run2-sweep.serial.log — DF-5728 reproduction run 2 (fresh boot, stock kernel).
NOTE: the rig's chardev logfile (boot.sock.log) is rotated on every guest
boot, so the full run-2 console log was rotated away by the subsequent
control boot. This file preserves the verbatim decisive excerpt captured
during the run (guest /boot/kernel/kernel nm + objdump confirm symbols).
The driver sent "p " + '('*40 + '1' as the FIRST bomb of the session.

--- verbatim excerpt (console, CR stripped) ---
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> p ((((((((((((((((((((((((((((((((((((((((1
DOUBLE FAULT

Fatal double fault
rip = 0xffffffff802cba0c
rsp = 0xfffff80117e77000
rbp = 0xfffff80117e77008
cpuid = 3; lapic id = 3
panic: double fault
cpuid = 3
Trace beginning at frame 0xfffff80089631ec8
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
boot() called on cpu#3
Uptime: 21s
Physical memory: 4060 MB
Dumping 677 MB: 662 646 630 614 598 582 566 550 534 518 502 486 470 454 438 422 406 390 374 358 342 326 310 294 278 262 246 230 214 198 182 166 150 134 118 102 86 70 54 38 22
Dump complete
--- end excerpt ---

Symbol resolution (guest nm -n /boot/kernel/kernel):
  0xffffffff802cb9d0 T db_flush_lex
  0xffffffff802cba00 T db_force_whitespace   -> rip = db_force_whitespace+0xc
  rsp 0xfffff80117e77000 is page-aligned (kstack guard page)

Interpretation: at depth 40 the descent itself survived (10.9 KB), but the
unwind's db_error("Syntax error") -> db_printf -> db_force_whitespace at
full depth crossed the guard page -> #PF with rsp in guard -> #DF.
(cf. run 1, where rip=db_unary+0xc — pure descent — at depth 60.)