xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP

The Xen Project reports:

VMX refuses attempts to enter a guest with an instruction pointer
which doesn’t satisfy certain requirements. In particular, the
instruction pointer needs to be canonical when entering a guest
currently in 64-bit mode. This is the case even if the VM entry
information specifies an exception to be injected immediately (in
which case the bad instruction pointer would possibly never get used
for other than pushing onto the exception handler’s stack).
Provided the guest OS allows user mode to map the virtual memory
space immediately below the canonical/non-canonical address
boundary, a non-canonical instruction pointer can result even from
normal user mode execution. VM entry failure, however, is fatal to
the guest.
Malicious HVM guest user mode code may be able to crash the
guest.