> Is this on a sun4m or sun4c?  Could the rbtree code be interacting with 
> the sun4c "vm hole" in some unfortunate way?

This is a sun4m (Sparcstation 5). I haven't tried anything else yet.

In any case, if a virtual address in the "hole" were returned, something
else would snap; I wouldn't expect a failing assertion in uvm_map().

-pk