I said:
> 1) aout_exec() seems to load files non-zero entry point at the wrong
>    address. A kernel with a_entry of 0x2e00 loads at address 0x2e00,
>    with its entry point at 0x5c00 !

Jason reported:
> If this were true, the i386 port wouldn't work.  But I'd need to look
> at the code again and get my head wrapped around it to figure out how
> to make your booter work.

	Basically, I do something this:

#define COUNT_KERNEL	(COUNT_ALL & ~COUNT_HDR)
#define LOAD_KERNEL	(LOAD_ALL & ~LOAD_HDR)
...
u_long	buff,
	kVec[MARK_MAX];
...
if ( loadfile("netbsd.aout", kVec, COUNT_KERNEL) == 1 )
    BootError();

buff = calloc(kVec[MARK_MAX], 1);
if ( ! buff )
    BootError();

kVec[MARK_START] = buff;

if ( loadfile("netbsd.aout", kVec, LOAD_KERNEL) == 1 )
    BootError();
...

	a_entry of netbsd.aout is 0x2e00. A dump of buff reveals the
first 0x2e12 bytes to be zero. MARK_ENTRY points to buff + 0x2e00.

-- 
| Nigel Pearson, nigel@ind.tansu.com.au | "Reality is that which,   |
|   Telstra NW-D, Sydney, Australia.    |  when you stop believing  |
| Office: 9206 3468    Fax:  9212 6329  |  in it, doesn't go away." |
| Mobile: 0408 664435  Home: 9792 6998  | Philip K. Dick - 'Valis.' |