https://outflux.net/blog/archives/2019/11/20/experimenting-with-clang-cfi-in-upstream-linux/
There seems to be some generated code that is being run at syscall entry that is not mapped. I suspect there is something still doing CFI checks on entry (and their resulting jump tables are missing), but I haven't found them yet. For now, disable KPTI under CFI (at run time, so test kernels can still boot with "pti" to enable it again).