DF-3978 — QEMU `-d int,cpu_reset` exception-log excerpts (provenance inside)

==========================================================================
[1] Debug iteration 2 (COW-page fault era), log of the private TCG QEMU
    instance run of 2026-10-12 ~01:41.  First hard proof that `sysenter`
    entered CPL0 at the armed state: cpl=0, CS=0008 (armed SYSENTER_CS),
    RIP inside the payload page, RSP = armed SYSENTER_ESP.  The fault
    itself was a PoC bug of that iteration (kernel-mode write to the
    fork-COW'd payload page slot 0x40000f00), NOT the finding.
==========================================================================
7926321:329859: v=0e e=0003 i=0 cpl=0 IP=0008:0000000040000004 pc=0000000040000004 SP=0010:0000000050000800 CR2=0000000040000f00

==========================================================================
[2] Debug iteration 3 (instruction-emitter bug era), log of ~01:46.
    The pivot had already executed mov rax,cr0 (privileged, no fault),
    the CR0 store, the PPSLOT load, the ucred load, three stores and the
    first three iretq-frame pushes when a mis-encoded byte sequence
    faulted.  Register dump shows the exact sysenter entry state:
    RSP = armed SYSENTER_ESP (0x50000800), RAX = USTACK_TOP constant
    just moved, R11 = user RFLAGS, R12-R15 = user stack pointers.
==========================================================================
7555831:313586: v=0e e=0000 i=0 cpl=0 IP=0008:0000000040000062 pc=0000000040000062 SP=0010:00000000500007e8 CR2=000000000000002b
RAX=0000000050002000 RBX=0000000000000000 RCX=0000000000000000 RDX=0000000000000000
RSI=0000000000000000 RDI=0000000000000000 RBP=00000000000004c7 RSP=00000000500007e8
R8 =0000000000003834 R9 =64616f6c79617020 R10=0000000000000000 R11=0000000000000202
R12=00007fffffdfdaeb R13=000000000000236a R14=00007fffffdfd870 R15=0000000000000007

==========================================================================
[3] Final evidence run (successful uid0 chain), log of ~02:02 (same
    QEMU command line).  The successful pivot is EXCEPTION-FREE (clean
    ring-0 excursion + iretq return), so no cpl=0 lines exist for it;
    the only compat-stub exceptions are the two baseline #GP entries
    (clean host, SYSENTER_CS=0) from the baseline and arm stages:
==========================================================================
7044000:290060: v=0d e=0000 i=0 cpl=3 IP=001b:0000000040000300 pc=0000000040000300 SP=0023:00007fffffdfd738 env->regs[R_EAX]=0000000040000300
7084302:291892: v=0d e=0000 i=0 cpl=3 IP=001b:0000000040000300 pc=0000000040000300 SP=0023:00007fffffdfd4f8 env->regs[R_EAX]=0000000040000300

The full ~500-700 MB raw logs of iterations [1] and [2] were working
files and were discarded with the throwaway QEMU overlay after the lines
above were extracted verbatim (grep over the live log files); the log of
[3] was likewise discarded after extraction.  The decisive, durable
evidence of CPL0 execution is in run.log: cr0=0x80050033 (CR0 is not
readable at CPL3 and matches QEMU's own CR0 dumps in [1]/[2]) plus the
0x3978 marker written by the ring-0 payload, plus uid=0.