Code:
$ kextstat |grep -v com.apple
Index Refs Address    Size       Wired      Name (Version) <Linked Against>
   97    0 0x15be000  0x5000     0x4000     com.hzsystems.driver.CDSDAudioCaptureSupport (1.5) <95 5 4 3 1>
  129    0 0x3644d000 0x4000     0x3000     com.sophos.kext.sav (7.3.0) <5 4 1>

Well i see Sophos is an early riser (and also mentioned in post #1).
I would say disabling AV until the current mystery is solved might be wise.
[we Macsters don't need it that badly.]

Interestingly enough, a google on your "com.hzsystems.driver" there finds a few threads about KPs.



Originally Posted By: ryck
is there a way to ask Terminal to come up with a log-in from another occasion?

The only thing along those lines i can think of is: sudo dmesg
...which gets us a look at some very early system messages.