text: // WARNING in __alloc_pages_nodemask
  // https://syzkaller.appspot.com/bug?id=e493e79b0a398fb608190237e9f2d399fdbe8580
  // status:dup
  // autogenerated by syzkaller (https://github.com/google/syzkaller)
  
  #define _GNU_SOURCE
  
  #include <endian.h>
  #include <errno.h>
  #include <fcntl.h>
  #include <stdarg.h>
  #include <stdbool.h>
  #include <stddef.h>
  #include <stdint.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <sys/mount.h>
  #include <sys/stat.h>
  #include <sys/syscall.h>
  #include <sys/types.h>
  #include <unistd.h>
  
  #include <linux/usb/ch9.h>
  
  unsigned long long procid;
  
  static void sleep_ms(uint64_t ms)
  {
    usleep(ms * 1000);
  }
  
  #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
  #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len)               \
    *(type*)(addr) =                                                             \
        htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) |           \
              (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
  
  #define USB_DEBUG 0
  
  #define USB_MAX_IFACE_NUM 4
  #define USB_MAX_EP_NUM 32
  
  struct usb_iface_index {
    struct usb_interface_descriptor* iface;
    struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM];
    unsigned eps_num;
  };
  
  struct usb_device_index {
    struct usb_device_descriptor* dev;
    struct usb_config_descriptor* config;
    unsigned config_length;
    struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
    unsigned ifaces_num;
  };
  
  static bool parse_usb_descriptor(char* buffer, size_t length,
                                   struct usb_device_index* index)
  {
    if (length < sizeof(*index->dev) + sizeof(*index->config))
      return false;
    memset(index, 0, sizeof(*index));
    index->dev = (struct usb_device_descriptor*)buffer;
    index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
    index->config_length = length - sizeof(*index->dev);
    size_t offset = 0;
    while (true) {
      if (offset + 1 >= length)
        break;
      uint8_t desc_length = buffer[offset];
      uint8_t desc_type = buffer[offset + 1];
      if (desc_length <= 2)
        break;
      if (offset + desc_length > length)
        break;
      if (desc_type == USB_DT_INTERFACE &&
          index->ifaces_num < USB_MAX_IFACE_NUM) {
        struct usb_interface_descriptor* iface =
            (struct usb_interface_descriptor*)(buffer + offset);
        index->ifaces[index->ifaces_num++].iface = iface;
      }
      if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
        struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
        if (iface->eps_num < USB_MAX_EP_NUM)
          iface->eps[iface->eps_num++] =
              (struct usb_endpoint_descriptor*)(buffer + offset);
      }
      offset += desc_length;
    }
    return true;
  }
  
  enum usb_fuzzer_event_type {
    USB_FUZZER_EVENT_INVALID,
    USB_FUZZER_EVENT_CONNECT,
    USB_FUZZER_EVENT_DISCONNECT,
    USB_FUZZER_EVENT_SUSPEND,
    USB_FUZZER_EVENT_RESUME,
    USB_FUZZER_EVENT_CONTROL,
  };
  
  struct usb_fuzzer_event {
    uint32_t type;
    uint32_t length;
    char data[0];
  };
  
  struct usb_fuzzer_init {
    uint64_t speed;
    const char* driver_name;
    const char* device_name;
  };
  
  struct usb_fuzzer_ep_io {
    uint16_t ep;
    uint16_t flags;
    uint32_t length;
    char data[0];
  };
  
  #define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init)
  #define USB_FUZZER_IOCTL_RUN _IO('U', 1)
  #define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event)
  #define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io)
  #define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io)
  #define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
  #define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io)
  #define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io)
  #define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9)
  #define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t)
  
  int usb_fuzzer_open()
  {
    return open("/sys/kernel/debug/usb-fuzzer", O_RDWR);
  }
  
  int usb_fuzzer_init(int fd, uint32_t speed, const char* driver,
                      const char* device)
  {
    struct usb_fuzzer_init arg;
    arg.speed = speed;
    arg.driver_name = driver;
    arg.device_name = device;
    return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg);
  }
  
  int usb_fuzzer_run(int fd)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0);
  }
  
  int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event);
  }
  
  int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io);
  }
  
  int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io);
  }
  
  int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io);
  }
  
  int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io);
  }
  
  int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc);
  }
  
  int usb_fuzzer_configure(int fd)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0);
  }
  
  int usb_fuzzer_vbus_draw(int fd, uint32_t power)
  {
    return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power);
  }
  
  #define USB_MAX_PACKET_SIZE 1024
  
  struct usb_fuzzer_control_event {
    struct usb_fuzzer_event inner;
    struct usb_ctrlrequest ctrl;
    char data[USB_MAX_PACKET_SIZE];
  };
  
  struct usb_fuzzer_ep_io_data {
    struct usb_fuzzer_ep_io inner;
    char data[USB_MAX_PACKET_SIZE];
  };
  
  struct vusb_connect_string_descriptor {
    uint32_t len;
    char* str;
  } __attribute__((packed));
  
  struct vusb_connect_descriptors {
    uint32_t qual_len;
    char* qual;
    uint32_t bos_len;
    char* bos;
    uint32_t strs_len;
    struct vusb_connect_string_descriptor strs[0];
  } __attribute__((packed));
  
  static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0};
  
  static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04};
  
  static bool lookup_connect_response(struct vusb_connect_descriptors* descs,
                                      struct usb_device_index* index,
                                      struct usb_ctrlrequest* ctrl,
                                      char** response_data,
                                      uint32_t* response_length)
  {
    uint8_t str_idx;
    switch (ctrl->bRequestType & USB_TYPE_MASK) {
    case USB_TYPE_STANDARD:
      switch (ctrl->bRequest) {
      case USB_REQ_GET_DESCRIPTOR:
        switch (ctrl->wValue >> 8) {
        case USB_DT_DEVICE:
          *response_data = (char*)index->dev;
          *response_length = sizeof(*index->dev);
          return true;
        case USB_DT_CONFIG:
          *response_data = (char*)index->config;
          *response_length = index->config_length;
          return true;
        case USB_DT_STRING:
          str_idx = (uint8_t)ctrl->wValue;
          if (descs && str_idx < descs->strs_len) {
            *response_data = descs->strs[str_idx].str;
            *response_length = descs->strs[str_idx].len;
            return true;
          }
          if (str_idx == 0) {
            *response_data = (char*)&default_lang_id[0];
            *response_length = default_lang_id[0];
            return true;
          }
          *response_data = (char*)&default_string[0];
          *response_length = default_string[0];
          return true;
        case USB_DT_BOS:
          *response_data = descs->bos;
          *response_length = descs->bos_len;
          return true;
        case USB_DT_DEVICE_QUALIFIER:
          *response_data = descs->qual;
          *response_length = descs->qual_len;
          return true;
        default:
          exit(1);
          return false;
        }
        break;
      default:
        exit(1);
        return false;
      }
      break;
    default:
      exit(1);
      return false;
    }
    return false;
  }
  
  static volatile long syz_usb_connect(volatile long a0, volatile long a1,
                                       volatile long a2, volatile long a3)
  {
    uint64_t speed = a0;
    uint64_t dev_len = a1;
    char* dev = (char*)a2;
    struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3;
    if (!dev) {
      return -1;
    }
    struct usb_device_index index;
    memset(&index, 0, sizeof(index));
    int rv = 0;
    rv = parse_usb_descriptor(dev, dev_len, &index);
    if (!rv) {
      return rv;
    }
    int fd = usb_fuzzer_open();
    if (fd < 0) {
      return fd;
    }
    char device[32];
    sprintf(&device[0], "dummy_udc.%llu", procid);
    rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]);
    if (rv < 0) {
      return rv;
    }
    rv = usb_fuzzer_run(fd);
    if (rv < 0) {
      return rv;
    }
    bool done = false;
    while (!done) {
      struct usb_fuzzer_control_event event;
      event.inner.type = 0;
      event.inner.length = sizeof(event.ctrl);
      rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
      if (rv < 0) {
        return rv;
      }
      if (event.inner.type != USB_FUZZER_EVENT_CONTROL)
        continue;
      bool response_found = false;
      char* response_data = NULL;
      uint32_t response_length = 0;
      if (event.ctrl.bRequestType & USB_DIR_IN) {
        response_found = lookup_connect_response(
            descs, &index, &event.ctrl, &response_data, &response_length);
        if (!response_found) {
          return -1;
        }
      } else {
        if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD ||
            event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) {
          exit(1);
          return -1;
        }
        done = true;
      }
      if (done) {
        rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower);
        if (rv < 0) {
          return rv;
        }
        rv = usb_fuzzer_configure(fd);
        if (rv < 0) {
          return rv;
        }
        unsigned ep;
        for (ep = 0; ep < index.ifaces[0].eps_num; ep++) {
          rv = usb_fuzzer_ep_enable(fd, index.ifaces[0].eps[ep]);
          if (rv < 0) {
          } else {
          }
        }
      }
      struct usb_fuzzer_ep_io_data response;
      response.inner.ep = 0;
      response.inner.flags = 0;
      if (response_length > sizeof(response.data))
        response_length = 0;
      if (event.ctrl.wLength < response_length)
        response_length = event.ctrl.wLength;
      response.inner.length = response_length;
      if (response_data)
        memcpy(&response.data[0], response_data, response_length);
      else
        memset(&response.data[0], 0, response_length);
      if (event.ctrl.bRequestType & USB_DIR_IN) {
        rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
      } else {
        rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
      }
      if (rv < 0) {
        return rv;
      }
    }
    sleep_ms(200);
    return fd;
  }
  
  struct vusb_descriptor {
    uint8_t req_type;
    uint8_t desc_type;
    uint32_t len;
    char data[0];
  } __attribute__((packed));
  
  struct vusb_descriptors {
    uint32_t len;
    struct vusb_descriptor* generic;
    struct vusb_descriptor* descs[0];
  } __attribute__((packed));
  
  struct vusb_response {
    uint8_t type;
    uint8_t req;
    uint32_t len;
    char data[0];
  } __attribute__((packed));
  
  struct vusb_responses {
    uint32_t len;
    struct vusb_response* generic;
    struct vusb_response* resps[0];
  } __attribute__((packed));
  
  static bool lookup_control_response(struct vusb_descriptors* descs,
                                      struct vusb_responses* resps,
                                      struct usb_ctrlrequest* ctrl,
                                      char** response_data,
                                      uint32_t* response_length)
  {
    int descs_num = 0;
    int resps_num = 0;
    if (descs)
      descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) /
                  sizeof(descs->descs[0]);
    if (resps)
      resps_num = (resps->len - offsetof(struct vusb_responses, resps)) /
                  sizeof(resps->resps[0]);
    uint8_t req = ctrl->bRequest;
    uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK;
    uint8_t desc_type = ctrl->wValue >> 8;
    if (req == USB_REQ_GET_DESCRIPTOR) {
      int i;
      for (i = 0; i < descs_num; i++) {
        struct vusb_descriptor* desc = descs->descs[i];
        if (!desc)
          continue;
        if (desc->req_type == req_type && desc->desc_type == desc_type) {
          *response_length = desc->len;
          if (*response_length != 0)
            *response_data = &desc->data[0];
          else
            *response_data = NULL;
          return true;
        }
      }
      if (descs && descs->generic) {
        *response_data = &descs->generic->data[0];
        *response_length = descs->generic->len;
        return true;
      }
    } else {
      int i;
      for (i = 0; i < resps_num; i++) {
        struct vusb_response* resp = resps->resps[i];
        if (!resp)
          continue;
        if (resp->type == req_type && resp->req == req) {
          *response_length = resp->len;
          if (*response_length != 0)
            *response_data = &resp->data[0];
          else
            *response_data = NULL;
          return true;
        }
      }
      if (resps && resps->generic) {
        *response_data = &resps->generic->data[0];
        *response_length = resps->generic->len;
        return true;
      }
    }
    return false;
  }
  
  static volatile long syz_usb_control_io(volatile long a0, volatile long a1,
                                          volatile long a2)
  {
    int fd = a0;
    struct vusb_descriptors* descs = (struct vusb_descriptors*)a1;
    struct vusb_responses* resps = (struct vusb_responses*)a2;
    struct usb_fuzzer_control_event event;
    event.inner.type = 0;
    event.inner.length = USB_MAX_PACKET_SIZE;
    int rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
    if (rv < 0) {
      return rv;
    }
    if (event.inner.type != USB_FUZZER_EVENT_CONTROL) {
      return -1;
    }
    bool response_found = false;
    char* response_data = NULL;
    uint32_t response_length = 0;
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      response_found = lookup_control_response(descs, resps, &event.ctrl,
                                               &response_data, &response_length);
      if (!response_found) {
        return -1;
      }
    } else {
      response_length = event.ctrl.wLength;
    }
    struct usb_fuzzer_ep_io_data response;
    response.inner.ep = 0;
    response.inner.flags = 0;
    if (response_length > sizeof(response.data))
      response_length = 0;
    if (event.ctrl.wLength < response_length)
      response_length = event.ctrl.wLength;
    response.inner.length = response_length;
    if (response_data)
      memcpy(&response.data[0], response_data, response_length);
    else
      memset(&response.data[0], 0, response_length);
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
    } else {
      rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
    }
    if (rv < 0) {
      return rv;
    }
    sleep_ms(200);
    return 0;
  }
  
  static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
  {
    if (a0 == 0xc || a0 == 0xb) {
      char buf[128];
      sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
              (uint8_t)a2);
      return open(buf, O_RDWR, 0);
    } else {
      char buf[1024];
      char* hash;
      strncpy(buf, (char*)a0, sizeof(buf) - 1);
      buf[sizeof(buf) - 1] = 0;
      while ((hash = strchr(buf, '#'))) {
        *hash = '0' + (char)(a1 % 10);
        a1 /= 10;
      }
      return open(buf, a2, 0);
    }
  }
  
  uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
  
  int main(void)
  {
    syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
    intptr_t res = 0;
    *(uint8_t*)0x20003e40 = 0x12;
    *(uint8_t*)0x20003e41 = 1;
    *(uint16_t*)0x20003e42 = 0;
    *(uint8_t*)0x20003e44 = 0;
    *(uint8_t*)0x20003e45 = 0;
    *(uint8_t*)0x20003e46 = 0;
    *(uint8_t*)0x20003e47 = 0x10;
    *(uint16_t*)0x20003e48 = 0xd8c;
    *(uint16_t*)0x20003e4a = 0x22;
    *(uint16_t*)0x20003e4c = 0;
    *(uint8_t*)0x20003e4e = 0;
    *(uint8_t*)0x20003e4f = 0;
    *(uint8_t*)0x20003e50 = 0;
    *(uint8_t*)0x20003e51 = 1;
    *(uint8_t*)0x20003e52 = 9;
    *(uint8_t*)0x20003e53 = 2;
    *(uint16_t*)0x20003e54 = 0x24;
    *(uint8_t*)0x20003e56 = 1;
    *(uint8_t*)0x20003e57 = 0;
    *(uint8_t*)0x20003e58 = 0;
    *(uint8_t*)0x20003e59 = 0;
    *(uint8_t*)0x20003e5a = 0;
    *(uint8_t*)0x20003e5b = 9;
    *(uint8_t*)0x20003e5c = 4;
    *(uint8_t*)0x20003e5d = 0;
    *(uint8_t*)0x20003e5e = 0;
    *(uint8_t*)0x20003e5f = 9;
    *(uint8_t*)0x20003e60 = 3;
    *(uint8_t*)0x20003e61 = 0;
    *(uint8_t*)0x20003e62 = 0;
    *(uint8_t*)0x20003e63 = 0;
    *(uint8_t*)0x20003e64 = 9;
    *(uint8_t*)0x20003e65 = 0x21;
    *(uint16_t*)0x20003e66 = 0;
    *(uint8_t*)0x20003e68 = 0;
    *(uint8_t*)0x20003e69 = 1;
    *(uint8_t*)0x20003e6a = 0x22;
    *(uint16_t*)0x20003e6b = 0x22;
    *(uint8_t*)0x20003e6d = 9;
    *(uint8_t*)0x20003e6e = 5;
    *(uint8_t*)0x20003e6f = 0x81;
    *(uint8_t*)0x20003e70 = 3;
    *(uint16_t*)0x20003e71 = 0;
    *(uint8_t*)0x20003e73 = 0;
    *(uint8_t*)0x20003e74 = 0;
    *(uint8_t*)0x20003e75 = 0;
    res = syz_usb_connect(0, 0x36, 0x20003e40, 0);
    if (res != -1)
      r[0] = res;
    syz_usb_control_io(r[0], 0, 0);
    *(uint32_t*)0x20000140 = 0x24;
    *(uint64_t*)0x20000144 = 0;
    *(uint64_t*)0x2000014c = 0;
    *(uint64_t*)0x20000154 = 0x200000c0;
    *(uint8_t*)0x200000c0 = 0;
    *(uint8_t*)0x200000c1 = 0x22;
    *(uint32_t*)0x200000c2 = 0x22;
    STORE_BY_BITMASK(uint8_t, , 0x200000c6, 0, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000c6, 0, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000c6, 0xb, 4, 4);
    memcpy((void*)0x200000c7, "]z", 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000c9, 3, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000c9, 2, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000c9, 0, 4, 4);
    memcpy((void*)0x200000ca, "\xc4\xeb\x48\xfd", 4);
    STORE_BY_BITMASK(uint8_t, , 0x200000ce, 2, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000ce, 2, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000ce, 0, 4, 4);
    memcpy((void*)0x200000cf, "\x8c\x93", 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d1, 3, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d1, 2, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d1, 0, 4, 4);
    memcpy((void*)0x200000d2, "\xaf\x9d\xb9\xb5", 4);
    STORE_BY_BITMASK(uint8_t, , 0x200000d6, 0, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d6, 2, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d6, 0, 4, 4);
    STORE_BY_BITMASK(uint8_t, , 0x200000d7, 3, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d7, 1, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000d7, 0, 4, 4);
    memcpy((void*)0x200000d8, "\xd9\xc6\x8a\x50", 4);
    STORE_BY_BITMASK(uint8_t, , 0x200000dc, 3, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000dc, 2, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000dc, 0, 4, 4);
    memcpy((void*)0x200000dd, "\x18\xc1\x18\x7b", 4);
    STORE_BY_BITMASK(uint8_t, , 0x200000e1, 3, 0, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000e1, 0, 2, 2);
    STORE_BY_BITMASK(uint8_t, , 0x200000e1, 0, 4, 4);
    memcpy((void*)0x200000e2, "\xaf\x64\x4c\x25", 4);
    *(uint64_t*)0x2000015c = 0;
    *(uint32_t*)0x20000380 = 0x26;
    *(uint64_t*)0x20000384 = 0;
    *(uint64_t*)0x2000038c = 0;
    *(uint64_t*)0x20000394 = 0;
    *(uint64_t*)0x2000039c = 0;
    *(uint64_t*)0x200003a4 = 0;
    syz_usb_control_io(r[0], 0x20000140, 0x20000380);
    memcpy((void*)0x200011c0, "/dev/usb/hiddev#\000", 17);
    res = syz_open_dev(0x200011c0, 0, 0);
    if (res != -1)
      r[1] = res;
    *(uint32_t*)0x20000080 = 3;
    *(uint32_t*)0x20000084 = 0x100;
    *(uint32_t*)0x20000088 = 9;
    syscall(__NR_ioctl, r[1], 0x400c4808, 0x20000080);
    return 0;
  }
  