Which makes "why 2" a better story than I expected. 0F FF and 0F B9 were things people found in the field and named after the fact. ud2 is the first one designed, and having no operands is the whole design.

Use __builtin_trap(). Emerald Rapids, Linux 6.18, gcc 13.3; code in the post.

The bad window is length-1 positions wide in all four rows I measured. That agreement is most of why I trust the explanation rather than just the numbers.

ud2 has no ModRM, so its length is fixed the moment the second opcode byte decodes.

Those six extra bytes never get used. #UD fires before any operand is read. But the decoder still has to fetch them, because it can't know the instruction's length until it's read ModRM, and maybe SIB, and maybe the displacement.

Fetch faults, #PF wins, you get SIGSEGV.

Fully resident, all three raise SIGILL. That surprised me less than it should have - it's the thing that pins the failure to the fetch rather than to the instruction.

ud2 is 0F 0B. ud0 with a memory operand is 0F FF 84 24 + disp32, so eight bytes.

Setup: two adjacent pages, first one RX, second one PROT_NONE, instruction placed so its first two bytes are the last two bytes of the mapped page. Fork per case, read the signal from waitpid.

Control maps the second page executable so the same bytes run fully resident.