... and either no tape connected or Exa8200 not ready. I'd bet that this
worked at least until 1.2B, but 1.2C-E have this symptom. 

hp400# mt status
trap: bad kernel read access at 0x0
trap type 8, code = 0x402074d, v = 0x0
kernel program counter = 0xb9fb6
kernel: MMU fault trap
pid = 143, pc = 000B9FB6, ps = 2004, sfc = 0001, dfc = 0001
Registers:
             0        1        2        3        4        5        6        7
dreg: 00000000 0000008F 00000320 00000014 00001404 00000005 0000512E 00000002
areg: 00000000 02090500 0205AF80 00646E1C 000D8230 02090500 00646DBC FFEFF9D8

Kernel stack (00646C7C):
646C7C: 000C3A6C 00646CCC 00000080 00000320 00000014 00001404 00000005 0000512E
646C9C: 00000002 0205AF80 00646E1C 000D8230 02090500 00000000 00000000 00646DBC
646CBC: 000018BC 00000008 0402074D 00000000 00000000 0000008F 00000320 00000014
646CDC: 00001404 00000005 0000512E 00000002 00000000 02090500 0205AF80 00646E1C
646CFC: 000D8230 02090500 00646DBC FFEFF9D8 00000000 2004000B 9FB6B008 1EEE074D
646D1C: 4A8D670A 00000000 00000000 00000000 2A700C00 000B9FBE 000B9FBC 000B9FBA
646D3C: 00000000 0C00FF0C 000FF486 00000000 02001580 00003F3C 00000000 00200018
646D5C: 00000000 00000000 00000008 00000000 00000320 00000014 00001404 00000005
646D7C: 0000512E 00000002 0205AF80 00646E1C 000D8230 02090500 000375D2 02083C00
646D9C: 0000000C 00000001 02087800 00000000 00646F88 00000004 02087800 00000000
646DBC: 00646DF8 00041F56 00001404 00000001 00002000 02090500 00000001 02087800
646DDC: 00000000 00000000 0205AF80 02090500 000D3574 0205AF80 0205AF80 00646E90
646DFC: 0003D32C 00646E1C 00000000 00000001 00646F88 0208F280 02090500 02090700
646E1C: 000D313C 0205AF80 00000001 02087800 02090500 0001CE82 0208FE00 0000000C
646E3C: 0001CF00 0000010F 00000005 00000000 00000005 0000512E 00000002 00646F88
646E5C: 02090500 0000010F 00019B30 0208F280 00000024 00000024 00000026 00000000
panic: MMU fault
Stopped at      _Debugger+0x6:  unlk    a6
db> C 
No such command
db> trace
_Debugger(2004,646cb8,c3a8a,c3673,320) + 6
_panic(c3673,320,14,1404,5) + 40
_trap(8,402074d,0) + 232
faultstkadj(1404,1,2000,2090500) + 0
_spec_open(646e1c) + 13c
_vn_open(646ee4,1,8c0) + 31e
_sys_open(2090500,646f88,646f80) + 72
_syscall(5) + 10e
_trap0() + e

I tried to discover where i nsource this happens, and looks like that
something went wrong when spec_open jumps via cdevsw[] to the the proper
d_open function. Might it be that this value is somehow mangled ??

How do I activate DDB while using a serial console ?? How is the kernel
started with DDB, just boot netbsd -d ??

Not surprisingly, but once the tape is ready, everything is ok. If this is
unknown or not reproducible, let me know and I'll try to dig into it.

BTW: what is happening to the X11R6 server story? Again pending? There was
such a good start with Mike Smith's Frodo driver... ah time, where are you...

Michael