> 
> I haven't built a shark kernel since late October, so I'm not sure when 
> this problem was introduced, but with a -current kernel source supped this 
> morning, I get a boot-time panic right after the "cpu0 at mainbus..." 
> message.  Unfortunately the machine then starts to recursively panic so I 
> can't get into a debugger (I only got this much info by making panic put 
> the cpu into an infinite loop).  Anyway the first panic is:
> 
> cpu0 at mainbus ....
> Section fault in SVC mode
> [u]vm_fault (0xff0fe644, fffff000, 1, 0) -> 1
                 ^^^^^^^^

That should have read 0xf00fe644 (which puts the address after edata, but 
before the first public BSS symbol).  With some further sleuthing with 
objdump, this address seems to be the value of the first argument passed 
to uvm_map_setup when it is called from uvm_km_init.