> It works like this: OBP loads the image and checks the header. If it
> sees an "Open Boot Client Program" magic number--which happens to be
> bit-identical to an a.out magic but IS NOT an a.out magic number;
> [...]
>  OBP pays no attention
> to the rest of the header, so effectively you have 28 bytes or seven
> instructions to play with.
> 

Ah good! My concern was that the OBP code would have a peek at "a_text",
"a_data" or whatever else is in the a.out (oops, OBCP) header..

-pk