ktlbmiss on the kernel stack. It was showing the temporary SP, not the original SP. Add a display of the first few wired entries of the TLB so when the ktblmiss occurs, the TLB entries mapping the kernel stack can be verified.