DF-4020 — kernel panic #2 (RUN 2, operator uid=2, REG_MEM_READ RegOffset=0x10000)
Verbatim serial-console transcript (vm.sh log) from the crashed guest, before
reset.  Address arithmetic checks out: the module printed its 64 KiB block at
0xfffff8011870a000; the faulting address is block + 0x10000 — exactly the
first offset past the block that the operator asked the driver to read.
panic.run1.txt holds panic #1 (RUN 1 probe, same trap, different placement:
"panic: vm_fault: fault on stack guard" + trap 000000000000000c at the same
dfmr_ioctl_devsw+0x3d).

Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0xfffff8011871a000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8262204d
stack pointer	        = 0x10:0xfffff801166df740
frame pointer          = 0x10:0xfffff801166df7a8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1140
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      dfmr_ioctl_devsw+0x3d:  movl    (%rdx),%edx
db>