=== BASELINE (pristine stock kernel, fresh boot, DDB never entered) ===
--- trigger: sysctl -w debug.df_kfault=1 (live syscall context; instrumentation stand-in
    for panic()'s print_backtrace(6) [stock DDB_TRACE] / ddb trace)
--- full serial console tail (untrimmed):
DFTRACE: kfault: chain=0xfffff80116c07a80, frame1=0xfffff80116c07aa0, frame1->fp=0xffffdead00000000 (unmapped kernel VA); db_jmpbuf never set this boot
Trace beginning at frame 0xfffff80116c07a80
kprintf() at kprintf 0xffffffff8069d340 
kprintf() at kprintf 0xffffffff8069d340 
kprintf() at kprintf 0xffffffff8069d340 
Fatal user address access from kernel mode from sysctl at ffffffff80bccb70


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xffffdead00000008
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bccb70
stack pointer	        = 0x10:0xfffff8011805c640
frame pointer	        = 0x10:0xfffff8011805c668
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1136
current thread          = pri 6 
kernel: type 12 trap, code=0
DOUBLE FAULT

Fatal double fault
rip = 0xffffffff80bcb71f
rsp = 0x0
rbp = 0x0
cpuid = 2; lapic id = 2
panic: double fault
cpuid = 2
Trace beginning at frame 0xfffff80089605ec8
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c 
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c 
Debugger("panic")

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

(a second identical baseline crash occurred later the same session; its serial
 buffer was truncated by the subsequent QEMU restart — see VERDICT.md)