> Well SVR4 and Solaris drivers will call copyin() or copyout() (or
> some message pair if Streams drivers) to read/write a user buffer.

You can, of course, do that for additional data in NetBSD too. The common
code handling this only enforces a constraint on you when you want to use
a fixed size buffer bigger than 0x1fff bytes. (And, if you view this as a
constraint, in the actual encoding of the request parameter.)

In this case you will need to copyin/copyout the data yourself (without any
limitations) and mark it as "void" (to prevent the common code from trying
to handle the copin/copyout for you), or pass a struct with a pointer and
a length argument, and copyin/out via that pointer yourself (thus allowing
for variable length buffers).

In the far majority of cases (see the hundreds of ioctls defined and 
implemented in the NetBSD tree) this comes in very handy (and avoids code
duplication). And when it gets in the way you can workaround it without
significant costs.

Why you would want to enforce a specific encoding of the request parameter
is still beyound me. But maybe I misunderstood the original question.

Martin