Kernel panic reproduced twice (two separate boots) by kldload of pqb_rig.ko.

=== Run 1 (guest boot 1, pre-reset, INVARIANTS kernel) ===
panic: vm_page_bits: illegal base/size 0/8192
cpuid = 1
Trace beginning at frame 0xfffff801185977a8
vm_page_bits() at vm_page_bits+0x46 0xffffffff809b5ae6 
vm_page_bits() at vm_page_bits+0x46 0xffffffff809b5ae6 
rig_loader() at rig_loader+0x38 0xffffffff82600038 
module_register_init() at module_register_init+0x49 0xffffffff806232e9 
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619 
linker_load_module() at linker_load_module+0x116 0xffffffff80625e16 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

=== Run 2 (fresh `vm.sh reset with-src` boot, clean guest) ===
login: panic: vm_page_bits: illegal base/size 0/8192
cpuid = 1
Trace beginning at frame 0xfffff801181587a8
vm_page_bits() at vm_page_bits+0x46 0xffffffff809b5ae6 
vm_page_bits() at vm_page_bits+0x46 0xffffffff809b5ae6 
rig_loader() at rig_loader+0x38 0xffffffff82600038 
module_register_init() at module_register_init+0x49 0xffffffff806232e9 
linker_load_file.part.3() at linker_load_file.part.3+0x1b9 0xffffffff80624619 
linker_load_module() at linker_load_module+0x116 0xffffffff80625e16 
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

Notes:
- The panic message echoes the rig's exact arguments (base=0, size=8192):
  proof that out-of-page arguments reach vm_page_bits() with no validation
  anywhere upstream (the rig calls the exported kernel function directly).
- The panic is the INVARIANTS KASSERT doing its job. On release/production
  kernels (no `options INVARIANTS`, sys/sys/systm.h:116-119) the KASSERT is
  a no-op and the same input computes `(2<<15)-(1<<0) = 0xFFFF` silently -
  see bitsarith.log for the exact arithmetic on the guest's own compiler.