The 'pmap_emulate_reference' panic I had comes from: WARNING: pmap_emulate_reference(0xfffffe008a766400, 0xfffffe00935a6000, 0, 1): pa 0x4f14000 not managed Hey, guess what. The message buffer ain't mapped. So, probably uiomove is a bad thing to call for copying it out, eh?