> I'm not sure what runtime errors would cause the operating system to send a SIGKILL on its own.
This is typical for Posix:
This signal is usually generated only by explicit request. ....
The system will generate SIGKILL for a process itself under some unusual conditions where the program cannot possibly continue to run (even to run a signal handler).