DF-1096 / run_patched.log
OK: handler ran, FP instruction completed, no panic. This means the kernel took the FXRSTOR branch (cpu_xsave=0) and ignored the crafted XSAVE header. The bug is still present at npx.c:416-417 (header not validated); to demonstrate the panic the guest must run on an XSAVE-capable CPU. RUN_EXIT=0