fix: lock crash report ring buffer (SMP race) and guard crashpad crash loop

kernel/src/Sched/CrashReport.hpp

@@ -39,12 +39,20 @@ struct Report {
     bool valid;
 };
 
-// Kernel-side ring buffer (written by exception handlers, read by SYS_CRASH_REPORT)
+// Kernel-side ring buffer (written by exception handlers, read by SYS_CRASH_REPORT).
+// All access is serialized by an internal interrupt-disabling spinlock: the
+// writer (AddReport) runs in exception/interrupt context and the reader
+// (TakeOldest) runs in syscall context, possibly on different CPUs.
 extern Report g_reports[MaxReports];
 extern int g_reportHead;
 extern int g_reportCount;
 
-// Add a report to the kernel ring buffer
+// Add a report to the kernel ring buffer (called from exception handlers).
 void AddReport(const Report& report);
 
+// Pop the oldest report into `out`. Returns the number of reports that were
+// present before this call (0 if the buffer was empty, in which case `out` is
+// left untouched). Safe against concurrent AddReport / TakeOldest.
+int TakeOldest(Report& out);
+
 } // namespace CrashReport