> Bingo. You need to figure why that address doesn't contain the right
> value. I'm not sure where it is, is it in the object code that was
> loaded? If so, maybe the address wasn't fixed up properly.

The address is inside of drv_data[], a big array of assembly which is
lifted from the Windows .sys file from the ndiscvt utility (to make
ndis_driver_data.h).  It's defined like so:

extern unsigned char drv_data[];

__asm__(".data");
__asm__(".globl  drv_data");
__asm__(".type   drv_data, @object");
__asm__(".size   drv_data, 369024");
__asm__("drv_data:");
__asm__(".byte 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00");
__asm__(".byte 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xB8, 0x00, 0x00, 0x00");
__asm__(".byte 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00");
... lots, lots, more ...


I just tried setting a breakpoint on the driver's attach function (the
first function that gets called, and the same value is there:

(gdb) target remote /dev/tty01
Remote debugging using /dev/tty01
breakpoint () at machine/cpufunc.h:283
283     }
(gdb) break ndis_attach_pci
Breakpoint 7 at 0xc06b85d6: file ../../../../dev/if_ndis/if_ndis_pci.c,
line 458.
(gdb) cont
Continuing.

Breakpoint 7, ndis_attach_pci (parent=0xc15a0800, self=0xc15ab000,
    aux=0xc0bd17f0) at ../../../../dev/if_ndis/if_ndis_pci.c:458
458             struct ndis_softc *sc = (struct ndis_softc*)self;
(gdb) x/16x 0xc0a5d548
0xc0a5d548 <drv_data+252668>:   0x00057fd4      0x00000000      0x00000000
     0x00000000
0xc0a5d558 <drv_data+252684>:   0x00000000      0x00000000      0x420c057d
     0x00000000
0xc0a5d568 <drv_data+252700>:   0x00000002      0x00000078      0x000551a0
     0x000551a0
0xc0a5d578 <drv_data+252716>:   0xffffffff      0x0000ffff      0x75736e55
     0x726f7070
(gdb)

So maybe this address dosen't appear to get fixed up at all, but maybe it
should.

Thanks again for your help :-)