DF-2898 baseline panics — stock kernel #0 (transcripts from serial console)

=== Boot A: sysent_edge stage 5 (libc syscall(SYS_syscall, 197, ...)) ===
(login: ... earlier console activity ...)
DOUBLE FAULT - KERNEL STACK GUARD HIT!

Fatal double fault
rip = 0xffffffff80bd7034          # symbolized: sys_xsyscall+0x84 (kernel #0)
rsp = 0xfffff80118335000          # kstack guard page (page-aligned)
rbp = 0xfffff80118335048
cpuid = 0; lapic id = 0
panic: double fault
cpuid = 0
Trace beginning at frame 0xffffffff818caec8
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
Debugger("panic")
CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=== Boot B: same call, fresh boot (vm.sh reset with-src first) ===
pid 875/885/895 (sysent_stage) exited on signal 12   # stages 1-3 SIGSYS children
DOUBLE FAULT - KERNEL STACK GUARD HIT!
rip = 0xffffffff80bd7034
rsp = 0xfffff801186b1000
rbp = 0xfffff801186b1048
cpuid = 0
panic: double fault
... (identical tail)

=== Boot C: probe 4 = libc syscall(SYS_syscall, 20), instrumented kernel #2 ===
(kernel #2 sys_xsyscall base 0xffffffff80bd7010; fault rip 0xffffffff80bd7094 = +0x84)
SYSE code=198 pid=892 tid=1 rsp=0xfffff8011804c968 pcb=0xfffff8011804cac0 kstack=0xfffff80118049000+16384
<interleaved> panic: double fault ... cpuid=5
Trace:
dblfault_handler() at dblfault_handler+0x10c
Debugger("panic")
db> ps  →  faulting thread = pid 830 (comm sysent_stage) on the boot-A crash,
           pid of probe (unprivileged user process) on boot C.

Entry geometry healthy on every traced indirect syscall (rsp≈pcb≈kstack top)
⇒ no stack-pointer leak; ~10.5KB consumed strictly inside the single
dispatch ⇒ recursion.  Direct-syscall control loops (5000× getpid,
3000× 7-arg mmap) never crash.