panic: vm_fault: fault on stack guard, addr: 0xfffff8011826c000
vm_fault() at vm_fault+0x12eb
trap_pfault() at trap_pfault+0x9a
trap() at trap+0x17c
calltrap() at calltrap+0x9
tpm_tis12_write() at tpm_tis12_write+0x72     <- production walk
dfhw_go() at dfhw_go+0x182

Mode: fake TIS keeps TPM_STS_DATA_EXPECT asserted forever (walk mode);
production tpm_tis12_write(sc, buf, 0) walks `*p++` up the kernel stack
byte-by-byte (each byte written to the TPM DATA register) until the
read crosses the top of the thread kernel stack and hits the guard
page. Combined with the capture runs:

  cap=1024: consumed exactly 1024, last byte = 0xC3 (the buffer fill)
  cap=1536: consumed 1536, last byte = 0x00 (kernel stack past buffer)
  full path: write(fd, buf, 0) on a tpm_ops cdev -> production
  tpmwrite -> sc_start -> tpm_tis12_write(buf, 0): consumed 1536,
  write(2) returned EIO, guest alive.