The pagefaulting instruction is
0x80001255: 0f a9 popl %gs
At first I was thinking "it's just a pop; how in the world could the stack have gotten paged out!?" and "`qemu -d mem` says there aren't any mmu operations between the corresponding `pushl` and that popl".
But CR2=000004c0, and that neither looks like a stack address nor looks much like SP=0008:80064c08.
Ahh, GS is a register related to segmented memory; GS=04c7.
I don't want to learn segmented memory :(