diff --git a/src/ntfc/device/nuttx.py b/src/ntfc/device/nuttx.py
index a12cc94..6d40ef9 100644
--- a/src/ntfc/device/nuttx.py
+++ b/src/ntfc/device/nuttx.py
@@ -51,6 +51,13 @@ class DeviceNuttx(OSCommon):
             b"up_dump_register",
             b"dump_tasks",
         ],
+        # kernel-mode (CONFIG_BUILD_KERNEL) user task faults: the kernel
+        # kills the offending task and keeps running, so the console
+        # message is the only crash evidence
+        CrashType.SEGFAULT: [
+            b"Segmentation fault in",
+            b"PANIC: Unhandled user exception",
+        ],
     }
     _PANIC_CHAR = r"/"
 
diff --git a/tests/device/test_nuttx.py b/tests/device/test_nuttx.py
index dd90df5..0275236 100644
--- a/tests/device/test_nuttx.py
+++ b/tests/device/test_nuttx.py
@@ -43,6 +43,22 @@ def test_device_nuttx_init():
         assert CrashType.ASSERTION in sigs
         assert all(isinstance(v, list) for v in sigs.values())
 
+        # kernel-mode user task faults kill only the task; the console
+        # message is the only crash evidence
+        assert CrashType.SEGFAULT in sigs
+        assert b"Segmentation fault in" in sigs[CrashType.SEGFAULT]
+        assert b"PANIC: Unhandled user exception" in sigs[CrashType.SEGFAULT]
+
+        # real rv-virt knsh64 console output is classified as SEGFAULT
+        from ntfc.device.state import DeviceStateManager
+
+        mgr = DeviceStateManager(crash_signatures=sigs)
+        line = (
+            b"[    2.966000] riscv_fault_handler: "
+            b"Segmentation fault in getprime (PID 4: getprime)"
+        )
+        assert mgr._detect_crash_type(line) is CrashType.SEGFAULT
+
         config.kv_check.return_value = 0
         assert d.panic_char == ""
         config.kv_check.return_value = 1