[feat] Kernel crash verification oracle — QEMU-based crash reproduction

[peaktwilight]

Context

Carlini has hundreds of unvalidated kernel crashes. A kernel oracle that can:

1. Parse the crash report
2. Boot a matching kernel in QEMU
3. Run the reproducer
4. Check if KASAN/crash output matches the original report
   ...would reduce validation from hours (manual) to minutes (automated).

What to build

• packages/core/src/triage/kernel-oracle.ts
• Follows existing oracle pattern (OracleResult interface)
• QEMU-based execution via Docker (reuses DockerExecutor pattern)
• Crash reproduction: compile reproducer, boot kernel, run, capture dmesg
• Matching: compare KASAN signatures, faulting function, crash type
• Severity classification: remote vs local, privilege boundary, heap vs stack

MVP scope

Start with a Docker container that has:

• Pre-built kernel with KASAN enabled
• QEMU + virtme for fast boot
• GCC for compiling C reproducers
• Script to run reproducer and capture output

none

[peaktwilight]

Implemented in 5899942. Kernel oracle with QEMU reproduction + static analysis fallback. Crash signature matching, 6-check consistency validation. 8 kernel-specific PoV judges.