re: two wait object types, and the read validates itself

Re-extracting the same gdb capture per thread rather than by grep qualifies the
previous entry. Of eighteen threads whose frame 3 is XObject::Wait, eight have
[rbx] equal to the XEvent vtable plus sixteen, two equal to the XSemaphore
vtable plus sixteen, and eight hold a pointer into the mmap region that is not a
vtable at all. So the waits are on two distinct kernel types, XEvent and
XSemaphore, and the earlier claim that the object is an XEvent was right for the
majority but not the whole picture.

The eight non-vtable readings are the method checking itself rather than a
failure. A polymorphic object's first word is always a vtable pointer, so those
values are simply not this: rbx could not be restored for those frames and the
unwind returned whatever the register held. A reading counts only if [rbx] lands
in the binary's vtable range and resolves to a "vtable for" symbol; anything
else is discarded rather than interpreted. Ten of eighteen resolve and the rest
are honestly unknown.

That also settles the previous entry's worry that the 0x7ffc and 0x7ffd
addresses looked like stack. They are the shared mmap region, which holds thread
stacks and large allocations alike, so the vtable check rather than the address
range is what separates an object from a stack slot.

The follow-up run that would have added /proc/<pid>/maps classification and a
wider object dump never booted -- EMULATOR GONE at 0s, skip_intro exit 4 --
most likely a stale emulator or lockfile from the preceding gdb session, whose
process tree is parented differently and escaped the usual cleanup. So the map
classification, the multi-word object dump and the frozen-state capture are all
still unrun.

tools/re-capture/freeze_waitobj.sh

@@ -50,12 +50,18 @@ for line in txt.splitlines():
         print('thread %s' % cur)
         print('frame 3')
         print('info registers rbx')
-        print('x/1gx $rbx')
+        print('x/8gx $rbx')          # vtable, KernelState*, fields -- or saved regs
         cur=None
 print(r'echo === END OBJ ===\n')
 print('continue')
 PY
 sleep 12
+# Is $rbx in a STACK mapping or an anonymous/heap one? 0x7ffc.. is the shared
+# mmap region on x86-64: thread stacks live there, but so do large allocations,
+# so the address range alone cannot tell them apart. /proc/<pid>/maps can.
+epid=$(pgrep -x xenia_canary | head -1)
+[ -n "$epid" ] && cp "/proc/$epid/maps" /tmp/fz-maps.txt 2>/dev/null && \
+  echo "--- saved /proc/$epid/maps ($(wc -l < /tmp/fz-maps.txt) mappings)"
 screenshot /tmp/fz-screen.png >/dev/null 2>&1
 echo "--- screen at capture time:"
 python3 "$SD/screen_id.py" /tmp/fz-screen.png 2>/dev/null | head -2