Thanks for confirmation. It's interesting that you could trigger the crash even without i915 driver. Maybe I didn't test long enough when I checked it. The stack trace without i915 looked similar with what I got, too (but from 6.9.x and i915 enabled). So, a crash pattern is a NULL dereference at the page allocation, mostly from get_page_from_freelist() or such lower layer via various code paths. Since it's happening with 6.9.x kernel, I suspect it's a recent upstream issue. FWIW, I tested SLE15-SP5 kernel on the same system, and it didn't lead to a crash. (Though, I tested only shortly, might need to run for longer time for verification.)