--- a/sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c	2026-10-12 02:08:41.681489954 +0000
+++ b/sys/dev/virtual/nvmm/x86/nvmm_x86_svm.c	2026-10-12 02:10:29.884086876 +0000
@@ -2609,10 +2609,14 @@
 		return false;
 	}
 
-	/* Want nRIP. */
+	/* Want nRIP. -- DF3978-TEST-ONLY RELAXATION: QEMU-TCG does not
+	 * expose CPUID.8000000A:EDX.nrip-save, so the stock gate rejects
+	 * the emulator CPU before the vulnerable path can ever run.  This
+	 * is an init-time capability gate only; the vmload/misc_leave MSR
+	 * path under test is bit-identical.  Applied identically to the
+	 * baseline AND the fixed build (disclosed in VERDICT.md). */
 	if (!(descs.edx & CPUID_8_0A_EDX_NRIPS)) {
-		os_printf("nvmm: SVM-NRIPS not supported\n");
-		return false;
+		os_printf("nvmm: SVM-NRIPS not supported (DF3978-TEST: continuing)\n");
 	}
 
 	svm_decode_assist = (descs.edx & CPUID_8_0A_EDX_DecodeAssists) != 0;