Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x40
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff809d9a7b
stack pointer	        = 0x10:0xfffff80118303618
frame pointer	        = 0x10:0xfffff80118303638
code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 906
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      prop_array_iterator+0x1b:       lock cmpxchgl   %edx,0x40(%rdi)
db>

---
Context from boot.log (preceding lines):
Sun Aug  9 00:01:31 UTC 2026
login: Device Mapper version 4.16.0 loaded
dm_target_error: Successfully initialized
dm_target_zero: Successfully initialized
Fatal user address access from kernel mode from dm_nulldata_dere at ffffffff809d9a7b

(then the Fatal trap 12 block above)

Analysis:
- Process 906 = dm_nulldata_deref (the PoC)
- Trap 12 = page fault in kernel mode
- fault VA = 0x40 = offsetof(struct prop_array, pa_rwlock) [NULL + 0x40]
- Stopped at prop_array_iterator+0x1b:  lock cmpxchgl %edx,0x40(%rdi)
  This is mtx_lock(&(pa->pa_rwlock)) with %rdi==0 (pa==NULL)
- Confirms: prop_dictionary_get(dm_dict, "cmd_data") returned NULL (key absent),
  prop_array_iterator(NULL) dereferenced it BEFORE the prop_object_is_array()
  guard could run (the rwlock take is the first stmt in prop_array_iterator).