| This is probably a feature of the new pmap code.  If a NULL pointer is
 | dereferenced from user code, you don't get a normal segfault, but
 | instead the kernel panics!
[...]
 | panic: kernel debugging assertion "((((int)va < 0) && (pmap == pmap_kernel())) || (((int)va > 0) && (pmap != pmap_kernel()))) && va != 0" failed: file "../../../../arch/sh3/sh3/pmap.c", line 876

I see. It should be "no mapping on va == 0". Trying to load va == 0 is
allowed, but not loaded and then not mapped.

__pmap_pte_load(pmap_t pmap, vaddr_t va, int flags)
{
	struct vm_page *pg;
	pt_entry_t *pte;
	pt_entry_t entry;
	int s;

	KDASSERT((((int)va < 0) && (pmap == pmap_kernel())) ||
	    (((int)va >= 0) && (pmap != pmap_kernel())));

	/* Lookup page table entry */
	if (((pte = __pmap_pte_lookup(pmap, va)) == NULL) ||
	    ((entry = *pte) == 0))
		return (FALSE);

	KDASSERT(va != 0);
---
UCHIYAMA Yasushi
uch@vnop.net