In testing NetBSD-1.4 on the SHARK, it appears that code which does
this causes a panic:

static char *foo = 0L;

main(argc, argv, envp)
        int argc;
        char *argv[];
        char *envp[];
{
        foo = malloc(20480+2);
        memset(foo,'a',20481);
        foo[20481] = '\0';
        execve("/bin/sh", &foo, envp);
}


strangely, if I run that code by itself, it does not panic, only when
run as a part of the execve() tests.  I can't reproduce the problem on
NetBSD-1.4/x86.  The panic looks like this:

login: [u]vm_fault(0xf00fcbfc, f4000000, 3, 0) -> 1
Unhandled trap (frame = 0xf3734d80)
Data abort: 'Translation fault (section)' status=005 address=f4000050 PC=f00dbc2c
Stopped in stest at     _copyoutstr+0x8c:       str     r6, [r4, #0x0050]
db> t
_sys_execve(_sys_execve+0x10)
_syscall(_syscall+0x10)
db> 

Now whilst the test is incorrect, it shouldn't be panic'ing in this way.

If I do:
execve("/bin/sh", argv, &foo);
(test env. handling as opposed to argv) then it's ok.

Darren