Even if tar (and pax, which I also tried) was to use stdio, this would not explain being bound by /system/ cpu time. It must be something in the kernel. Likely vnode/FFS, but maybe at a lower level (RAIDframe, scsipi, mfii), that's why I asked up to what level time spent in the kernel is attributed to the user process.