The response to the ? packet is provided by rsp_report_exception (). This is always a S packet. The signal value (as a GDB target signal) is held in rsp.sigval, and is presented as two hexadecimal digits.