Serial console capture (vm.sh log) of the DF-5779 rig C panic.
Trigger: kldload seqputs_rigc.ko — module performs the EXACT seq_puts()
macro expansion of sys/dev/drm/include/linux/seq_file.h:44 with a dynamic
data string containing nine "%s" conversions and passes NO format args
(the Linux seq_puts contract has none):

    seq_puts(m, "m=%s s=%s x=%s y=%s z=%s w=%s v=%s u=%s t=%s\n");
      -> ksnprintf(m->buf, m->size, <that string as FORMAT>);

Result: kvcprintf's %s handler (sys/kern/subr_prf.c:750-755) pulls pointers
from vararg slots that were never set, and strlen() faults on a wild
pointer.

------------------------------------------------------------------------
seqputs_rigc: firing %s-walk on unset varargs...
Fatal user address access from kernel mode from kldload at ffffffff809d7740


Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x1a640
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809d7740
stack pointer	        = 0x10:0xfffff80118217570
frame pointer	        = 0x10:0xfffff80118217668
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1538
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      strlen: cmpb    $0,(%rdi)
db> 
------------------------------------------------------------------------
Guest state after: vm.sh status => down (panic). Reset via `vm.sh reset
with-src` before the fix-validation run.