DF-3385 -- baseline (stock X86_64_GENERIC #0) kernel panic, first reproduction
==============================================================================

Captured from the QEMU serial console immediately after running
/root/hfsc_initvf_null as root (pf.ko loaded, altq ticket=1, hfsc
discipline + q_root(1Gbps) + curve-less q_mid + default q_leaf(10Mbps)
committed, DIOCSTARTALTQ, ping -c1 10.0.2.2):

    Fatal trap 12: page fault while in kernel mode
    cpuid = 2; lapic id = 2
    fault virtual address	= 0x0
    fault code		= supervisor read data, page not present
    instruction pointer	= 0x8:0xffffffff80720111
    stack pointer	        = 0x10:0xfffff8008d263710
    frame pointer	        = 0x10:0xfffff8008d263730
    code segment		= base 0x0, limit 0xfffff, type 0x1b
    			= DPL 0, pres 1, long 1, def32 0, gran 1
    processor eflags	= interrupt enabled, resume, IOPL = 0
    current process		= Idle
    current thread          = pri 12 (CRIT)
    kernel: type 12 trap, code=0

    CPU2 stopping CPUs: 0x0000003b
     stopped
    Stopped at      rtsc_min+0x11:  movq    (%rsi),%r12
    db>

Reading (%rsi) with %rsi == 0 is exactly isc->sm1 in rtsc_min()
(sys/net/altq/altq_hfsc.c:1578) with isc == cl->cl_fsc == NULL --
the first instruction of the function.  Guest dead in DDB.

Second baseline reproduction (fresh reset, same PoC):
    Fatal trap 12: page fault while in kernel mode
    cpuid = 0; lapic id = 0
    fault virtual address	= 0x0
    fault code		= supervisor read data, page not present
(saved from the serial console during the second pass; the ssh session
and the unflushed HAMMER2 log file died with the guest, as expected for
a panic this early in the transmit path.)

Patched kernel (X86_64_GENERIC #1, fix.diff applied): same PoC run
completes, kernel survives the packet, altq rolls back, network
recovers -- see run.fixed.log.