DF-5777 -- kernel panic evidence (VGA console screendump via QEMU monitor,
guest console switched to vidconsole for this run; see env.txt / VERDICT.md)

From vga_panic.png (DDB on sc0, immediately after `sysctl hw.nullsplash_fire=1`):

    kernel: type 12 trap, code=10
    CPU0 stopping CPUs: 0x0000003e
     stopped
    Stopped at      0:

    Fatal trap 12: page fault while in kernel mode
    cpuid = 0; lapic id = 0
    fault virtual address   = 0x0
    fault code              = supervisor read data, page not present
    instruction pointer     = 0x8:0xffffffff80bccb70
    stack pointer           = 0x10:0xfffff801181f7410
    frame pointer           = 0x10:0xfffff801181f7438
    code segment            = base 0x0, limit 0xffffff, type 0x1b
                             = DPL 0, pres 1, long 0, def32 0, gran 1
    processor eflags        = interrupt enabled, resume, IOPL = 0
    current process         = 988          <- the sysctl(8) caller
    current thread          = pri 6 (CRIT)
             kernel: type 12 trap, code=0
    db>

Key facts:
  * "Stopped at 0:" -- control transferred to address 0: the unguarded
    indirect call (*splash_decoder->splash)(adp, on) at splash.c:205 with
    ->splash == NULL.
  * fault virtual address = 0x0, supervisor read / instruction fetch at NULL.
  * Guest stopped answering ssh at the same moment (sysctl hung; session
    killed by timeout) -- kernel left in DDB on CPU0.
  * A second `trace` attempt at db> re-faulted on the NULL return address.