ROOT CAUSE: fexec_impl maps the 8 MB stack at STACK_TOP - STACK_SIZE =
0x7FFFFFF800000 (with STACK_TOP = 1 << 47 = 0x800000000000 on x86_64).
The update_min_mmap_addr closure computes (addr + size).next_multiple_of(PAGE_SIZE)
= 0x800000000000 as the new mmap_min. But 0x800000000000 is the FIRST
non-canonical address on x86-64 — the canonical lower half ends at
0x7FFFFFFFFFFF. With mmap_min = 0x800000000000, every subsequent anonymous
mmap fails because find_free_near can't find any hole at or above
0x800000000000.
This breaks ld.so's stage2 Tcb::new(0) call (8 KB anonymous mmap),
which uses .expect_notls() and panics → ud2. The init process crashes
before main() with 'Invalid opcode fault' at RIP 0x21cd1.
FIX: Add USER_CANONICAL_TOP_PAGE constant per architecture and cap
mmap_min_addr at that value. On x86_64/aarch64 this is 0x7FFFFFFFF000
(last page in the 48-bit canonical lower half). On riscv64-sv39 this
is (1 << 38) - 0x1000. On i686 this is (1 << 31) - 0x1000.
Red Bear OS
94646dee65