I'm assuming this is because something needs paxctl +m. As a security measure netbsd as of -8 disallows WX mappings unless explicitly allowed via "paxctl +m" to a binary. As a quick check to see if that's the case, we can globally disable it (not recommended for general use): sysctl -w security.pax.mprotect.enabled=0