cr2 is where the pf address is, not cr3.

Copypaste bug.