# DF-3157 baseline kernel panic -- forged NFS fh (dirclust=0, dirofs=32),
# unprivileged RPC GETATTR, captured from serial console (vm.sh log).
# Reproduced 3/3 on stock kernel #0. Crash 3 capture also in panic_capture.txt.

=== crash 2 (fresh boot, single call) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0xfffff80054126000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80716b85
stack pointer	        = 0x10:0xfffff801166df2d0
frame pointer	        = 0x10:0xfffff801166df350
code segment		= base 0x0, limit 0xfffff, type = 0x1b
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 869
kernel: type 12 trap, code=0
CPU5 stopping CPUs: 0x0000001f
Stopped at      deget+0x2b5:    movq    (%rax),%rcx

=== crash 3 (fresh boot, single call; current process 919 = "nfsd: server") ===
Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0xfffff80056936000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80716b85
current process		= 919
kernel: type 12 trap, code=0
Stopped at      deget+0x2b5:    movq    (%rax),%rcx

# deget = 0xffffffff807168d0 (nm), so fault PC = deget+0x2b5.
# objdump around the PC (guest kernel.debug):
#   ffffffff80716b81: mov -0x50(%rbp),%rax      ; direntptr (from readep/bptoep)
#   ffffffff80716b85: movq (%rax),%rcx          ; <-- FAULT: DE_INTERNALIZE deName[0..7]
#   ffffffff80716b88: mov %rcx,0x58(%r14)       ; -> dep->de_Name
#   ... movzwl 0x8(%rax) / movzbl 0xa/0xb/0xc/0xd(%rax)  ; name/attrs/lcase/ctimetenth
# The faulting pointer is page-aligned and unmapped: the bptoep-computed
# direntry address (bp->b_data + (dirofs & 511)) points outside the buffer's
# mapped data.
#
# Related console artifact from the same forged-fh family (crash 1 session):
#   dscheck(vn0): b_bcount 1 is not on a sector boundary (ssize 512)