Additional DF-4012 panic captures from the verify session (all:
unprivileged uid=2 REG_MEM_READ at an offset past the mapped run, RIP
inside the production mps_user_reg_access inline in mps_ioctl_devsw;
console text captured via `vm.sh log`; the rolling serial log reset on
subsequent reboots, so these are assembled verbatim from the session's
console captures).

=== Capture 2: unmapped offset inside a published run (mid-scan) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xfffff8013224b490
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff826001a0 (compute_scan_range.constprop.2 -- rig-side pmap walk, fixed later)
...
=== Capture 3/4: page unmapped between check and read (churn race) ===
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
cpuid = 1
Trace beginning at frame 0xfffff8011910b1a8
vm_object_hold_shared() at vm_object_hold_shared+0x3f 0xffffffff809ab9bf
vm_fault() at vm_fault+0x408 0xffffffff8099e0b8
trap_pfault() at trap_pfault+0x9a 0xffffffff80bd52ca
trap() at trap+0x17c 0xffffffff80bd5bcc
calltrap() at calltrap+0x9 0xffffffff80b991fa
--- trap 000000000000000c, rip = ffffffff805b27ad, rsp = fffff8011910b5c0, rbp = fffff8011910b738 ---
mps_ioctl_devsw() at mps_ioctl_devsw+0x10dd 0xffffffff805b27ad   <-- the production REG_MEM_READ inline
dev_dioctl() at dev_dioctl+0x65 0xffffffff8062cdb5
Debugger("panic")
(observed 3x: 0xfffff80118a3f1a8 / 0xfffff801116fbc5c0 / 0xfffff8011910b5c0 frames)

=== Capture 1 (panic.txt): kstack guard page ===
panic: vm_fault: fault on stack guard, addr: 0xfffff80118f00000
--- trap 000000000000000c, rip = ffffffff805b27ad ---
mps_ioctl_devsw() at mps_ioctl_devsw+0x10dd 0xffffffff805b27ad

All four: a single unprivileged ioctl(MPTIOCTL_REG_ACCESS,
{REG_MEM_READ, RegOffset=X}) faulting inside the shipped kernel's
production accessor at bhandle+X -- deterministic operator-triggerable
kernel panic (the offsets that hit unmapped KVA are a strict superset
of what any rig-side safety check can predict).