# DF-5358 baseline run — stock kernel #0 (Thu Jul 2 06:02:54 UTC 2026), root on QEMU guest
# Decisive run. Module proofs then /dev/kmem pread at the probed absent-PDPT KVA.
# Serial-console capture (identical content preserved in panic.txt).

$ cd /root/df5358 && kldload ./pmxtest.ko
KLDLOAD_RC=0
pmxtest: KvaStart=fffff80040000000 KvaEnd=ffffffffff1ff000 KvaSize=000007ffbf1ff000
pmxtest[1]: CONTROL pmap_kextract(&dummy=0xffffffff826002d8) = 0000000135ab1278 (mapped, sane)
pmxtest[2]: va=ffffffff82601000 while-mapped pa=0000000134641000
pmxtest[2]: PT-present/PTE-0: aligned   pmap_kextract(va)     = 0000000000000000
pmxtest[2]: PT-present/PTE-0: unaligned pmap_kextract(va+0x30) = 0000000000000030  <-- non-zero garbage (no PG_V check; aligned queries luck out: va&PAGE_MASK==0)
pmxtest[2]: restored + freed
pmxtest[3]: kernel_vm_end=fffff80118800000
pmxtest[3]: PML4[496] present, PDPT[5] ABSENT (0000000000000000) -> /dev/kmem test KVA fffff80140000000

$ ./pmx_user 0xfffff80140000000 8
pmx_user: pread(/dev/kmem, 8 bytes) at kva fffff80140000000 ...
(ssh session dies; guest enters DDB)

--- serial console (vm.sh log) ---
Fatal user address access from kernel mode from pmx_user at ffffffff80c0cdc6

Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0xffff80403e005000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80c0cdc6
stack pointer	        = 0x10:0xfffff8011865f700
frame pointer	        = 0x10:0xfffff8011865f728
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1016
kernel: type 12 trap, code=0

CPU3 stopping CPUs:  0x00000037
 stopped
Stopped at      pmap_kextract.part.23+0x16:     movq    (%rax,%rdx,1),%rdx
db>

# RESULT: reproduced — Fatal trap 12 at pmap_kextract+0x16 (the *vtopt(va) read),
# fault VA is the unmapped recursive-map PDE-slot address for KVA 0xfffff80140000000,
# triggered by an unprivileged-path panic from a root-held /dev/kmem fd. Guest DOWN.
# (Full serial capture: panic.txt)