See below.  At least of the first of these lines does get reached with
(opte & PG_W) nonzero, once or twice per domain creation, and it won't
do what I assume was intended in that case (since -512 and -511 are
both true).  Unfortunately, this doesn't fix any of the bugs I was
hoping to find there.

diff -u -r1.8.2.3 pmap.c
--- sys/arch/xen/i386/pmap.c    6 Jun 2005 12:16:10 -0000       1.8.2.3
+++ sys/arch/xen/i386/pmap.c    21 Jul 2005 01:56:33 -0000
@@ -4223,7 +4223,7 @@
                 * change since we are replacing/changing a valid mapping.
                 * wired count might change...
                 */
-               pmap->pm_stats.wired_count += (1 - (opte & PG_W) ? 1 : 0);
+               pmap->pm_stats.wired_count += 1 - ((opte & PG_W) ? 1 : 0);
 
                //printf("pmap_remap_pages opte == pa");
                /* zap! */
@@ -4262,7 +4262,7 @@
                 * change since we are replacing/changing a valid mapping.
                 * wired count might change...
                 */
-               pmap->pm_stats.wired_count += (1 - (opte & PG_W) ? 1 : 0);
+               pmap->pm_stats.wired_count += 1 - ((opte & PG_W) ? 1 : 0);
 
                if (opte & PG_PVLIST) {
                        opte = xpmap_mtop(opte);
__END__

-- 
(let ((C call-with-current-continuation)) (apply (lambda (x y) (x y)) (map
((lambda (r) ((C C) (lambda (s) (r (lambda l (apply (s s) l))))))  (lambda
(f) (lambda (l) (if (null? l) C (lambda (k) (display (car l)) ((f (cdr l))
(C k)))))))    '((#\J #\d #\D #\v #\s) (#\e #\space #\a #\i #\newline)))))