$ /tmp/bios_ss_null_deref_replica
[+] 4-byte revision probe at off=131062 succeeded (rev 2.1) -- kernel gates into get_ss_info_from_internal_ss_info_tbl_V2_1
[+] sizeof(ATOM_ASIC_INTERNAL_SS_INFO_V2)=16 > 10 bytes left -> kernel GET_IMAGE at :1041 returns NULL
[+] kernel takes the deref at bios_parser.c:1046 (header->sHeader.usStructureSize) -> NULL page -> panic
[*] entering replica of bios_parser.c:1041-1046 ...
rc2=139 (segv expected: 139=-SIGSEGV)
Segmentation fault (core dumped)

(the SIGSEGV is the replicated NULL load the kernel would take at
 bios_parser.c:1046; in-kernel this is the NULL page -> panic)