Excerpts from netbsd: 20-May-98 Re: UVM/PMAP_NEW on i386 pa.. Stefan
Grefen@hprc.tande (2312)

> The problem is that if the pte page for an virtual address is not there, 
> the I386 copyout code traps trying to testb the pte for this va. 
> uvm can't page the pte page in and but because copyfault is set 
> copyout just returns EFAULT via copyfault instead of panicing on the kernel
> page-fault.

I've understood this too in the meantime. The patch I checked
in on Wednesday (locore 1.192, trap 1.113) addresses the same.
Perhaps in a more expensive way, but cleaner. (Your |=PSL_Z
depends a lot on a "testb" done in all copyout-like functions, so
it is really dangerous.)
Do you see performance differences?

best regards
Matthias