--- a/sys/platform/pc64/x86_64/machdep.c	2026-10-09 11:24:27.632084964 +0000
+++ b/sys/platform/pc64/x86_64/machdep.c	2026-10-09 11:24:27.652084700 +0000
@@ -3153,6 +3153,18 @@
 		 * result in undefined behaviour and can lead to an unexpected
 		 * TRCTRAP.
 		 */
+
+		/*
+		 * Bits 63:32 of DR7 are architecturally reserved.  On Intel
+		 * CPUs (and unconditionally under KVM, where kvm_set_dr()
+		 * rejects them) a MOV to DR7 with any of these bits set raises
+		 * #GP(0).  pcb_dr7 is loaded by cpu_heavy_restore() during a
+		 * context switch, so storing an unvalidated value here would
+		 * fatal-trap the kernel mid-switch.  Reject it up front.
+		 */
+		if (dbregs->dr[7] & 0xFFFFFFFF00000000LU)
+			return (EINVAL);
+
 		/* JG this loop looks unreadable */
 		/* Check 4 2-bit fields for invalid patterns.
 		 * These fields are R/Wi, for i = 0..3