npxprobemask() lacks the mxcsr_mask==0 fallback guard: a non-conforming FXSAVE probe zeroes npx_mxcsr_mask, forcing MXCSR=0 (all SIMD FP exceptions unmasked) and a SIGFPE on every FPU restore

Summary

The probe stores the raw FXSAVE mxcsr_mask word; Intel documents it may read 0 where software must use the 0xFFBF default (the FreeBSD heritage carries the fallback, DFly dropped it): every consumer test classifies all MXCSR bits illegal, the restore paths clear all six exception-mask bits, and SIGFPE fires on each first-use restore - userland SIMD effectively unusable on such CPUs/VMs. Conforming hardware (incl. the audit guest) unaffected; hardening with a one-line fix. Pass-2 weight: guest-verified negatives - cross-process marker leakage 0/48 across 40 sibling exits (whole-pcb fork copy), tail [832..1023] process-owned roundtrip 3x, exec npxinit reset.