DF-5306 panic capture - verbatim serial console (vm.sh log) from the
crashed run at 12:11 UTC (guest since reset; text preserved from the
session transcript of `dfbsd-qemu/vm.sh log 80`):

  HARNESS DF-5306: parse_ctrl ret=0 sc.data=0 (expected NULL)
  HARNESS DF-5306: calling real uvc_drv_init_video(sc, ctrl, NULL): expect NULL-deref panic at uvc_drv.c:1513 (data->num_altsetting)
  Fatal user address access from kernel mode from sysctl at ffffffff82605a1b


  Fatal trap 12: page fault while in kernel mode
  cpuid = 1; lapic id = 1
  fault virtual address	= 0xa
  fault code		= supervisor read data, page not present
  instruction pointer	= 0x8:0xffffffff82605a1b
  stack pointer	        = 0x10:0xfffff8011844f6d8
  frame pointer		= 0x10:0xfffff8011844f798
  code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
  processor eflags	= interrupt enabled, resume, IOPL = 0
  current process		= 1213
  current thread          = pri 6
  kernel: type 12 trap, code=0

  CPU1 stopping CPUs: 0x0000003d
   stopped
  Stopped at      sysctl_harness+0x30b:   cmpb    $0x1,0xa(%r9)
  db>

Decisive lines:
  - fault virtual address = 0xa     -> read at NULL + 0xa, exactly the
    offset of num_altsetting in struct uvc_drv_data
    (iface ptr 8B | iface_num | iface_index | num_altsetting @ +0xa)
  - Stopped at sysctl_harness+0x30b: cmpb $0x1,0xa(%r9)
    -> the inlined "data->num_altsetting > 1" test of
       uvc_drv_init_video() (uvc_drv.c:1513)
  - "parse_ctrl ret=0 sc.data=0" preceding it -> the real
    uvc_drv_parse_ctrl() accepted the crafted descriptors (bIfaceNums=0)
    and left sc->data NULL; attach would have continued into
    uvc_drv_init_video() exactly as analyzed.