DF-5655 — baseline run (decisive)
============================================================
Rig: sh /tmp/vk_run.sh baseline 1   (driver in this pack)
     vkernel: /usr/obj/usr/src/sys/VKERNEL64/kernel.debug (stock)
     trigger: /bin/as_nobody /bin/vk_tls_noncanon 1  (in-vkernel uid 65534)

The vkernel console was tee'd onto the GUEST serial console so the trigger
marker and the resulting HOST panic appear in one transcript. The two
CPUs interleave their console writes, so two lines are split/mixed in the
raw capture (marked below, content unambiguous); the original capture is
preserved verbatim in panic.txt.

Serial console (guest boot.log), decisive segment:

  Mounting root from ufs:vkd0
  ...
  # /bin/as_nobody /bin/vk_tls_noncanon 1
  DF5655: uid=65534 gid= [65534] poisoning TLS which=1 base=0x0000800000000000 size=-1
  Fatal trap 9: general protection fault while in kernel mode
  cpuid = 2; lapic id = 2
  instruction pointer  = 0x8:0xffffffff80bd4c74
  stack pointer        = 0x10:0xfffff8011847d8e0
  frame pointer        = 0x10:0xfffff8011847d928
  code segment         = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 0, def32 0, gran 1
  processor eflags     = interrupt enabled, resume, IOPL = 0
  current process      = 8459          (the kernel.debug vkernel process)
  current thread       = pri 6 (CRIT)
  kernel: type 9 trap, code=0
  CPU2 stopping CPUs: 0x000b
   stopped
  Stopped at      set_user_TLS+0x94:      wrmsr
  db>

RIP 0xffffffff80bd4c74 == set_user_TLS+0x94 == the wrmsr preceded by
`mov $0xc0000102,%ecx` (MSR_KGSBASE) per objdump of /boot/kernel/kernel
(see env.txt) — i.e. pc64 tls.c:171 installing the emulated user's
GS base supplied by the vkernel's vframe. The MSR_FSBASE wrmsr at
+0x68 was skipped (fs untouched, gd_user_fs unchanged).

Post-trigger guest state: wedged in DDB; ssh dead; vm.sh status => down.
(An earlier baseline execution without console-tee panicked identically:
 RIP ffffffff80bd4c74, "current process = 13799", first run of the day.)