[console capture, kernel #0, unprivileged uid 1001, /tmp/typeconfuse /boot true]
mode=true path=/boot pid=946

Fatal trap 9: general protection fault while in kernel mode
cpuid = 2; lapic id = 2
instruction pointer	= 0x8:0xffffffff8067102c
stack pointer	        = 0x10:0xfffff80117d3f768
frame pointer	        = 0x10:0xfffff80117d3f7c8
current process		= 946
current thread          = pri 6 (CRIT)
kernel: type 9 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      _mtx_lock_ex+0xdc:      movq    %r12,(%rax)
db>

[RIP disassembly (objdump /boot/kernel/kernel)]:
ffffffff80671014:  mov    0x8(%rax),%rcx     <- exlink walk read
ffffffff80671024:  mov    %r12,0x8(%rax)     <- link->next->prev = link (WRITE)
ffffffff8067102c:  mov    %r12,(%rax)        <- link->prev->next = link (WRITE, faulting)
=> the __mtx_lock_ex wait-queue enqueue writing a kernel stack pointer
   through mtx_exlink aliased onto non-array object memory.