Function kvm_absent 

pub fn kvm_absent(open: Result<(), i32>) -> bool

KVM is absent when /dev/kvm does not exist. That is proof on its own: a CPU that advertises vmx or svm still cannot run a KVM guest without the device (an RE worker or a container shows exactly that shape). Any other failure to open it – a permissions or sandbox refusal – is doubt about the probe, not proof, so the capability stays present and the cell runs.