> I guess something starts wrong when exception path re-enters kernel upon
> ast() condition meets prior to user return.  This seems to relate with one
> which you mentioned previously.

I added even more debug printf's. There is an ast(), but I don't
understand how this is able to drive us into trap() again.
Here is the precise code path:

mips3_UserGenException
  trap
    uvm_fault
      uvmfault_lookup
    trapsignal
      psignal1
  ast
    preempt
      mi_switch 
        ...

On each time we go through ast, we go into preempt() and mi_switch(),
but the offending process is always scheduled again, even if there are
other processes that should be run.

This explains the hang, but I still fail to understand why are we
looping on this fault forever. 

In the meantime, I was able to reproduce the bug with a native program
of a few lines. It's mips specific (at least macppc is not affected).
More to come in a PR :o)

-- 
Emmanuel Dreyfus.  
Avec Windows 3.1 ils etaient au bord du gouffre...
Avec Windows 95 ils ont fait un grand bon en avant.
manu@netbsd.org