=== DF-0841 deterministic trace ===
bug site: sys/vfs/msdosfs/msdosfs_lookup.c:557
        error = msdosfs_lookup_checker(pmp, vdp, VTODE(*vpp), vpp);
where   *vpp == NULL  (set at msdosfs_lookup.c:148, never reassigned
                       in the ISDOTDOT branch — :543 assigns LOCAL tdp)

macro:   VTODE(vp) = ((struct denode *)(vp)->v_data)
         (sys/vfs/msdosfs/denode.h:223)

sizeof(vnode offset of v_data) = 0x128
VTODE(NULL) reads from address = 0x128
=> that address is inside the unmapped zero page on x86-64.
=> kernel-mode read of 0x128 => fatal page fault (trap 12) => panic.

sibling sites pass `tdp` (local denode*) instead of VTODE(*vpp):
  msdosfs_lookup.c:481  msdosfs_lookup_checker(pmp, vdp, tdp, vpp)   OK
  msdosfs_lookup.c:512  msdosfs_lookup_checker(pmp, vdp, tdp, vpp)   OK
  msdosfs_lookup.c:557  msdosfs_lookup_checker(pmp, vdp, VTODE(*vpp), vpp)  BUG
  msdosfs_lookup.c:574  msdosfs_lookup_checker(pmp, vdp, tdp, vpp)   OK
---msdosfs sanity (root-only, skipped for user)
TRACE_EXIT=0