DF-5557 — vkernel npxprobemask() lacks the mxcsr_mask == 0 fallback guard (DF-5526 twin)

What

sys/platform/vkernel64/x86_64/npx.c:112-123:

void npxprobemask(void)
{
    /*64-Byte alignment required for xsave*/
    static union savefpu dummy __aligned(64);

    crit_enter();
    /*stop_emulating();*/
    fxsave(&dummy);
    npx_mxcsr_mask = ((uint32_t *)&dummy)[7];   /* <-- no zero check */
    /*stop_emulating();*/
    crit_exit();
}

The Intel SDM (and the FXSAVE "Denormals are Zero" applicability note) say the MXCSR_MASK field of the FXSAVE image (offset 28, i.e. ((uint32_t*)&dummy)[7]) may be reported as 0 by non-conforming implementations, in which case software must use the default mask 0xFFBF. pc64's twin (sys/platform/pc64/x86_64/npx.c:126-137) has the identical missing guard (filed this pass as DF-5526); the vkernel copy-paste never got it either (and additionally cannot load_cr4(CR4_OSFXSR) — harmless: the host OS always sets OSFXSR for 64-bit processes).

Effect if it fires

npx_mxcsr_mask = 0 makes every later MXCSR "illegal":

• npxpop() (npx.c:341-350) force-masks the restored MXCSR to 0 on every sigreturn, and npxdna() (npx.c:218-221) does the same on every FP restore — MXCSR=0 unmasks all six SIMD floating-point exceptions, so the first SSE instruction of the process raises SIGFPE;
• a rate-limited "illegal FP MXCSR" flood is printed for every restore.

Pure correctness/robustness (no memory-unsafety, no info leak, no privilege impact); reachable only on a CPU whose FXSAVE reports a zero MXCSR_MASK. Severity Info.

Why no PoC

Requires non-conforming hardware (FXSAVE image with MXCSR_MASK==0). The audit guest's FXSAVE reports a non-zero mask (verified: the vkernel boots and restores FPU state without the SIGFPE storm), so the condition cannot be triggered on the available rig. Code-divergence from the SDM recommendation is structural and certain; runtime behavior is untested.

Fix

Mirror the SDM-recommended fallback (pc64 twin should take the same fix, see DF-5526):

--- a/sys/platform/vkernel64/x86_64/npx.c
+++ b/sys/platform/vkernel64/x86_64/npx.c
@@ -117,11 +117,14 @@ void npxprobemask(void)
    crit_enter();
    /*stop_emulating();*/
    fxsave(&dummy);
-   npx_mxcsr_mask = ((uint32_t *)&dummy)[7];
+   npx_mxcsr_mask = ((uint32_t *)&dummy)[7];
+   if (npx_mxcsr_mask == 0)
+       npx_mxcsr_mask = 0xFFBF;
    /*stop_emulating();*/
    crit_exit();
 }