The per-CPU initialization code is copying in bogus data into
thread->tls_array. Note that it copies &per_cpu(cpu_gdt_table, cpu), not
&per_cpu(cpu_gdt_table, cpu)[GDT_ENTRY_TLS_MIN). That is totally broken
and unnecessary. Make the initialization explicitly NULL.