In Debugger Mode, breaking the debuggee and then reading registers (e.g. the
'r' command) could bugcheck the debuggee with DRIVER_IRQL_NOT_LESS_OR_EQUAL
(0xD1) at IRQL 0xff.
Root cause: DebuggerCommandReadRegisters() copies GUEST_REGS from
DbgState->Regs, but the per-core DbgState->Regs is only populated on the
event-triggered halt paths. A core halted via a manual break
(DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM) or via the NMI broadcast (KdHandleNmi)
never had DbgState->Regs set, so it was NULL and the GUEST_REGS memcpy
dereferenced address 0.
Fix:
- Add VmFuncGetGuestRegs(CoreId) returning g_GuestState[CoreId].Regs (the
guest GP registers saved on the last vm-exit).
- Populate DbgState->Regs from it on the two manual-halt entry points
(DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM and KdHandleNmi) so register reads on a
manually-halted core return the correct values.
- Add a defensive NULL check in DebuggerCommandReadRegisters().
