Thanks to a reproducible bug report from Scott Ellis, I've
killed an evil bug in cg4.c - an uninitialized pointer.
In his kernel, it smashed a location in cfdata causing
later death in subr_autoconf.  Gotta love wild pointers...

Here is the fix: (wild pointer was: bt)

diff -r1.7 cg4.c
181c181
<       sc->sc_bt = (struct bt_regs *)
---
>       sc->sc_bt = bt = (volatile struct bt_regs *)