b\x63\x1d\x8c\x6a\x59\x1d\x41\x10\x73\x02"
"\xed\x2f\x1a\xd9\x77\x44\x6d\xcb\xc8\x2e\x27\x7b\x98\x46\x3f\xe0\xa9"
"\x69\x59\x87\x19\xa0\x55\x5c\x9f\x26\xc5\xc7\x53\x98\x99\xf2\x50\x0f"
"\x8c\x7b\xbc\x0a\x8d\xe1\xc8\xc1\x19\xa9\xbd\x9e\x77\x76\xd3\x27\x58"
"\xb8\xac\x9c\x45\xd6\x01\x12\x82\xfd\x8d\x88\x96\x7d\x35\x8c\xdc\xd8"
"\xa0\x44\x63\x8d\x8a\xa2\x08\xe8\x1f\x0a\x48\x07\xc3\xcf\x5a\x27\x61"
"\x7d\x99\x70\x63\xb9\x34\xe8\xad\xfe\xcd\x43\x4a\x34\xb6\x18\xae\x53"
"\xb9\x02\x63\x19\x19\xe7\x3d\x8c\x7f\x89\x18\xb3\xe4\xfd\x3b\x8a\x5b"
"\x25\x99\x53\x56\x59\x55\x15\xe9\x13\xfe\xfd\xb6\x46\x87\x2e\x23\x05"
"\xf1\x79\x2c\xe0\x8a\x8f\xe3\x6a\xed\xa5\x4d\x6b\xc7\x6c\x80\x3a\x3a"
"\xc2\x9e\x07\xfc\x46\xc1\x86\xf7\x3c\x14\xf8\x04\x04\x2c\xcc\x5e\xe0"
"\xf2\x29\x37\xad\x8c\x58\x0d\xd4\xe0\x10\x10\x83\xa0\x0c\x89\x9f\xbe"
"\xb8\x81\xcd\xff\x11\x57\xfb\xc8\x37\x23\x01\xe1\x0b\x59\x32\x78\x62"
"\xd2\x21\xb3\x6d\xca\x9e\x12\xdd\x8f\xda\x70\xee\x3d\x00\x13\x57\xdf"
"\xe6\x86\xb3\xe2\xa7\x78\x1d\x6b\x58\xab\xe5\x19\x04\x01\x50\x40\x59"
"\x11\xfd\x1c\x30\xd7\x92\x07\xac\xeb\xae\xab\x8f\x93\x2c\x13\x0e\xfd"
"\x12\xad\x3d\xc4\x1e\x5c\x86\x10\x5b\x3b\xd4\xe4\xcc\x6d\x9d\xa0\xc1"
"\x41\x69\x75\x40\x02\xd0\xed\x95\x92\x7f\x5d\x03\x85\x59\xe9\xe3\xcd"
"\xd1\x72\x16\xd1\xb5\x34\xfa\x91\x8d\xc1\x90\x04\xce\x2d\x2c\x38\x6a"
"\x59\x5c\x67\x54\x29\x01\x9e\x17\x5a\x4d\x79\x05\x38\x7c\x45\x9a\xdd"
"\x63\x5f\xbb\xd0\x10\xab\xee\xc3\x3d\xec\x3e\xb8\x42\x9f\x09\x55\xf8"
"\x4c\xca\xfe\x65\xce\x14\xe1\x14\x55\x4e\xf9\x9f\x23\xed\x90\x62\x0c"
"\x5a\x7e\x9d\x3d\x64\x7b\xcb\x5c\x56\x66\xa9\x0c\xc6\xb3\xb0\x66\xe7"
"\x8d\x7a\x8c\xdc\x14\x5b\x4b\x0f\x9b\x40\x28\x38\xde\x0a\x74\xf0\x91"
"\x9f\x1e\x12\xcf\x66\x96\xb7\x18\x97\xdf\xfb\x39\x98\x2d\x2c\x59\x6f"
"\xed\xba\x2f\x78\xbe\x41\x75\x5a\xbd\xe5\xd6\x65\x3c\xad\x91\xf5\xf7"
"\x0c\x75\x61\x06\x1c\x01\xd0\x75\x0b\x12\xfc\x58\x8b\x98\x0c\x87\xa8"
"\x06\xe5\x2c\xe3\xfe\x1d\x4b\xf6\x45\x23\xc7\x40\xac\xed\xad\xe8\xb4"
"\x4a\x59\xa8\xd9\xd6\x5f\x74\x70\xb2\x3b\xe3\x09\xb8\xf0\x2b\xb3\x8c"
"\xce\x70\xbb\x33\x6e\x88\xe9\x30\x6e\x72\xd7\x04\xec\x7e\x70\xab\xf4"
"\x13\xa7\x3f\x2f\x88\x9d\xaa\x03\x61\xaa\x7d\xae\x7b\x42\xe1\x82\xde"
"\x65\x85\x13\xff\x5a\x3d\xa2\xa3\xd5\xd7\x85\x29\x8a\x1b\x60\x86\x7e"
"\xf0\x76\x51\xa9\xc4\x75\x95\xd1\x76\xf1\x0b\x1b\x7d\xf2\x76\x09\x7d"
"\xc2\xa7\x8a\xd9\xe6\x18\x3d\xd7\xa9\x2f\x5c\xd5\x83\xe1\x21\xbc\x9f"
"\x14\xf5\x29\xbc\xfc\x0c\x4d\xf2\xa3\x14\xfd\xaf\x71\x8a\x9c\xf3\x0d"
"\x32\xfa\xe4\xea\x2b\x21\x31\x97\x91\x27\x81\x47\x0b\x9d\xb8\xb8\x10"
"\x9b\xcf\xc2\xd9\x5d\x7b\x04\x0c\x04\x4e\x5f\x40\xa5\x72\xba\xe3\xcc"
"\x3c\xb9\x96\xc7\x93\xf6\x90\x79\x5a\x95\x2e\xa3\x08\x7c\x75\xa9\x03"
"\x62\xb7\x1d\xc3\x02\x2c\xcf\x64\xf5\x48\xb7\xb8\x98\x42\x70\xbb\xf4"
"\xc9\x55\x3c\xa5\x86\xd2\xfa\xc2\x85\x6e\x68\x81\xf0\x8a\xa7\xb9\xc7"
"\x92\xb2\xa0\x10\x5c\xef\x2d\x34\x4e\x23\xbc\xd4\xda\xdd\x91\xb9\xe3"
"\x12\xf5\xa2\x4f\x83\x06\x49\x38\x29\x17\x0d\x37\xe3\xd5\x1d\xf5\xae"
"\x2b\xf4\x23\x5f\xd3\x5f\x4c\x05\x2c\x23\xc1\x4f\x11\x8d\xfb\x25\xa0"
"\x90\x44\x71\xab\x6c\x17\xd1\x2f\xf3\x81\xae\x23\x65\x46\x41\x03\x42"
"\x09\x60\x42\xbb\xd8\xd4\x16\xba\xf8\xe0\x5f\xe9\xfb\x32\x1c\x0b\x3e"
"\x1c\xb1\xda\xa9\xd9\xbc\xf4\xb0\x9d\xef\xad\x12\xc6\x8b\x85\x6d\xf1"
"\xb6\x9a\x9e\x7b\x44\x80\xa2\xae\x2f\x2e\x08\x5e\xa1\xa5\x79\x8e\x0e"
"\x36\x72\x59\xf4\x10\x6a\xc1\x42\xaf\x5e\x76\x44\xe1\x0c\xe9\x5f\x98"
"\xd5\xec\x3e\x89\xcc\xc6\x57\xa1\x2a\xa9\x6a\x6e\xed\x9f\xa5\xe4\xd3"
"\x1b\xd4\x85\x19\xb3\x57\x06\x7b\xd8\xbd\x86\x3b\xbb\x0a\x95\x03\x64"
"\x17\x31\x61\x81\x67\xe1\x26\x52\xf3\xf3\x54\x57\xc0\x6f\xa7\xcd\xcb"
"\xa0\x39\xa6\xd0\x99\xd6\xb0\xc4\xc3\xa5\x35\x7f\x5a\xb8\xdb\x7d\xd6"
"\x6d\x22\xdf\x1d\x14\x32\x60\xd1\x79\xa2\xef\x21\x82\x0e\xe7\xfa\xe6"
"\x9d\x2a\x4e\x29\x46\xf1\xf9\x15\xd3\x44\x78\xfc\x74\x7b\x93\x47\x5e"
"\x37\x5c\x48\xaa\x85\x93\x30\x9e\x92\x22\x81\x21\x12\xf5\xa9\xc5\xe5"
"\xf6\x67\x6d\x96\xf3\xff\xd7\x33\x3e\xcb\x09\x46\xe4\x4f\x46\x78\xc9"
"\x73\x81\x75\xde\xfc\x9a\xa7\x6f\xd4\x57\x79\xb4\x20\xa4\xdb\xf6\x88"
"\xf7\xf3\x09\xf8\x9e\x7c\xa6\x6c\x26\xb9\x7a\x1a\x92\x61\x72\x5a\x59"
"\x2a\xf7\x50\x79\xc5\x7c\x6c\x13\xb9\xdd\x8a\xa8\xdd\x8c\x19\xd8\x3a"
"\xfc\xdc\x53\x0c\xec\x94\x4f\xb0\x3a\x67\x71\x3f\xc2\x84\x58\x10\x6a"
"\xd8\xc1\x78\xda\x9b\xd3\x0d\xaf\xe8\x24\x39\xce\xd6\xb5\x61\x95\xc9"
"\x80\x91\x0b\x97\x8f\xaf\x22\x30\x5e\x2e\xe5\xa4\x1f\x3c\xec\x8c\x89"
"\xf3\x87\x0f\xaa\x8d\x40\xd8\x2d\x46\x3c\xb5\xb1\x65\x87\xd1\x5c\x8d"
"\x2c\x82\x68\x9f\x17\xd8\xab\x6e\x30\x5c\x47\x2a\x8f\x3a\xb4\xc2\x36"
"\xf8\x4a\x5c\xf1\xc4\xb0\xd0\x10\x92\x55\x5c\xf6\x3c\x5e\x5b\xd9\x52"
"\x5c\x05\x05\xf3\x8c\x8b\x5b\xf3\xfa\x49\x68\x7b\x4f\x63\x49\xc5\x8b"
"\x01\xc1\x34\xc2\x2b\xe5\x90\xa1\x94\xd4\x76\x33\xbc\x46\x82\xa7\x27"
"\x09\x42\xdd\x7c\xa8\x1e\xff\x3b\xe0\x24\x2c\xb4\x70\xd1\x09\x84\x41"
"\x4b\x03\xf4\x56\x0f\x20\x4d\xdd\xc3\xef\xab\x6c\xe3\x2a\x98\xc0\xe1"
"\xff\xdb\x02\xf8\x58\xa2\xc6\x7d\xf7\xf4\x00\x17\x11\x6a\xa4\x4f\x43"
"\x6b\x85\x4e\xeb\xbf\x82\x42\xa1\x28\x2e\x16\x8f\x53\x0d\xda\x94\xf0"
"\x06\x27\xff\xff\xbd\x75\x47\xe3\xd0\xf7\x83\x1a\xe2\xb4\x12\x1f\xd6"
"\x45\x78\x8d\x7a\x2d\x5c\xdb\x4c\xe1\x8f\x3b\x46\xf1\xda\x3b\xa3\x8a"
"\x7e\x87\x6c\x64\x8d\xcc\x1f\xaf\xe9\x9c\x63\x7d\x7c\x49\x7f\x36\x5d"
"\x85\xfa\x5b\x45\xc2\x7c\x35\x05\x55\x2a\x98\x7e\x71\x33\xc8\xbf\x5e"
"\x0c\xf6\x9e\xd8\x7b\x55\x15\x3f\x3a\xe2\x20\x39\xd2\x75\x24\x69\x6d"
"\x5a\x05\xf5\xc7\xfe\x57\xa8\xe8\x8c\x79\xde\x1d\xe1\xcb\x58\xb1\x18"
"\xd0\xc9\xc9\x35\xaf\x9c\xe7\x05\x06\x7b\x24\x94\xcf\x13\x60\x4b\x60"
"\xe9\x40\x8d\x3c\xcd\x4f\x90\xea\xba\x42\x62\x56\x42\xa9\xf8\x7d\xc9"
"\xa4\xfd\xb1\x5c\x20\xc5\xfb\x11\xb4\x71\x60\x8a\x34\xef\x7d\x70\x9a"
"\x0a\x0e\x05\x54\xd1\x23\x99\xcb\x42\xaf\x61\x9b\x13\xee\x38\x04\xb2"
"\x0e\x50\xb6\xa2\xe3\x39\x9e\x22\x7e\x7f\xb6\x5a\x31\xe9\x01\xc4\x09"
"\x0c\xa4\x70\x64\xf1\x34\x44\x32\x47\x0d\x63\x85\x69\x2e\x9f\x76\xb7"
"\x92\xcb\x85\x8c\xda\x1e\x63\xe0\x47\xca\x83\xc4\x8a\x5c\x10\x92\x51"
"\x07\xa3\xa5\x1e\xff\x79\x8f\x3b\x7d\x69\xd3\x7f\x87\xb8\xaf\xb2\x74"
"\x39\x06\x56\xda\xb5\xdf\xde\x82\x87\x8c\xf7\x65\x2f\x43\xcb\x25\xb7"
"\x25\x92\xd7\x41\xdf\x14\xd9\x03\x10\xd0\xfb\xe1\x2f\x8d\xb4\xaa\x2d"
"\xc7\xb7\xec\xc3\xa4\xf3\xf4\xa1\x9b\xab\x74\x59\x88\x05\x94\x30\x34"
"\x08\xa5\x49\x06\x1c\x1c\x7d\x5d\x5b\xc8\x8a\x21\xe3\x1c\x29\x64\xe9"
"\x7b\x78\x9d\x40\xa8\x06\xc9\x94\x2a\x7d\xe3\xc2\xb5\xd9\x92\x2a\xbb"
"\xf0\xb6\x98\xed\x67\x44\x9e\x48\xfa\xff\xef\x7d\x74\xd9\xa1\x5f\xb2"
"\x5d\xe4\x29\xdd\xa4\x84\x9b\xfa\x8f\x81\x5a\xea\xac\x53\xea\x03\x65"
"\x08\x01\x75\xca\x1e\x77\x0c\xc9\x8c\x67\x70\x66\x15\xd4\xd5\x51\x4f"
"\x95\x76\x36\xf0\xee\x29\xb7\x7a\x67\x79\xd6\x7d\xbe\xc6\x63\xda\x11"
"\xdc\x56\x53\x46\x19\x57\xf7\x6e\x77\xd3\x1a\x9c\x52\x1e\xfd\x05\x6a"
"\x5d\xf4\xad\xec\xc4\x91\x05\xbe\x95\x0d\x82\xcb\x62\xf5\x68\x57\x0b"
"\x6e\x18\xbd\xee\x79\x0b\xf2\x70\x81\xa4\x44\x2a\x1b\xa4\xfa\xd0\x93"
"\x61\x30\x81\x14\xd1\xc8\xdd\xbd\x5e\x6a\x0b\x40\x4e\xb8\xf9\xac\x52"
"\x49\xe5\xd1\xb7\xa1\xa7\xe6\xa9\xb9\x18\x6a\xf1\xb1\xeb\x97\x3e\x8e"
"\x90\x3e\x39\xb6\xe9\x22\x49\xf2\x1a\xfc\x8c\xb9\xbd\xd4\xb9\x01",
4096));
NONFAILING(*(uint8_t*)0x200073a8 = 9);
NONFAILING(*(uint8_t*)0x200073a9 = 5);
NONFAILING(*(uint8_t*)0x200073aa = 0x80);
NONFAILING(*(uint8_t*)0x200073ab = 0);
NONFAILING(*(uint16_t*)0x200073ac = 0);
NONFAILING(*(uint8_t*)0x200073ae = 4);
NONFAILING(*(uint8_t*)0x200073af = 0x2a);
NONFAILING(*(uint8_t*)0x200073b0 = 5);
NONFAILING(*(uint8_t*)0x200073b1 = 0x36);
NONFAILING(*(uint8_t*)0x200073b2 = 0xf);
NONFAILING(memcpy((void*)0x200073b3,
"\x6b\x16\x55\x47\x95\x49\x93\x77\x23\xeb\x72\x6a\x30\x52"
"\x4c\xc6\xf2\xcd\xe7\xd1\xa7\x64\x72\xa5\x30\xb6\xa5\x8c"
"\xf9\xea\x3f\x55\x55\x83\x0d\xf6\xc7\x88\x61\x87\xf3\x89"
"\x6b\x21\xbe\x1e\x21\xbc\x8c\x42\xf5\x94",
52));
NONFAILING(*(uint8_t*)0x200073e7 = 0x29);
NONFAILING(*(uint8_t*)0x200073e8 = 0x26);
NONFAILING(memcpy((void*)0x200073e9,
"\x2d\x3b\x27\x7e\xe9\x3e\x32\x57\xc1\x1c\x7e\xd4\xf1\x55"
"\xd4\x93\xe0\x84\x9c\xd8\xa0\x1d\x28\xa5\xc7\xfa\xd5\x27"
"\x9e\x7e\xaf\xa2\xa1\x30\x2f\x24\xe0\x64\x30",
39));
syz_usb_connect(0, 0x2090, 0x20005380, 0);
break;
case 6:
NONFAILING(*(uint8_t*)0x20000840 = 0x12);
NONFAILING(*(uint8_t*)0x20000841 = 1);
NONFAILING(*(uint16_t*)0x20000842 = 0x350);
NONFAILING(*(uint8_t*)0x20000844 = 0x73);
NONFAILING(*(uint8_t*)0x20000845 = 0xd);
NONFAILING(*(uint8_t*)0x20000846 = 0x82);
NONFAILING(*(uint8_t*)0x20000847 = 0x60);
NONFAILING(*(uint16_t*)0x20000848 = 0x77d);
NONFAILING(*(uint16_t*)0x2000084a = 0x410);
NONFAILING(*(uint16_t*)0x2000084c = 0x94b2);
NONFAILING(*(uint8_t*)0x2000084e = 0x7f);
NONFAILING(*(uint8_t*)0x2000084f = 1);
NONFAILING(*(uint8_t*)0x20000850 = 0x20);
NONFAILING(*(uint8_t*)0x20000851 = 1);
NONFAILING(*(uint8_t*)0x20000852 = 9);
NONFAILING(*(uint8_t*)0x20000853 = 2);
NONFAILING(*(uint16_t*)0x20000854 = 0x13e6);
NONFAILING(*(uint8_t*)0x20000856 = 1);
NONFAILING(*(uint8_t*)0x20000857 = 1);
NONFAILING(*(uint8_t*)0x20000858 = 0xfa);
NONFAILING(*(uint8_t*)0x20000859 = 0xc0);
NONFAILING(*(uint8_t*)0x2000085a = 8);
NONFAILING(*(uint8_t*)0x2000085b = 9);
NONFAILING(*(uint8_t*)0x2000085c = 4);
NONFAILING(*(uint8_t*)0x2000085d = 0x82);
NONFAILING(*(uint8_t*)0x2000085e = 1);
NONFAILING(*(uint8_t*)0x2000085f = 0xf);
NONFAILING(*(uint8_t*)0x20000860 = 9);
NONFAILING(*(uint8_t*)0x20000861 = 0xb);
NONFAILING(*(uint8_t*)0x20000862 = 0x70);
NONFAILING(*(uint8_t*)0x20000863 = 2);
NONFAILING(*(uint8_t*)0x20000864 = 0x18);
NONFAILING(*(uint8_t*)0x20000865 = 0x21);
NONFAILING(*(uint16_t*)0x20000866 = 4);
NONFAILING(*(uint8_t*)0x20000868 = 0xe8);
NONFAILING(*(uint8_t*)0x20000869 = 6);
NONFAILING(*(uint8_t*)0x2000086a = 0x21);
NONFAILING(*(uint16_t*)0x2000086b = 0x1b8);
NONFAILING(*(uint8_t*)0x2000086d = 0);
NONFAILING(*(uint16_t*)0x2000086e = 0x92f);
NONFAILING(*(uint8_t*)0x20000870 = 0x22);
NONFAILING(*(uint16_t*)0x20000871 = 0x4c2);
NONFAILING(*(uint8_t*)0x20000873 = 0x23);
NONFAILING(*(uint16_t*)0x20000874 = 0x625);
NONFAILING(*(uint8_t*)0x20000876 = 0x23);
NONFAILING(*(uint16_t*)0x20000877 = 0x5aa);
NONFAILING(*(uint8_t*)0x20000879 = 0x23);
NONFAILING(*(uint16_t*)0x2000087a = 0xedd);
NONFAILING(*(uint8_t*)0x2000087c = 9);
NONFAILING(*(uint8_t*)0x2000087d = 5);
NONFAILING(*(uint8_t*)0x2000087e = 0);
NONFAILING(*(uint8_t*)0x2000087f = 0);
NONFAILING(*(uint16_t*)0x20000880 = 0x80);
NONFAILING(*(uint8_t*)0x20000882 = 9);
NONFAILING(*(uint8_t*)0x20000883 = 0x3f);
NONFAILING(*(uint8_t*)0x20000884 = 2);
NONFAILING(*(uint8_t*)0x20000885 = 9);
NONFAILING(*(uint8_t*)0x20000886 = 5);
NONFAILING(*(uint8_t*)0x20000887 = 3);
NONFAILING(*(uint8_t*)0x20000888 = 0x1c);
NONFAILING(*(uint16_t*)0x20000889 = 0x43);
NONFAILING(*(uint8_t*)0x2000088b = 0x83);
NONFAILING(*(uint8_t*)0x2000088c = 1);
NONFAILING(*(uint8_t*)0x2000088d = 2);
NONFAILING(*(uint8_t*)0x2000088e = 0x36);
NONFAILING(*(uint8_t*)0x2000088f = 0xc);
NONFAILING(memcpy((void*)0x20000890,
"\x7e\x9b\x37\x14\x25\x88\x21\x7c\x77\xce\x19\xb4\xa6\x61"
"\xb4\xf8\x5a\x35\x2e\xe9\xe0\xf7\x5f\xd8\x42\x75\x15\x0d"
"\xba\xa8\xfd\xdf\x96\xed\xb7\xbe\xf8\x5b\x9c\x56\x5a\x21"
"\x0f\x9a\x37\xc7\xbf\x80\x20\xfa\xd1\xe2",
52));
NONFAILING(*(uint8_t*)0x200008c4 = 0x51);
NONFAILING(*(uint8_t*)0x200008c5 = 0x19);
NONFAILING(memcpy(
(void*)0x200008c6,
"\xd6\xf9\xb3\xeb\x8b\x11\xc4\xf0\x9e\x60\x61\x09\x4d\xc7\x48\x21\x7a"
"\xe7\x0d\x2d\xf5\x06\x35\x6c\x9d\x21\xc2\xca\x7c\x94\xa9\x1a\x71\xa9"
"\x76\xbf\x01\x3b\x69\x88\x77\x15\xb4\x85\x11\x7c\x9e\x4b\xe9\xff\xdd"
"\xd1\xf5\x41\x70\x46\x61\xc9\x0e\x7a\x73\x2f\x4e\x90\x4b\x37\xa6\x23"
"\x43\xbd\x21\x0a\x9d\x32\xd6\xa5\xdd\x51\xc8",
79));
NONFAILING(*(uint8_t*)0x20000915 = 9);
NONFAILING(*(uint8_t*)0x20000916 = 5);
NONFAILING(*(uint8_t*)0x20000917 = 0xf);
NONFAILING(*(uint8_t*)0x20000918 = 0);
NONFAILING(*(uint16_t*)0x20000919 = 0x1000);
NONFAILING(*(uint8_t*)0x2000091b = 0x7b);
NONFAILING(*(uint8_t*)0x2000091c = 0);
NONFAILING(*(uint8_t*)0x2000091d = 0x28);
NONFAILING(*(uint8_t*)0x2000091e = 0x76);
NONFAILING(*(uint8_t*)0x2000091f = 0xb);
NONFAILING(memcpy(
(void*)0x20000920,
"\xdd\x7d\x22\xf1\x4e\x1a\xf5\x70\x76\xc1\xeb\x7b\xdf\x59\x4c\x64\xcc"
"\xdd\x0b\x80\x7e\x09\x46\x07\xcd\x7b\x82\x82\x9d\x8f\x50\x91\xd9\x78"
"\x35\x1a\xf3\x51\xa4\xe8\x2a\xcb\xc4\x7f\xb4\x72\x44\xf6\xf7\x5c\x07"
"\x03\x11\x3c\xd8\xa7\xda\x5b\xa9\xb0\xc1\x0d\xd5\x37\xaf\x40\x83\x20"
"\x95\x8a\x3e\x8c\xea\xea\xbd\x1e\x68\xd6\x3f\x99\xf0\x44\x3a\x60\x38"
"\x76\x00\x20\x76\xfa\x00\x0d\xb9\x90\x73\x99\x90\x51\x5f\xda\x96\xb4"
"\x7f\x6a\xc7\x44\xef\xe6\xe3\x83\xc1\xcd\x21\xbb\x49\xa3",
116));
NONFAILING(*(uint8_t*)0x20000994 = 9);
NONFAILING(*(uint8_t*)0x20000995 = 5);
NONFAILING(*(uint8_t*)0x20000996 = 8);
NONFAILING(*(uint8_t*)0x20000997 = 3);
NONFAILING(*(uint16_t*)0x20000998 = 4);
NONFAILING(*(uint8_t*)0x2000099a = 0);
NONFAILING(*(uint8_t*)0x2000099b = 1);
NONFAILING(*(uint8_t*)0x2000099c = 2);
NONFAILING(*(uint8_t*)0x2000099d = 0x77);
NONFAILING(*(uint8_t*)0x2000099e = 0x21);
NONFAILING(memcpy(
(void*)0x2000099f,
"\xba\x27\x38\xe5\xe0\x10\x5f\x38\x0a\x73\x92\x71\xcd\x7c\xde\x3c\x3f"
"\xee\xbc\xb1\x35\xd5\x3d\x13\x96\xee\x5c\x74\x9d\xde\xbe\xff\x0c\xb3"
"\xb2\x53\x13\x7e\x68\x9e\x66\x51\xf3\x20\xe8\xde\x2c\x39\xdc\x98\x55"
"\x35\x77\x1c\x64\x5d\x83\xb4\xe7\x6b\x3a\xc3\xd0\xa7\x3e\xee\x15\x32"
"\x65\x80\x40\x6f\xd6\xc3\xd8\x6b\x7c\x22\x6c\xa1\x3c\x32\xf0\x70\x26"
"\x14\xea\xf2\xd0\x97\x27\xd9\xcc\xbd\xcf\x3e\xa9\x6e\x30\x3d\x23\x70"
"\xf2\xf8\x4d\xd6\x21\xa3\x80\xa0\x34\xec\xe7\x2f\x3d\xcd\x7c",
117));
NONFAILING(*(uint8_t*)0x20000a14 = 9);
NONFAILING(*(uint8_t*)0x20000a15 = 5);
NONFAILING(*(uint8_t*)0x20000a16 = 5);
NONFAILING(*(uint8_t*)0x20000a17 = 0x10);
NONFAILING(*(uint16_t*)0x20000a18 = 9);
NONFAILING(*(uint8_t*)0x20000a1a = -1);
NONFAILING(*(uint8_t*)0x20000a1b = 1);
NONFAILING(*(uint8_t*)0x20000a1c = 0x59);
NONFAILING(*(uint8_t*)0x20000a1d = 9);
NONFAILING(*(uint8_t*)0x20000a1e = 5);
NONFAILING(*(uint8_t*)0x20000a1f = 0xb);
NONFAILING(*(uint8_t*)0x20000a20 = 0x11);
NONFAILING(*(uint16_t*)0x20000a21 = 3);
NONFAILING(*(uint8_t*)0x20000a23 = 0x1d);
NONFAILING(*(uint8_t*)0x20000a24 = 4);
NONFAILING(*(uint8_t*)0x20000a25 = 4);
NONFAILING(*(uint8_t*)0x20000a26 = 0xfa);
NONFAILING(*(uint8_t*)0x20000a27 = 0xf);
NONFAILING(memcpy(
(void*)0x20000a28,
"\x4f\xe9\x4f\xce\xa0\xd9\x86\x03\x7a\xa2\x55\x86\x5d\xa2\xbc\x93\x12"
"\xef\x8e\xbd\xfa\x28\x2d\xdd\x23\xf4\x92\x05\x71\xca\x00\x96\x0a\x16"
"\xdd\x79\xa2\xa9\xc3\x29\x5d\x3b\x13\x37\x9c\x1a\x94\xac\x14\x89\xc9"
"\x72\x93\x68\x96\x44\x0b\xd2\x2f\xf8\x8a\x4e\x20\x77\x6f\x15\x58\x72"
"\x94\x96\x29\x82\x64\xc6\xc4\x66\xe8\x89\x4d\x2f\x46\x99\xa0\x61\x73"
"\x64\xe7\xa2\x94\xb7\xa5\xaa\xa6\x96\x55\x9d\x5b\xb3\x0d\x08\x71\x58"
"\x97\x8a\x35\x6e\xcb\x1c\x46\x54\x95\x3e\x97\x41\x82\xc8\xc0\x0e\xbc"
"\x7b\x48\x35\x54\x08\xb2\x18\x43\x7a\x83\x93\xfd\xa7\xf0\x6c\x3e\xdc"
"\xe5\x7d\x7d\x86\xca\xaa\x52\xd7\x15\x09\x9a\x20\x65\x09\x5f\x34\x2c"
"\xfa\xe8\x87\xc8\x09\xdc\x84\x76\xef\x04\x7a\x12\xea\x0e\x22\x18\xe7"
"\xd7\xcc\x94\x76\xed\x7f\x9a\xba\x3d\x17\x4b\xae\xcd\xe6\xb2\xf9\x88"
"\x40\xaa\x1a\x96\x54\xba\xfd\x64\xcd\x89\xb6\x7b\x2a\xe4\x84\x70\x3a"
"\x93\x47\x54\x3c\x5e\x34\x38\x0b\x60\x23\xa8\x59\x39\x7e\x85\x53\xa7"
"\x16\x12\x4d\xcb\x62\xfa\x13\x93\x1c\x3c\xcc\x20\x70\x7e\x3c\x49\x24"
"\x36\x58\x47\xbe\x75\xa5\xef\x64\xdd\x65",
248));
NONFAILING(*(uint8_t*)0x20000b20 = 0x84);
NONFAILING(*(uint8_t*)0x20000b21 = 0xd5);
NONFAILING(memcpy(
(void*)0x20000b22,
"\x3d\x4b\x2d\x8d\x26\x12\x84\x20\x58\x18\xaa\x8b\x16\xad\xfd\x19\xe9"
"\x9d\x03\x45\x3e\x17\x9b\x71\x7f\x5a\xfc\xa1\xea\x2a\x7f\xc8\x13\x90"
"\xf9\xd4\xc4\xc7\xa3\xaf\x60\xc0\x83\xe2\x97\x4b\x42\x35\xb0\xfe\x68"
"\x82\x61\xcc\x75\x87\xa9\x12\xae\x57\x2d\x93\x77\x9b\xb0\x26\xc5\xa1"
"\x19\x6e\xc4\x40\xf5\xcd\xdf\x05\x30\x39\x8e\xa3\x97\x04\xa0\x97\xfe"
"\x7f\x80\xe7\xa1\xcc\x9d\x03\x00\xd8\xce\x88\x90\x7e\x10\xa1\x82\xe9"
"\x5f\xe7\xb0\x4e\x48\x18\x44\x37\xe8\xb5\x77\xf1\x67\x8d\x72\x38\x9c"
"\x86\x70\x19\xf2\x8d\xea\x67\x0f\xdf\xe1\xd9",
130));
NONFAILING(*(uint8_t*)0x20000ba4 = 9);
NONFAILING(*(uint8_t*)0x20000ba5 = 5);
NONFAILING(*(uint8_t*)0x20000ba6 = 8);
NONFAILING(*(uint8_t*)0x20000ba7 = 0);
NONFAILING(*(uint16_t*)0x20000ba8 = 1);
NONFAILING(*(uint8_t*)0x20000baa = 0);
NONFAILING(*(uint8_t*)0x20000bab = 5);
NONFAILING(*(uint8_t*)0x20000bac = 4);
NONFAILING(*(uint8_t*)0x20000bad = 9);
NONFAILING(*(uint8_t*)0x20000bae = 5);
NONFAILING(*(uint8_t*)0x20000baf = 0);
NONFAILING(*(uint8_t*)0x20000bb0 = 0x11);
NONFAILING(*(uint16_t*)0x20000bb1 = 1);
NONFAILING(*(uint8_t*)0x20000bb3 = 0x24);
NONFAILING(*(uint8_t*)0x20000bb4 = 0x55);
NONFAILING(*(uint8_t*)0x20000bb5 = 7);
NONFAILING(*(uint8_t*)0x20000bb6 = 9);
NONFAILING(*(uint8_t*)0x20000bb7 = 5);
NONFAILING(*(uint8_t*)0x20000bb8 = 0x80);
NONFAILING(*(uint8_t*)0x20000bb9 = 8);
NONFAILING(*(uint16_t*)0x20000bba = 0);
NONFAILING(*(uint8_t*)0x20000bbc = 7);
NONFAILING(*(uint8_t*)0x20000bbd = 2);
NONFAILING(*(uint8_t*)0x20000bbe = 7);
NONFAILING(*(uint8_t*)0x20000bbf = 9);
NONFAILING(*(uint8_t*)0x20000bc0 = 5);
NONFAILING(*(uint8_t*)0x20000bc1 = 0xc);
NONFAILING(*(uint8_t*)0x20000bc2 = 0x12);
NONFAILING(*(uint16_t*)0x20000bc3 = 0x6b8);
NONFAILING(*(uint8_t*)0x20000bc5 = 1);
NONFAILING(*(uint8_t*)0x20000bc6 = -1);
NONFAILING(*(uint8_t*)0x20000bc7 = 3);
NONFAILING(*(uint8_t*)0x20000bc8 = 9);
NONFAILING(*(uint8_t*)0x20000bc9 = 5);
NONFAILING(*(uint8_t*)0x20000bca = 5);
NONFAILING(*(uint8_t*)0x20000bcb = 0x11);
NONFAILING(*(uint16_t*)0x20000bcc = 7);
NONFAILING(*(uint8_t*)0x20000bce = 0x34);
NONFAILING(*(uint8_t*)0x20000bcf = 0xc1);
NONFAILING(*(uint8_t*)0x20000bd0 = 4);
NONFAILING(*(uint8_t*)0x20000bd1 = 2);
NONFAILING(*(uint8_t*)0x20000bd2 = 3);
NONFAILING(memcpy(
(void*)0x20000bd3,
"\x90\xbd\x22\xa6\x6d\xdc\xb6\xf1\x2d\xd6\x3a\xb1\xf7\x75\x81\x61\x50"
"\x03\x72\x5e\x9d\xcd\x4a\x48\x9d\x62\x98\xce\x46\x58\x13\xfe\xd3\xff"
"\xcd\x6e\x01\x16\x64\x30\x8d\x90\xd9\x8f\xf8\xac\x76\x9b\x70\xd2\xf3"
"\x50\x64\x4d\x61\x5f\xde\xa0\x2e\x94\x6f\xb0\x86\x26\x31\xdd\x8c\xe7"
"\xd2\x40\x71\x84\x82\xfa\x89\xf6\x52\xfb\xa5\xbc\x6b\xe0\x78\x1e\x3c"
"\x0a\xc9\xaf\xc7\x82\xdb\x42\x53\xba\xe3\x44\xcd\xf3\xcc\x55\x6b\x0a"
"\x36\x36\x62\xfa\xc2\x84\x51\x8e\xa7\x7f\x13\x24\x68\xaa\x4b\xbb\x63"
"\xd1\x50\x16\xa6\x1b\x65\x7f\x17\x8f\xe9\x6f\x94\x29\x29\x2f\xb3\x13"
"\x7f\xf2\x65\x53\xd3\xc4\x46\xb1\xea\x9c\x61\x31\x9f\xb4\xe4\xe8\x18"
"\xfd\x4f\xe3\x4a\x33\xf0\xaa\xe2\x43\xcc\xd1\x6d\x1d\x0e\x47\x72\x5d"
"\x90\x84\x23\x89\x9f\xff\xb0\xcc\x2f\x0f\x15\x2d\x9f\xe8\x45\x60\xa2"
"\xa1\x0d\x9f\xc0\x6b\x02\xca\x62\x2e\xf9\x43\x06\x84\x81\x00\x56\x2a"
"\x1f\x36\x86\xc7\x2e\x2d\x05\x15\x6d\xaf\x73\xd0\x14\x91\x12\x18\x84"
"\x1f\xfa\xac\x4f\xf9\xa3\x8d\x78\x64\x55\x48\xca\x1f\x15\x73\x84\x2c"
"\xce\xf6\x87\x8e\x2f\x3e\xcd\x3a\x60\x97\x46\x0a\xce\x3b\xff\x04\x12"
"\x98\xa2\x92\x0c\xcf\x3a\x12\xb1\x85\x9d\x09\x97\xbf\x5d\xf9\xd8\x69"
"\x80\xee\xf1\x5a\xb2\xcd\xff\x5e\x4b\x66\x55\xbf\x04\x9f\x8c\x94\xae"
"\x1c\x66\x6c\x72\x31\xe9\x86\x14\xbe\xd2\x16\x0a\x8f\x7d\x4a\x56\x1b"
"\xbd\x42\x14\xf1\x7b\x41\x95\x76\xc8\x2d\x11\xa6\x50\x99\x1e\xae\x1e"
"\x20\xdd\x8b\x60\xe5\x80\x36\xb8\xd8\x1f\x85\x5d\x83\x40\x1b\x7b\x90"
"\x2c\x11\x58\x0c\xf6\x01\x54\x86\x97\x3d\x25\x25\x84\x7e\x71\x71\xf3"
"\x01\xd2\x6d\x5f\x28\x43\x5e\x25\xeb\x05\x25\x7a\x7e\xf2\x34\xd8\xcd"
"\xd7\xab\xbd\x0b\x0c\x70\xdb\x7e\x21\x1e\x1a\xc3\x4a\x2d\x4c\x65\x29"
"\x27\x12\x45\xe3\x86\x20\x95\xb8\xa6\x32\x81\x74\x35\xc1\x27\xae\x34"
"\xfa\x20\xbe\x02\x57\xd3\x9c\x14\x3a\x7a\x1b\x71\xd3\x21\x9e\x44\xcf"
"\xc8\x4c\x98\xfc\x8e\x6a\xd8\x60\x5a\x35\x34\x5f\xe0\x55\xaa\xce\xe3"
"\x76\x82\x11\x0d\xf0\xaf\xde\x92\xa6\x57\x0a\x50\x39\xa9\xbb\x31\xcc"
"\x97\x6a\x7b\x11\xc0\xeb\xd3\x82\xfd\x4b\xe3\x40\x94\x23\x10\x6c\x33"
"\xe7\x83\xf1\xdc\x8e\xbf\x6a\x46\x95\x6f\x25\xdc\x69\x52\x30\x9f\x71"
"\xd9\x64\xe3\xc5\x13\x5f\x4f\x43\x29\x4c\x7d\x6a\x83\x25\x59\xbe\xee"
"\x9e\x04\xe4\x13\xdb\x9c\xcf\xf9\x04\x78\x04\x93\x0e\xbb\xe3\x27\x8c"
"\x59\x67\xd3\xe4\x5f\x69\x7f\xb7\xcc\x5e\x4b\xa2\x03\x9b\xd1\x50\xf0"
"\x65\xfa\x3b\x3b\xc5\x23\xae\x64\x76\x7b\x63\xac\xb0\xd4\x69\x0f\x48"
"\x38\x1a\xb9\xd8\xac\xda\xf0\xb5\xb0\x76\x69\x6e\x13\x96\x71\xbf\x57"
"\xd1\xac\xf4\xdd\x51\xd3\x17\x48\x35\x22\x25\x13\xf4\x28\xa7\x88\x1a"
"\xa7\x1b\xe7\xfe\x85\xf8\xcf\x59\x1e\x68\x34\xc9\xee\x41\x63\xc2\xe9"
"\x6c\xe3\x03\x85\xe3\x30\xb2\x4c\xfb\x19\x9f\x75\x29\xf7\xdd\x0f\x3e"
"\x3e\x49\x70\xcf\xf7\xf6\x89\xb6\x39\xe9\xd8\x25\x47\xec\xf4\x4b\x3c"
"\xfd\x65\x3b\x97\x9a\x05\x1c\x52\x1a\x92\xf1\x0e\x14\xae\x7b\xad\xc4"
"\x07\xc7\x40\xda\x53\x36\xa6\xbc\xea\x84\xbf\x68\x47\x75\x32\xac\x30"
"\x2e\x84\x16\x11\xfd\xfd\x90\x08\xf5\xb2\x99\x57\x7c\x9c\xd1\x66\xc7"
"\xaa\x0b\xa0\x52\xdf\xd2\x37\xcc\x2c\xb0\xa0\x3e\x95\x16\xb7\xa4\x90"
"\x67\xc7\x11\xb9\x8d\x04\xd3\x46\x3c\xf2\x13\x6d\x22\x8a\xbf\x61\x4c"
"\x32\x16\x82\x0a\xfa\x2f\x80\xfc\xab\x2c\xfe\xf6\xbf\x86\x89\x64\x3f"
"\xf8\x2e\x35\xdb\x79\xf0\xf1\x09\xfb\x7a\x57\x3d\xda\xb8\x35\x7a\xd2"
"\x62\x84\x46\x26\x92\xe5\xcc\x6d\x51\x71\xbf\xda\xfb\x07\x48\xe2\x5d"
"\xee\x4f\xd1\x13\x22\xf1\xca\x6e\xe1\x4a\xd8\xa6\x34\x1b\x5a\xa4\x93"
"\x8f\x24\xca\x01\xdd\xa2\x70\x04\x39\xcd\xb5\x75\xc2\x39\x22\x98\x7e"
"\x1d\x6a\x0f\xa9\xea\x39\xf4\xc2\xf5\x89\x93\xe7\xcb\xab\x81\xb9\x09"
"\xeb\xc6\x92\x1e\x2d\xf5\xa5\x0f\xcb\x23\xfa\x95\x3d\x0a\x1d\x00\xee"
"\x96\x9f\xe7\x55\x75\x97\xdd\xe6\x83\x35\x26\x37\xac\x96\xba\xb3\x58"
"\x54\xb9\xcc\x6d\x9c\x8f\x8f\x8e\xb6\x18\x40\x9e\x49\xdd\x33\xbe\x74"
"\xb7\x6c\x41\x4e\xec\x39\xf0\xb7\xeb\x88\xad\x4d\x91\x8f\x64\x4f\x41"
"\x28\xc5\x5d\x2e\xa1\x0e\x01\x19\x34\x83\x3f\xf3\xe3\x8a\x00\xe5\xc7"
"\x7e\x92\xdb\x04\xc4\xab\xab\x6c\xeb\x38\x40\x0f\x2e\xf2\x39\xdb\x93"
"\x45\x3e\x80\x18\xf9\xd8\x94\x2a\xfd\x06\x00\x4f\x95\x58\xce\x3f\xa2"
"\x32\x83\x0a\xad\x4f\x22\x22\x15\x87\x67\x23\x8d\x58\x4e\x0a\x31\x8e"
"\x0b\x09\x30\x8b\x58\x05\x4d\xb6\xbe\x61\x88\x6d\x16\x41\xd4\xc2\xb0"
"\x00\x42\x46\x32\xd8\xa8\xc8\x1d\x74\x89\x57\x3c\x95\x35\xd0\xa3\xe8"
"\x6c\xc8\xcf\x28\x3d\x7c\xa4\xb5\xbe\xd3\xda\x33\xf0\xdf\x45\x8b\xbc"
"\x13\x95\x43\x6f\x56\x94\x62\xc4\x2b\x99\xbe\x26\x06\x26\x51\x32\x09"
"\x3c\x3b\xe4\xa0\x5b\xc6\x45\xad\xc2\xfc\x3f\xa2\x51\x7d\x18\x56\xd3"
"\x0d\xcc\xe1\x77\x6b\x2d\x42\x04\x18\x9d\x7b\xa5\x3d\x9e\x97\x6b\x64"
"\x7f\x62\xa6\xc7\x4c\xc0\xe3\x05\x27\x4a\x3a\xe9\x5d\x46\x2a\xff\x27"
"\x3e\x87\xb0\xa5\x18\x0f\x15\x5d\x15\x26\x28\x05\xc1\x2f\x8e\x47\xcd"
"\x68\x3b\x09\xbb\x6b\xaa\x5f\x28\x35\x24\xe2\xe9\x34\x42\xee\x31\xdb"
"\x8a\x66\x98\xeb\xce\x79\x2a\xec\xa1\x66\x5c\xb2\x91\x14\x69\x9e\x12"
"\xc1\xd4\x71\x98\xcb\xe7\x32\x92\x2a\x88\x68\x30\x03\x43\x18\x6f\x83"
"\x97\x65\xd0\xb8\xc9\x4f\xe5\xa0\x8c\x55\x97\xf5\x86\xac\x48\x3c\xfc"
"\x1b\x19\x7a\x0e\xa4\x0b\x7d\x14\xb0\xa5\x42\x96\xc4\x8f\x7e\xde\x36"
"\x9a\x95\xdb\x11\x27\xe9\xbf\x9f\x95\x92\xc1\x5b\xb6\x4a\xda\x38\x61"
"\x8c\x14\x98\x9f\x81\x2e\xa1\x82\x6c\x60\xc8\xe9\xbb\x78\x5b\x54\x23"
"\xd3\xe5\xcf\x06\xc6\xee\x98\x4b\x0c\x64\x77\x62\xcb\xa1\xbf\xd9\x29"
"\x84\x95\xc0\x69\x74\x30\x2a\x94\xa2\xb2\xac\xc4\x6b\x7b\x7d\x6b\x5d"
"\xb6\x1d\x95\x60\xc5\xc9\xb6\xdc\xcc\xef\x37\x1c\x44\x5d\x75\xaa\xf6"
"\x1e\x13\x84\xba\xad\xfc\xe5\xeb\x2b\xf0\x80\x0b\x61\x74\xf6\x57\x89"
"\xb9\xa3\x9d\x39\x22\xf0\xeb\xde\x61\xfd\xff\x86\xd1\x12\xc6\xa3\x11"
"\xdb\x74\x07\x11\x50\xfc\x05\xda\xc3\x7a\xa0\xd0\x09\x19\x8e\xd2\xe3"
"\xd7\xe0\x13\x1e\x69\x7e\x9b\x64\x8e\xd7\xff\xc7\xd7\x54\x21\xa2\x66"
"\x94\x00\x5f\x52\xf4\x4b\xb6\xa2\x8c\xb1\xae\x7a\xe1\x8c\x7b\x05\x78"
"\x18\x2f\x91\xac\x1f\x6f\x4d\xf0\x16\x4a\xa1\xfa\x67\x45\x76\xb4\xda"
"\xb3\x35\xa8\x5b\x2d\x2a\x85\x5a\x2f\x7d\x06\x40\xd7\x83\x14\x02\x54"
"\xcd\x55\xd5\x7a\x35\xa6\x20\x5f\x08\xfc\x0b\xf0\x42\xb5\xde\x6b\x7c"
"\xb5\x32\xd9\xaa\x66\x81\x5d\xf5\xcc\x4c\x21\xe7\x4e\x6e\x53\xc1\x5a"
"\xbc\x8b\x28\xc6\x41\x5d\x36\xb1\x4b\x0e\x0e\xa1\xe1\x4c\x3f\x66\x69"
"\xf2\xc0\x29\x46\x32\x9f\xa1\xbb\x1f\xce\xa5\x31\x2d\x63\x77\xd4\x54"
"\xce\x78\x7c\x5e\x46\x4d\x20\x6b\x36\x4f\x46\x19\xb0\x70\x16\x47\xd5"
"\xf1\x1c\xa3\x4e\xb7\xc2\xcd\xea\x60\xa0\x1e\x3d\xa1\x28\xba\xaa\x40"
"\x5c\xc3\x9d\xbb\x8e\x74\x3c\x2a\xdb\x70\xb4\xb8\x8b\x90\xff\xed\x7b"
"\x37\x86\xae\xf4\xed\xb3\x24\x0d\x1e\xa2\x97\x73\x43\xfd\x57\x82\x2f"
"\x08\x61\x8a\x80\x99\x05\xd8\xe4\xcf\x06\xca\xcb\x61\x83\xdd\x8e\xa4"
"\xce\xb3\x3d\x82\xc0\xad\x4c\x7a\x43\xfa\x2f\x22\x3d\xe5\x7e\xa4\xa7"
"\xac\xdc\xb8\x24\xa1\x46\x7d\x44\x2d\x6b\x2e\x8e\x91\xdb\x42\x51\xfc"
"\x16\x29\x2a\xc5\x72\xd8\x69\x1b\x1c\x98\x3d\x51\xd1\x4c\x5f\xc1\xaa"
"\x8b\x9f\xfe\x87\xa7\xc1\xbb\x30\x99\x5f\x7a\xe7\x34\x9f\x24\x49\xdf"
"\xe2\x38\xb5\x1d\x26\xcf\x7e\xa7\x82\xd2\x3c\x6b\x8d\x76\xcf\xeb\x5c"
"\x0d\x7a\xf4\xbc\x46\xde\x96\x54\x17\x67\x7d\xaa\x37\xa3\x2a\x17\x10"
"\xa1\xf8\xe2\x6b\x57\x6c\xcc\xd7\xd8\x48\xd4\xda\x4d\xa4\x64\x8b\x6d"
"\x82\x0f\x59\xed\x17\xb1\x4b\x5e\xfd\x9f\x68\x6f\x6f\xa4\x5c\xa6\xb8"
"\x3d\x98\x38\x00\xf5\xa0\x6a\xba\x3b\xf6\x4b\x48\x25\xd5\x1e\xf8\xda"
"\x6a\xd2\xe8\x3d\xec\x69\x62\xf7\xe1\xda\x56\xdc\x09\x1c\x56\xfa\xd1"
"\x14\x52\xe9\x5e\x6a\x14\x88\xd5\xfd\x0e\x00\x81\xbb\x93\xfc\x62\xa2"
"\xce\xf9\x65\x1d\xc5\xa3\x00\xb2\x7f\xa0\xed\x58\xdb\x84\xe2\xaf\x13"
"\xbc\x23\xaf\xcd\xd7\x20\xf3\xd1\x2e\x78\x0f\xa2\xd4\x06\xf8\x73\x73"
"\x8f\x41\x64\x29\x10\x26\x69\xc3\xd6\x23\xac\xb1\xd4\xa4\x0b\x0e\x92"
"\x87\xb5\x9b\x5f\x99\x30\x4a\xe9\x9d\x9d\x81\xce\x0d\xd8\xd9\x68\xa9"
"\x19\xc8\x01\x1f\x13\x5a\x61\x8f\x2e\xa9\x3e\x2c\x57\x75\x1c\x7c\x10"
"\xd3\x70\x36\xa9\xe3\x89\x96\x08\xf3\x9f\x4e\x53\xf6\x22\xb5\x85\x6b"
"\x96\x44\x28\xc4\x89\x18\xa8\x49\xe6\xec\x45\x57\x13\x26\x9b\xac\xc5"
"\x2c\x41\xbd\xcd\x78\x1e\x9d\xd4\x96\x9a\x03\x9a\x07\xee\xe1\xc0\x86"
"\x74\x41\x7c\xca\x77\xde\xdd\xff\x8d\x0f\x09\x70\x06\x47\x24\xde\xf6"
"\xdc\xc7\x24\xe1\x0e\xa6\xda\xe0\x1b\x78\x2a\xc6\x24\x31\x14\x08\x0d"
"\x4c\xf8\x59\x55\xb9\x46\x64\x68\x66\xdd\x0b\x8e\x86\xac\xaa\x3b\x67"
"\x0c\xa6\xd3\xa6\xe6\xf8\x3d\xd6\xf0\x67\x1a\xb7\xb1\x2e\xb7\x82\xf5"
"\xeb\x1d\x74\xe8\xc4\x16\x78\x23\xb2\x1f\x42\xce\x04\x6f\x04\xaf\x9a"
"\x04\xf3\x3b\xc4\xb2\xa3\x1b\x4b\x46\xb6\xfc\xc3\x61\x55\x67\xcb\x18"
"\x4a\xb8\xc3\xff\x88\x8d\x64\xca\x3d\x57\x8e\x30\x8f\x3f\xc5\xb2\x27"
"\xfb\x9a\xac\x18\xdb\x71\x55\x5f\x59\x12\x10\x54\x4f\x11\x68\x76\x98"
"\x49\xee\x58\x6d\x1a\xd0\x93\x42\x68\x5d\x0b\x6a\x0e\x0e\x5d\x8d\x15"
"\x94\x1a\x18\x7b\x19\xf8\x07\x41\x3f\x82\x3a\x69\x5f\x60\x2f\xbe\xb4"
"\xd0\xc6\xf2\xb0\x38\x1f\xc7\x4a\x0f\x15\x8a\x15\xa3\x94\xce\x51\x40"
"\x32\x28\x70\xba\x2d\x3f\x61\x77\x4d\x14\x72\xd5\x9d\x86\x54\x37\xae"
"\xf6\x3a\x33\x38\x6e\x59\x74\x11\x00\x45\xf0\x14\x1d\x73\x18\x6a\x34"
"\xd2\xa0\x5a\x96\x49\x02\xc6\x37\x30\xae\x49\x8f\xaf\xba\xc0\x70\x13"
"\xdf\xd2\x6f\x03\x34\x3e\xd0\x34\xda\xe6\xda\xc1\x8f\x99\xd5\x90\x99"
"\x79\x51\x4e\xdc\x70\x10\x92\xe0\xd2\xed\x1c\x33\xa3\x69\x79\x62\x59"
"\x8c\x4d\x26\x4b\xd1\x42\xa9\x3e\x83\x6b\x9e\xae\x3f\xba\x85\xa7\x9f"
"\xa4\x29\x42\x68\xdc\x3e\xc8\x18\xc6\x9a\x1d\xd1\x72\x01\xe9\x38\xa9"
"\x54\xca\x3d\x87\xc1\xe7\xd4\xf5\x43\xa9\x2f\x07\xa5\xaf\xd7\x70\xae"
"\x40\x76\xc2\xef\x3e\x23\x4a\x0e\x23\x50\x29\xc5\x43\x50\x2c\x3f\x2a"
"\xb6\xa6\x4e\x0e\x47\x3e\xfe\xad\xc3\xd7\x69\x22\xb1\x3d\x25\x22\xd5"
"\x69\x83\x9b\xbe\x96\xee\x0e\xa8\xc2\x16\xa2\x58\xd0\xdc\x49\x23\x11"
"\xf6\xe0\x0c\xda\x66\x05\x37\x9c\x6e\x67\x6e\x9f\xd1\x87\x21\x31\x0a"
"\x94\xc8\x71\x85\x61\xaf\x4b\xa2\x04\xbe\x9d\x7e\xd6\x5f\x6a\x55\x8e"
"\x4a\x95\x4c\x56\x0d\x82\x40\x02\xe7\xc4\x03\xc3\xa7\xa7\x46\x5e\x82"
"\xb6\xfe\xd4\x53\x71\x64\x41\x2d\x17\x5e\x7b\x15\xd4\x32\x49\x6c\xaa"
"\x1e\x33\xbe\xd3\x8a\x8e\xfb\xd1\x67\x66\x10\x5b\x2a\xf5\x7e\x2c\xbc"
"\x55\xba\xfe\x6e\xc8\x2e\xc1\x1d\x0a\x4a\x77\x15\xa3\x96\xeb\x72\xfd"
"\x51\xf6\xec\xb3\xd8\x5c\xb2\x50\x95\xe3\xf4\x03\xd1\x41\x22\xe6\x41"
"\x54\xc5\x72\x89\x0f\x59\xa4\x9b\x3e\x29\x21\xbd\x1f\xf0\x1f\xe9\x81"
"\x3a\x48\x95\x45\x27\xe1\xef\xa5\xd9\xe5\xf4\x6d\x48\x44\x34\x34\x29"
"\xca\xc3\x3b\xec\x7a\xf1\xdf\xa0\xb9\xac\x56\xc5\x4d\x6b\x6a\x98\x75"
"\xb4\xed\xdc\x55\xf4\x10\x6e\x01\xb4\x9f\xe8\xae\x81\xaf\xf0\x2e\x8a"
"\x29\x3b\x32\x36\x07\x2a\x91\xbf\x3b\x7c\x1f\x88\x67\xb6\x29\xae\xc2"
"\xc2\xfd\x13\x23\x74\x06\x3f\xe7\x1c\xdf\x55\xf5\x34\xe6\x6c\xa5\xe9"
"\xcd\xdd\x4b\x59\x89\x41\xbe\x51\xfd\x05\x10\xb0\x39\x84\xcd\xf7\xb6"
"\x09\x94\xa6\xdc\x1e\x51\xaf\x04\xf4\xe8\xb6\x60\xff\x78\x61\x07\x30"
"\x7b\x44\x64\xb6\x36\xc1\xb5\x33\xd9\xd6\x1e\xb0\xa4\xc9\x36\x9e\xdc"
"\x57\x5b\x49\x72\xb8\x71\x93\xbd\x49\x18\xa3\xd6\xab\x78\x5a\xc7\x18"
"\x02\xd1\x9f\x61\xed\x7c\x67\xfc\xd1\xbb\x40\x93\x69\xf4\xd3\x52\x19"
"\xa4\xc2\xb8\xff\x75\x4f\x50\x45\x72\xeb\x74\x9e\xc8\x9b\xe2\x0a\x10"
"\x26\xd1\x4a\x1b\x0a\x6d\x28\xa2\x82\x7e\x29\x93\x5f\x8c\xf5\x48\xf4"
"\x38\x82\xfe\xfb\x2b\x19\xbe\x8a\x10\x2d\x18\x38\x57\xc4\xa2\x96\x08"
"\x2d\xaa\x1a\x58\x80\xd9\x83\x10\x2e\x72\xc0\x10\x5e\x91\xef\x58\x8c"
"\xcd\xe5\x39\x54\x10\xe4\xc6\xc0\x5e\xf3\x70\x0a\x97\xeb\x59\x9e\xff"
"\x39\x5c\x07\xb1\x0b\x49\xc3\x04\xfc\x6d\xe7\xd5\x8e\xe6\xe3\xd0\x21"
"\xa0\x01\x93\xa5\x5b\xb1\xf7\x93\x39\xa7\x37\x34\x9f\x71\xb5\xef\x62"
"\x69\x2b\x3a\x88\x01\xec\xc7\x7c\x26\x0e\xe3\x05\xbc\x87\x9f\xa2\x07"
"\xce\x28\xfe\xdd\x9b\xe5\x24\x8b\x75\xcc\x0a\x1d\x81\x22\x0a\x86\x78"
"\x8c\xf0\x73\x62\xe4\x51\xba\x40\x79\xfb\xec\x33\x67\x3a\x25\x2d\xe3"
"\x00\x93\x31\xee\x0a\x4f\xc7\xce\x81\xf1\x6f\xef\x6e\x85\x35\x49\x15"
"\xf9\x5f\xbe\x1e\x47\xa6\x75\x62\xba\x76\x67\x6a\x3c\x86\xab\x18\xc9"
"\xf8\xb2\xd2\x2a\x47\xbc\xff\xee\xbe\x79\x8f\x56\x04\x28\xbb\xc9\xe3"
"\x6f\x44\x5c\x2a\x50\x53\x92\x27\x35\xc3\x0f\xc8\x04\x6e\x07\xbd\x5f"
"\xc4\x2c\x51\x8c\x1b\xe7\x79\x39\x6c\x20\x89\x51\x16\x22\x3a\x4a\x05"
"\x3b\x4c\xe0\xc3\xb1\x16\x42\xaa\x4d\xfd\xfa\x6b\x4a\x10\x42\xe2\x9a"
"\x58\xa3\x70\x7b\xd6\xde\x71\x01\x82\x97\x0e\x49\x08\x4b\x36\xa0\xa1"
"\xff\x35\x7a\x0c\x32\xac\xc5\xf9\x7e\xcc\xa2\x3b\x8a\x40\x98\xcf\xaf"
"\xfa\x6f\x1f\x6c\x63\x99\xb8\x90\x12\x31\x5f\x22\xcd\x20\x36\x28\xf8"
"\xb8\x78\x4d\x1e\x16\x1e\x57\x5a\x6f\x98\xc8\x4f\x5a\xf3\xde\x45\x66"
"\x0f\x0e\xe8\x20\x19\x14\xa7\x6d\x67\xa4\x52\xf3\xc1\x96\xc0\xad\x0f"
"\x64\x7b\x8a\x1e\x0f\x86\x5e\x97\x36\x46\xda\x92\xf4\xc1\xa4\xb6\x5a"
"\xb0\x9b\xd2\xfa\x0b\x6c\x0d\x21\x89\xb7\xd3\xf3\x89\x5a\x70\x23\xb7"
"\x90\x2a\x48\x45\xd2\x79\x01\x6a\x13\x11\x81\xe1\x57\xb3\x73\x52\x7b"
"\x64\x80\x79\x94\xc0\x90\xe8\xf5\xcd\x97\xb3\x4c\x71\x46\x94\x93\x96"
"\xd2\x30\x8c\xb1\x8b\x06\x0e\xd9\x31\x98\xe4\x6d\x6d\xb0\xd0\x6b\x54"
"\xc4\xf0\x38\x0a\xd4\xfe\xbc\x10\x13\xb6\x25\x99\xb9\x32\xc0\x22\xc3"
"\x07\xd8\xff\x77\xca\x9d\x6b\xc2\xce\x25\x0f\xdc\x1e\x2a\x63\x01\x0c"
"\xd9\x66\xb4\x86\xca\x30\x6b\x81\x9d\xaf\xa8\x19\x7f\x3f\x5a\xf1\xd1"
"\x0e\x00\x03\x97\xa6\x70\xdc\xfa\xdd\x5e\x71\xd1\x8a\x01\x82\x2b\x32"
"\x66\x04\x14\x6d\x6c\x71\xdd\xad\x1f\xd9\xc6\x72\x1e\xf4\x6d\x93\xd4"
"\x47\xfa\x9e\xdd\xc8\xc2\xc6\x7b\x2f\x1a\xf5\xb0\x74\xde\xb7\x1e\x00"
"\xeb\x08\xa8\x64\x64\x8c\x3e\x70\x7a\xe4\x9e\x3f\xc4\x4c\xaf\xec\xd7"
"\x62\xb4\x69\x54\xe2\x51\x5c\x6a\xc3\xb4\x6b\x7f\x92\xe5\x89\x0b\x88"
"\x21\x8e\x2c\x68\x85\x06\x6f\x64\x08\x6d\xf9\x77\x25\x9f\xc0\x97\x15"
"\x75\x1f\x75\x1e\xda\x57\xb2\xc1\x4e\x42\xeb\xe2\xf4\x1d\xac\xdd\xbb"
"\xb5\x5f\x53\x5a\x0c\x8d\xb2\x70\x08\x4a\xaf\x63\x19\x93\xe1\xdb\xb8"
"\x7c\x8c\x1d\x0c\x9d\x39\x1a\xbe\x23\x2c\x8f\xce\xca\x77\xc0\xa0\xe1"
"\x74\x6e\x26\xe3\x28\x24\xa4\x65\xe6\x2b\x4e\xdc\x20\x34\x75\xc8\xa4"
"\x91\x13\x3a\x76\xb7\x93\x89\x5f\xfc\x02\x6a\x0d\xaf\x3c\xec\xc8\x63"
"\x5f\x2a\x41\xd7\x88\x31\x9a\x80\xe0\x26\x36\xb2\x86\xce\x4e\x45\x9f"
"\xdf\x95\x35\x89\x1f\x73\xdc\x9c\xc0\x14\x68\x06\x0e\x6f\x43\x75\xc7"
"\x06\xbb\x84\x72\xb2\x0b\x32\x5c\x81\xc8\xa5\x88\x02\xe4\x6d\x49\x23"
"\xaf\xce\x55\x26\x86\xae\xa2\x28\x49\x6e\xc8\x16\xaa\x47\x29\x41\x9c"
"\xf2\xfd\xf2\x29\x53\xd4\x4d\xec\xa3\xa7\x36\x21\xa5\x70\xb2\xbd\xd6"
"\x22\xc8\x41\x7c\x93\x93\xa4\x43\x34\x03\x8b\x54\xd2\x1e\x32\x71\x35"
"\x81\x2e\xd3\x95\x5e\xdb\x60\x4c\x32\x55\x22\xdb\x6b\x7e\xb2\x8b\xdb"
"\x7a\xbc\x5d\x59\x54\x2f\x2c\x03\x02\xdb\x33\xbe\xa8\x27\xb0\xe1\x65"
"\xbd\xeb\xf6\x67\xde\xf3\xe2\x43\x99\x35\xad\x82\xae\x09\xa8\xd9\x3d"
"\x2b\xf5\xdc\x9e\x17\xf1\x19\x61\xd9\xca\x72\xcb\x44\xbf\x37\x16\x27"
"\x70\x9a\xc7\x99\x89\x0e\x57\x86\x86\x43\xb8\xfe\xb3\x71\x7f\x83\x49"
"\x2c\xb7\xca\xc3\x1c\xd4\xc2\xfc\xd1\x90\x25\x85\x3a\x97\x8d\x28\xb3"
"\x9a\x27\x61\xd5\xf2\x1a\xd6\xba\xbb\x3f\xea\x51\x63\x4f\x0d\xed\x0e"
"\x65\x42\x86\x9c\xd9\x3f\x74\xa5\xfe\xbc\xfb\x3e\xc9\x3a\x96\x2c\x03"
"\x7b\x2d\xff\x39\x14\x87\x46\x72\x85\x1c\x54\x47\x94\x99\x81\x93\xdf"
"\xc3\xe8\x6d\xa9\x0f\x80\xe3\xe4\x53\xda\x48\xd1\x1d\xbd\x24\x0d\xe1"
"\x77\x07\x98\xa8\x7c\xdb\x24\x5c\x17\xa0\xd4\x45\x17\x01\x58\x6d\x55"
"\x26\x3e\x2d\x6b\xcf\xf9\x06\xd0\x5e\x64\xcb\xc3\xb6\xaa\x42\x3e\x81"
"\x33\x13\xdc\x0d\x2a\x86\xff\xbc\xb6\xf2\xec\x5c\x18\x2d\x2d\xb2\x1c"
"\x9c\xb1\x39\x68\x38\x07\x8f\xfa\xdb\xbd\xc0\x43\x7b\x2b\xc0\xbd\x01"
"\x2c\xda\xf3\xbf\xc1\x06\x21\xbf\x33\x38\x3b\xcc\xf3\xd6\xfd\x64\x49"
"\xdd\x31\xa2\x72\x14\x78\x01\x12\xf3\x04\x6f\xe0\x19\xc2\x56\x3d\x45"
"\x33\x3e\x3e\xe6\x4b\x84\x74\x1a\x7e\xf3\x77\xe6\xe3\x44\x7e\x2a\x56"
"\x78\xe6\x7f\x2c\x7e\x64\x0b\x4b\x2d\x65\xdc\x40\x97\x0f\xdb\x37\xac"
"\x96\x28\x6c\x94\x16\x86\x0c\x62\x82\xf4\x27\x7f\x90\xae\x0c\x40\x80"
"\xad\x07\xef\xba\xfd\x88\xc3\xa4\x62\x5c\xf5\xa4\x31\x48\xd3\xa4\x82"
"\x98\x4d\x47\xe7\x73\x4f\x80\x76\x7a\xf4\xd7\x8c\x46\xae\x0f\x5d\x4b"
"\x0c\xf2\x33\xfa\xde\x11\x85\x36\xdb\x89\xaf\x25\x70\x43\x3f\xf2\x8c"
"\x40\xd8\x98\xdc\xba\x91\x59\x9b\x07\x6a\x2b\xc1\xb4\x18\xb8\x61\xd0"
"\x5f\xc2\xad\x49\x51\x44\xbe\x07\x8b\x87\xc8\x84\x5f\x57\x66\xff\xb1"
"\x0a\xeb\x91\x07\xa7\x0e\xfe\x6b\x11\x46\xb4\x6a\xbc\xb3\x0f\x9f\x6e"
"\x36\x75\xa9\xbc\xec\xfa\x62\xd7\x02\xff\xb7\x03\x87\x7d\x10\x7e\x19"
"\x6e\x2a\x77\xa1\xf2\x2c\x3e\x3e\xef\xf8\x7c\x8d\xc2\xa3\x1f\x65\x0a"
"\x8f\x40\xfc\x51\x97\x5f\xc8\xd0\x47\x1e\x05\xac\x37\x25\xd1\x25\x66"
"\xa5\xd8\x78\xc3\x39\x78\x62\x1f\xf0\x2c\xba\x91\xed\x2c\x67\xa4\x6a"
"\xb0\x26\x11\x35\x6b\xa3\x15\x3e\x36\xc7\x85\x24\xa3\xa5\x6c\x98\x46"
"\x33\xc7\x5b\xd4\xe6\xf7\xb9\xa7\x8d\x81\x7e\xda\xac\x89\x0b\x86\x83"
"\xbd\xb9\xce\x62\x87\x7d\x7e\x0f\x81\x37\x7a\x36\xe6\xd4\x46\xc8\xf0"
"\x50\x66\x9a\xc0\xaf\xf0\x0c\x77\xff\xeb\x3d\x9a\x95\xb2\x99\xa4\xb0"
"\x04\x1b\x0e\xc9\x9a\x47\x7b\xb6\x92\x56\xa6\x79\x32\x95\x01\x04\x8b"
"\x81\xe3\x15\x10\x3c\x4c\xa7\xb1\xd3\x35\xb1\xfe\xa1\x59\xf0\x89\xd3"
"\x14\x52\x4a\x24\xbd\x88\xdd\x95\xc2\x95\xcd\x2a\x26\x60\x1b\x68\x03"
"\x5e\xf9\x9a\x79\x3c\x95\x2b\xec\xf5\x2d\x7f\xb2\x07\x03\x0b\x69\xb2"
"\x7b\x38\xf5\x35\xd5\x11\xd0\x2e\x5d\x8c\x6b\x15\xe3\x5b\x39\xa6\xd0"
"\x7f\x22\x1c\x32\x12\x67\x13\x07\xa4\xb0\x44\x69\xed\xa9\xf4\x57\x78"
"\xc2\x78\x23\x86\x13\xc3\x0f\x02\xc6\xc2\x9e\xef\xf4\xf9\x1e\x00\x89"
"\xc0\x62\x71\x18\x4a\x5f\x0c\xb2\xdd\x91\xca\xfe\x96\x74\x7e\xd2\xbb"
"\x43\xf9\x72\x7b\x4d\x12\x80\x9d\x6e\x90\x27\x6b\x9d\xaf\xde\xe6\x71"
"\x33\x45\xe5\x32\xe0\xdd\x7d\xa2\x8e\xfc\xe5\x8a\xf2\x05\x2a\xbb\x3e"
"\x4a\x03\xe5\xfb\x0e\x93\x9d\x91\x0a\xde\x4a\x09\x28\x65\x24\x0a\x3a"
"\xee\xec\x4a\xfe\xdf\x8d\xc0\xf6\xb9\x71\xc0\x99\x54\xd6\x9a\x11",
4096));
NONFAILING(*(uint8_t*)0x20001bd3 = 9);
NONFAILING(*(uint8_t*)0x20001bd4 = 5);
NONFAILING(*(uint8_t*)0x20001bd5 = 8);
NONFAILING(*(uint8_t*)0x20001bd6 = 0x10);
NONFAILING(*(uint16_t*)0x20001bd7 = 9);
NONFAILING(*(uint8_t*)0x20001bd9 = 0x66);
NONFAILING(*(uint8_t*)0x20001bda = -1);
NONFAILING(*(uint8_t*)0x20001bdb = 0x1e);
NONFAILING(*(uint8_t*)0x20001bdc = 2);
NONFAILING(*(uint8_t*)0x20001bdd = 0x21);
NONFAILING(*(uint8_t*)0x20001bde = 9);
NONFAILING(*(uint8_t*)0x20001bdf = 5);
NONFAILING(*(uint8_t*)0x20001be0 = 0);
NONFAILING(*(uint8_t*)0x20001be1 = 0x10);
NONFAILING(*(uint16_t*)0x20001be2 = 0x9da5);
NONFAILING(*(uint8_t*)0x20001be4 = 4);
NONFAILING(*(uint8_t*)0x20001be5 = 6);
NONFAILING(*(uint8_t*)0x20001be6 = -1);
NONFAILING(*(uint8_t*)0x20001be7 = 9);
NONFAILING(*(uint8_t*)0x20001be8 = 5);
NONFAILING(*(uint8_t*)0x20001be9 = 0xb);
NONFAILING(*(uint8_t*)0x20001bea = 0xc);
NONFAILING(*(uint16_t*)0x20001beb = 0x864);
NONFAILING(*(uint8_t*)0x20001bed = 4);
NONFAILING(*(uint8_t*)0x20001bee = 1);
NONFAILING(*(uint8_t*)0x20001bef = 1);
NONFAILING(*(uint8_t*)0x20001bf0 = 0x3f);
NONFAILING(*(uint8_t*)0x20001bf1 = 0x24);
NONFAILING(memcpy(
(void*)0x20001bf2,
"\x39\xc3\x17\xab\x0b\xc8\xce\xbc\x57\x8b\x85\x9e\x26\x3a\xe6\xa3\xb6"
"\xb1\xf0\xc5\x16\xf4\x99\xae\x54\x01\x85\x1d\x85\xe2\x09\x68\x41\x4b"
"\x99\x66\x21\x88\x41\x40\x06\x73\xd8\x41\xd8\xec\x0c\x21\xec\x53\x60"
"\xed\xef\x15\x0a\x89\xa7\x78\xb0\xcd\xc8",
61));
NONFAILING(*(uint8_t*)0x20001c2f = 9);
NONFAILING(*(uint8_t*)0x20001c30 = 5);
NONFAILING(*(uint8_t*)0x20001c31 = 3);
NONFAILING(*(uint8_t*)0x20001c32 = 0x10);
NONFAILING(*(uint16_t*)0x20001c33 = 6);
NONFAILING(*(uint8_t*)0x20001c35 = 2);
NONFAILING(*(uint8_t*)0x20001c36 = 0xc1);
NONFAILING(*(uint8_t*)0x20001c37 = 0);
NONFAILING(*(uint32_t*)0x20001f80 = 0);
NONFAILING(*(uint64_t*)0x20001f84 = 0);
NONFAILING(*(uint32_t*)0x20001f8c = 0x19);
NONFAILING(*(uint64_t*)0x20001f90 = 0x20000080);
NONFAILING(*(uint8_t*)0x20000080 = 5);
NONFAILING(*(uint8_t*)0x20000081 = 0xf);
NONFAILING(*(uint16_t*)0x20000082 = 0x19);
NONFAILING(*(uint8_t*)0x20000084 = 3);
NONFAILING(*(uint8_t*)0x20000085 = 3);
NONFAILING(*(uint8_t*)0x20000086 = 0x10);
NONFAILING(*(uint8_t*)0x20000087 = 0xb);
NONFAILING(*(uint8_t*)0x20000088 = 0xa);
NONFAILING(*(uint8_t*)0x20000089 = 0x10);
NONFAILING(*(uint8_t*)0x2000008a = 3);
NONFAILING(*(uint8_t*)0x2000008b = 2);
NONFAILING(*(uint16_t*)0x2000008c = 4);
NONFAILING(*(uint8_t*)0x2000008e = 6);
NONFAILING(*(uint8_t*)0x2000008f = 5);
NONFAILING(*(uint16_t*)0x20000090 = 0x3f);
NONFAILING(*(uint8_t*)0x20000092 = 7);
NONFAILING(*(uint8_t*)0x20000093 = 0x10);
NONFAILING(*(uint8_t*)0x20000094 = 2);
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000095, 0x14, 0, 8));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000095, 0, 8, 4));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000095, 0xff, 12, 4));
NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000095, 0xfba2, 16, 16));
NONFAILING(*(uint32_t*)0x20001f98 = 8);
NONFAILING(*(uint32_t*)0x20001f9c = 4);
NONFAILING(*(uint64_t*)0x20001fa0 = 0x20002000);
NONFAILING(*(uint8_t*)0x20002000 = 4);
NONFAILING(*(uint8_t*)0x20002001 = 3);
NONFAILING(*(uint16_t*)0x20002002 = 0x430);
NONFAILING(*(uint32_t*)0x20001fa8 = 0x5e);
NONFAILING(*(uint64_t*)0x20001fac = 0x20000100);
NONFAILING(*(uint8_t*)0x20000100 = 0x5e);
NONFAILING(*(uint8_t*)0x20000101 = 3);
NONFAILING(*(uint16_t*)0x20000102 = 0x44e);
NONFAILING(
memcpy((void*)0x20000104,
"\xdb\x6d\x68\x5d\xa7\xbc\x4b\x4a\x2f\xca\xc7\x51\xc5\x24\x93"
"\x56\x1c\xb8\x95\xa1\x5e\xea\x1b\xcb\x25\xe5\x75\xa3\x63\x50"
"\xcb\x9f\xe1\xc2\x63\xc4\xff\x5f\xb1\xa5\x94\x4a\x12\x05\xaa"
"\x4e\x11\xc1\xca\x17\x08\xda\x46\xfc\x4b\xd1\x2f\x91\x3d\x16"
"\x7a\x41\x2b\x84\xfd\x3f\x3d\x4e\x98\x8e\x21\xd9\x0a\x09\xff"
"\x3d\x58\xd3\xd8\x38\x88\xfc\xa7\x3a\xc4\xd9\x69\x3e\xbd\x6c",
90));
NONFAILING(*(uint32_t*)0x20001fb4 = 4);
NONFAILING(*(uint64_t*)0x20001fb8 = 0x20004340);
NONFAILING(*(uint8_t*)0x20004340 = 4);
NONFAILING(*(uint8_t*)0x20004341 = 3);
NONFAILING(*(uint16_t*)0x20004342 = 0x200a);
NONFAILING(*(uint32_t*)0x20001fc0 = 0x52);
NONFAILING(*(uint64_t*)0x20001fc4 = 0x20000180);
NONFAILING(*(uint8_t*)0x20000180 = 0x52);
NONFAILING(*(uint8_t*)0x20000181 = 3);
NONFAILING(*(uint16_t*)0x20000182 = 0x2c01);
NONFAILING(memcpy(
(void*)0x20000184,
"\x9d\xc6\x82\xe6\x52\xa3\x19\x19\xbc\x2d\x4b\xda\x76\x84\x95\x7c\xd6"
"\xd7\xfb\x7f\xc6\xd3\x0d\xa9\x8a\x39\x72\x76\xa6\xdd\x73\xfc\x6e\x58"
"\x75\x7d\x1b\xd1\xc7\x4e\xab\x3d\xff\xd0\xcd\x03\xfc\xd6\xb1\x5b\xba"
"\x17\xd0\xed\xfb\x98\x21\x42\x6d\x4e\xe3\x63\xc8\x9b\xea\xcd\x46\xf5"
"\x59\x5e\xba\x60\x05\x26\xd4\x9d\x04\x38",
78));
NONFAILING(*(uint32_t*)0x20001fcc = 0xde);
NONFAILING(*(uint64_t*)0x20001fd0 = 0x20001c80);
NONFAILING(*(uint8_t*)0x20001c80 = 0xde);
NONFAILING(*(uint8_t*)0x20001c81 = 3);
NONFAILING(*(uint16_t*)0x20001c82 = 0x6c3d);
NONFAILING(memcpy(
(void*)0x20001c84,
"\x84\xf8\x08\xb4\x7f\x78\xbd\xf7\x66\x4a\xba\x13\x99\x10\x92\xdb\xae"
"\x98\xb7\x6a\x02\x24\x92\x49\x45\x53\xd4\xd6\x18\x92\x30\x40\x31\xad"
"\x30\xc2\x55\xb0\x25\x1d\xe1\x6b\x81\xde\xf0\xdd\xb7\xf4\x24\xe0\xf2"
"\xcf\x98\x37\xbf\xc0\xfe\xfa\xc6\x4f\x4b\xa3\x2d\x7f\x36\x4a\xc4\xfd"
"\x8d\xc1\xf8\xca\xba\xff\x8f\x4b\xb0\x59\x02\x49\x9b\x94\xc8\xe8\xfe"
"\x1f\x69\xfa\x8f\xfa\xa3\xf0\x74\x50\x68\x9f\x6b\x3b\x8d\x4f\xc0\x50"
"\xd3\x99\x46\x42\xa5\xdb\x1e\x33\xad\x96\x68\x62\xa3\xf9\xb6\x37\x80"
"\x41\x69\xe7\x3a\x15\x2d\xfb\xd0\xc4\x09\x57\x5b\x36\xe0\xec\xe4\x09"
"\x05\x8a\x0f\xfc\x59\x03\x5d\xe3\x3a\x60\x12\xb1\x86\xcf\x6e\x93\xfd"
"\xfb\xb6\xd4\x38\xa5\x68\x05\x04\x4d\xf2\x3a\xb7\x95\xa0\x1c\x1a\xd7"
"\xe1\x68\xb9\xab\xad\x81\x2b\x6e\xdf\x2e\x13\x8d\xdc\x8c\xfb\xfe\xe7"
"\x08\x7c\xe8\x41\x26\xb5\x4c\x72\x5c\x6b\x47\xa5\x91\x45\x1b\x7b\x3d"
"\xcd\x88\x19\xff\x47\x6a\x62\xc9\x75\x43\xc2\x02\xc3\xde",
218));
NONFAILING(*(uint32_t*)0x20001fd8 = 0xec);
NONFAILING(*(uint64_t*)0x20001fdc = 0x20001d80);
NONFAILING(*(uint8_t*)0x20001d80 = 0xec);
NONFAILING(*(uint8_t*)0x20001d81 = 3);
NONFAILING(*(uint16_t*)0x20001d82 = 0x80a);
NONFAILING(memcpy(
(void*)0x20001d84,
"\xe4\x86\xff\x87\xe4\x36\x6b\x44\x9d\x0a\xb0\x83\xe9\x98\xfc\x39\x75"
"\x11\xed\x89\xf1\x0d\x99\x78\xfa\x61\x56\xe3\x72\x23\x36\x19\x57\x71"
"\xc5\x51\x06\x37\x96\x29\x88\x11\x77\x96\x43\x12\x56\xe4\xb6\x66\xb8"
"\x69\x66\x47\x2b\xf2\xb8\x44\xc5\xcf\x3e\x85\x25\x3f\x25\xa3\xde\x2c"
"\x72\xa1\x7d\x90\x80\xc7\xbd\x0d\x04\xef\xf4\x2a\x06\x2d\xa8\x17\x2c"
"\x53\xd0\x7f\x3a\xe3\x84\x17\x4e\x05\x90\xea\xd9\x44\x38\x89\xb9\x64"
"\xd0\x2b\x6c\x17\xa6\xe0\x6d\x3a\xae\xd1\x42\xb9\xcd\xd3\x86\x36\x5d"
"\x4a\x90\xa1\x5f\x48\xbe\x74\xc9\xf9\x7d\x93\xeb\x04\x70\xb4\x7d\xe9"
"\xd5\xe0\x9a\xb9\x43\xe8\xab\x68\x73\xaf\x43\x75\x99\x5f\xcf\x41\xb9"
"\xf2\x44\xb6\x6d\x8b\x6e\xc7\x08\xde\xb6\x66\xd3\x1f\x40\xe3\x3a\xea"
"\x04\x80\x39\x48\x7a\x60\x27\xa3\x94\x6f\xd2\x34\x0c\xcf\x77\xe4\xb5"
"\xe6\xcf\xe3\xee\xbf\x6e\x97\xd5\x32\x21\x2f\xfa\x27\x12\xe5\xc8\xb6"
"\x0c\x0c\x30\xa3\x23\xfd\xd2\xc3\x07\x83\xf3\xa1\x65\xed\xd1\x61\xdf"
"\xba\x8b\xb3\x33\x11\x3b\xf7\x19\xa7\xc1\x06",
232));
NONFAILING(*(uint32_t*)0x20001fe4 = 4);
NONFAILING(*(uint64_t*)0x20001fe8 = 0x20000200);
NONFAILING(*(uint8_t*)0x20000200 = 4);
NONFAILING(*(uint8_t*)0x20000201 = 3);
NONFAILING(*(uint16_t*)0x20000202 = 0);
NONFAILING(*(uint32_t*)0x20001ff0 = 4);
NONFAILING(*(uint64_t*)0x20001ff4 = 0x20001e80);
NONFAILING(*(uint8_t*)0x20001e80 = 4);
NONFAILING(*(uint8_t*)0x20001e81 = 3);
NONFAILING(*(uint16_t*)0x20001e82 = 0x44a);
syz_usb_connect(5, 0x13f8, 0x20000840, 0x20001f80);
break;
}
}
int main(void)
{
syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
setup_binfmt_misc();
install_segv_handler();
for (procid = 0; procid < 6; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}