dfx_pm_read (baseline harness kernel, /usr/obj/usr/src/sys/DFX2423/kernel.debug,
built 2026-10-19 11:11 from PRISTINE ahci_pm.c sha256 db2f5784...ac66):

  ffffffff80a800a0 <dfx_pm_read>:
  ...
  ffffffff80a800b8:	48 8b b7 a0 01 00 00 	mov    0x1a0(%rdi),%rsi     ; ap->ap_ata[15]
  ffffffff80a800bf:	e8 6c ff ff ff       	callq  ffffffff80a80030 <dfx_ahci_ata_get_xfer>
  ...
  ffffffff80a800cb:	48 8b 10             	mov    (%rax),%rdx          ; xa->fis  <-- NO NULL CHECK,
  ...                                                                       ; LOAD AT OFFSET 0 = fault VA 0x0
  ffffffff80a800dc:	c6 02 27             	movb   $0x27,(%rdx)         ; fis->type = ATA_FIS_TYPE_H2D
                                                                            ; (ahci_pm.c:978)
  ffffffff80a800df:	48 8b 10             	mov    (%rax),%rdx
  ffffffff80a800e2:	c6 42 01 8f          	movb   $0x8f,0x1(%rdx)       ; fis->flags (ahci_pm.c:979)
  ...

This is the exact instruction the phase-2 panic fired on:
  instruction pointer = 0x8:0xffffffff80a800cb   (dfx_pm_read+0x2b)
  fault virtual address = 0x0, supervisor read data, page not present

For comparison, the FIXED kernel (fix.diff applied, sha256 8a42cfdb...a987f)
compiles dfx_pm_read to:

  ffffffff80a8012d:	e8 6e ff ff ff       	callq  ffffffff80a800a0 <dfx_ahci_ata_get_xfer>
  ffffffff80a80132:	48 85 c0             	test   %rax,%rax            ; <-- the fix
  ffffffff80a80135:	0f 84 a5 00 00 00    	je     ffffffff80a801e0 <dfx_pm_read+0xd0>
  ffffffff80a8013b:	48 8b 10             	mov    (%rax),%rdx          ; deref only when non-NULL