I haven't really looked into this at all, but I did make an
interesting observation:

It seems that every time this happens, I get `Failed page fault in
kernel' syslogged.  This, combined with the *lack* of a
`[u]vm_fault...' message, should indicate that the SEGVs occur just
after a failed copyin/copyout operation.

I wonder if something is screwing up a TLB update...