guest_uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 virtualization: QEMU/KVM (vm.sh: -enable-kvm -m 4096 -smp 6), host CPU vendor: GenuineIntel -> guest wrmsr executes natively; Intel raises #GP(0) on WRMSR FSBASE/GSBASE with non-canonical value (SDM Vol.3 17.17) kernel under test (baseline): stock snapshot kernel (clean sys/ tree), /boot/kernel/kernel panic RIP 0xffffffff80bd4c48 == set_user_TLS+0x68 == first wrmsr (mov $0xc0000100,%ecx; wrmsr) per objdump -d test user: nobody (uid 65534) via `su -m nobody -c ...` from root ssh syscalls: SYS_set_tls_area=472, SYS_get_tls_area=473 (sys/sys/syscall.h)