I think I found a neat way to hang a process in exit.  This process
(dosemu) opens /proc/curproc/mem to rearrange its own memory address
space (gross, eh?)

Anyway, when it exits, it sits in thrd_sleep:
load: 0.16  cmd: dosstatic 232 [thrd_sleep] 8.90u 12.51s 0% 1024k

A stack trace from ddb is shown below.
(procfs_validfpregs is really procfs_rwmem; static symbols are not shown)
The vm_map was locked for write by vm_map_remove(), and now wants to be
locked for read by vm_map_lookup() inside procfs.

Presumably one solution is "don't do that";  I'd prefer an answer that
doesn't make me rewrite some of dosemu's code.

==John

bpendtsleep(f883e904,4,f819b65a,0) at bpendtsleep+0x1
_thread_sleep(f883e904,f883e904,0) at _thread_sleep+0x35
_lock_read(f883e904,1000,27f000,f883e900,27f000) at _lock_read+0x5d
_vm_map_lookup(f9e58d50,27f000,2,f9e58d4c,f9e58d48) at _vm_map_lookup+0x17
_procfs_validfpregs(f883e000,f9e58dd0,f9e58d88,f8135dd5,0) at _procfs_validfpre
gs+0xff
_procfs_domem(0,f883e000,f8811080,f9e58dd0,f9e58dd0) at _procfs_domem+0x15
_procfs_rw(f9e58dac,1,f9e58e58,1,1000) at _procfs_rw+0xad
_vnode_pager_uncache(f88213c0,f9e58e58,1,1,1) at _vnode_pager_uncache+0x241
_vm_allocate_with_pager(f882dda0,f9e58e58,1,1,f83022d0) at _vm_allocate_with_pa
ger+0x353
_vm_pager_put_pages(f882dda0,f9e58e58,1,1,f9e58e70) at _vm_pager_put_pages+0x2a

_vm_pager_put(f882dda0,f83022d0,1) at _vm_pager_put+0x14
_vm_object_page_clean(f8820880,0,0,1,1) at _vm_object_page_clean+0x189
_vm_object_terminate(f8820880,f882dda0,f8830fc0,f883e900,f9e58ec0) at _vm_objec
t_terminate+0x4f
_vm_object_deallocate(f8820880) at _vm_object_deallocate+0x65
_vm_map_entry_delete(f883e900,f8830fc0,f7bfe000,0,f883e900) at _vm_map_entry_de
lete+0x54
_vm_map_delete(f883e900,0,f7bfe000,f883e900,f883e000) at _vm_map_delete+0x104
_vm_map_remove(f883e900,0,f7bfe000) at _vm_map_remove+0x47
_exit1(f883e000,0,f9e58fa8,f81a9068,f883e000) at _exit1+0xe0
_sys_exit(f883e000,f9e58f88,f9e58f80,0,0) at _sys_exit+0x14
_syscall() at _syscall+0x258