Fatal user address access from kernel mode from diag_lookup at ffffffff82609ab8

Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x58
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff82609ab8
stack pointer	        = 0x10:0xfffff801169fb4a8
frame pointer	        = 0x10:0xfffff801169fb4c8
code segment		= base 0x0, limit 0xffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 872 (diag_lookup)
current thread          = pri 6 (CRIT)
kernel: type 12 trap, code=2

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      smb_iod_request+0x58:   lock xaddl      %edx,0x58(%rbx)
db>

================================================================================
NOTE ON THIS PANIC:
This panic is a SEPARATE bug in the smb VC setup path (smb_iod_request called
with vc_iod==NULL during SMBIOC_LOOKUP -> smb_vc_connect), NOT the DF-0907
overflow. It fires identically for short (9-char) and long (80-char) usernames
and fires before smbfs_mount is ever reached. It is the environmental blocker
that prevents a live demonstration of the DF-0907 overflow on this guest.

The DF-0907 overflow itself is proven by:
  1. Source analysis (smbfs_vfsops.c:170-173, pe-pc-2 underflow)
  2. Disassembly of the shipping smbfs.ko (SIZE_MAX bound at smbfs_mount+0x251)
  3. The deterministic arithmetic harness (pe-pc-2 == -1 -> SIZE_MAX)