Fatal user address access from kernel mode from ml2 at ffffffff809d7740

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809d7740
stack pointer	        = 0x10:0xfffff80117ea35f0
frame pointer	        = 0x10:0xfffff80117ea3648
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1041
kernel: type 12 trap, code = 0

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      strlen: cmpb    $0,(%rdi)
db>

# ------------------------------------------------------------------
# NOTE: this panic was produced by the FIRST attempt of the DF-2698 PoC,
# whose heap-spray helper called mountctl(2) with buflen == 0.  That is the
# already-known finding DF-2667 (vfs_flagstostr() strlens the NULL buffer
# before its degenerate-length guard, sys/kern/vfs_subr.c:1996 vs :2004) —
# captured here as independent live confirmation of DF-2667.  The DF-2698
# PoC was then fixed to never pass buflen == 0.  Serial console captured
# from the pre-reset boot (guest later reset with-src).