DF-4995 — crash signature (userland replica of the kernel fault shape)

The audit guest has no AMD GPU (env.txt: 0 PCI 0x1002 devices, no drm klds),
so the kernel-side fault cannot be triggered on this hardware. The replica
reproduces the exact kernel control flow instead:

  dal_irq_service_set(irq_service, DC_IRQ_SOURCE_DC1_VLINE0=84, true)
    -> find_irq_source_info: 84 < DAL_IRQ_SOURCES_NUMBER(90) and >= 0
       => returns &irq_source_info_dcn10[84]          (irq_service.c:82-85)
    -> dal_irq_service_set calls dal_irq_service_ack first
       (irq_service.c:116)
    -> dal_irq_service_ack: info->funcs->ack          (irq_service.c:152)
       with info->funcs == NULL (table slot 84 zero-initialized,
       irq_service_dcn10.c:245-331 has no designator past index 83)
    => load from (NULL + offsetof(struct irq_source_info_funcs, ack))
       = address 0x0/0x8

Replica output (deterministic, run.log + run.2.log):

  trigger: dal_irq_service_set(DC_IRQ_SOURCE_DC1_VLINE0=84)
     -> dal_irq_service_ack -> `info->funcs->ack` (irq_service.c:152) with funcs==NULL ...
  Segmentation fault (core dumped)
  EXIT=139

Kernel equivalent: data segment page fault on the NULL mapping in interrupt or
process context => kernel panic ("Fatal trap 12: page fault while in kernel
mode", fault address ~0x0). Ceiling: local DoS/panic; no write primitive, no
leak (see VERDICT.md — reachability is latent; no in-tree caller passes
84..89 on DCN10 today).