Ah, this is very interesting.

I think there is actually only one case where what you say can happen
-- that being a fault causing a pagein over NFS.  In this case, the
process will do synchronous network I/O, which goes through the code
in uipc_socket.c that uses uiomove().

What's really interesting is that there are a lot of ports that do not
save the `onfault' handler -- including the i386.  I'm CCing this to
tech-kern so that other people know to fix their ports.