vgsp-sema: capture the X DDX kick arm without a USERD and author its completion

The X server's class2d kick channel (bfef0002) has a 2-entry ring at a page
end (0x1203cfff0) and an FB userd offset the guest never writes; the pump's
USERD-miss path returned before the entry-0 arm decode, so the class2d
SET_NOTIFY target was never captured and every kick push had no address.
Decode the ring head directly when the USERD is missing (the ring PA still
resolves) and author the zeroed NvNotification at the captured target.

r1664: the first bfef0002 instance still missed, but the re-registered one
adopted its USERD on the PUT step (put 1 -> 2) at pa=0x10fecc000, decoded
its pushes at 0x1203c0000 (len 32/64, have_rel=1), and the notify2d writes
fire at va=0x12000d0b0. Xorg's spin moved off the control wait
(_nv015102rm 66 % -> 0) and now sits in _nv018351rm (30 %); GZDoom still
spins in glcore.

0 files changed, 0 insertions, 0 deletions