[yeah I know, I'm following up my own post...]

FWIW, I built a kernel with a copyin/copyout modified to save/restore
PCB_ONFAULT.

For the last 15 minutes, I've been thrashing the daylights out of this
Shark in a manner which would normally cause lots of SEGV's. I've seen not
a single one. :-)

Here's the diff:

Index: bcopyinout.S
===================================================================
RCS file: /cvsroot/src/sys/arch/arm32/arm32/bcopyinout.S,v
retrieving revision 1.14
diff -r1.14 bcopyinout.S
119c119
< 	stmfd	sp!, {r4}
---
> 	stmfd	sp!, {r4, r5}
127a128
> 	ldr	r5, [r4, #PCB_ONFAULT]
162,163c163,164
< 	str	r0, [r4, #PCB_ONFAULT]
< 	ldmfd	sp!, {r4}
---
> 	str	r5, [r4, #PCB_ONFAULT]
> 	ldmfd	sp!, {r4, r5}
168,170c169,170
< 	mov	r0, #0x00000000
< 	str	r0, [r4, #PCB_ONFAULT]
< 	ldmfd	sp!, {r4}
---
> 	str	r5, [r4, #PCB_ONFAULT]
> 	ldmfd	sp!, {r4, r5}