Or you could do binary-search on the size allocated for a miniroot,
   looking for a thresh-hold where things break; and then compare the
   program and section headers, on the broken and non-broken kernels,
   looking for inconsistencies.


it *isn't* sized related.  it's whether the miniroot is there or not.



i don't see anything wrong with the objdump output.  here's the parts
for reference.  broken kernel:


INSTALL/netbsd:     file format elf32-sparc
INSTALL/netbsd
architecture: sparc, flags 0x00000012:
EXEC_P, HAS_SYMS
start address 0xf0004000

Program Header:
    LOAD off    0x00000074 vaddr 0xf0004000 paddr 0xf0004000 align 2**3
         filesz 0x0010d604 memsz 0x0010d604 flags r-x
    LOAD off    0x0010d678 vaddr 0xf0121608 paddr 0xf0121608 align 2**8
         filesz 0x001b1104 memsz 0x001d52d8 flags rw-

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         000f5184  f0004000  f0004000  00000074  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .rodata       0001847c  f00f9188  f00f9188  000f51fc  2**3
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  2 .data         001b1104  f0121608  f0121608  0010d678  2**3
                  CONTENTS, ALLOC, LOAD, DATA
  3 .bss          00024150  f02d2800  f02d2800  002be800  2**8
                  ALLOC
  4 .comment      00004754  00000000  00000000  002be800  2**0
                  CONTENTS, READONLY


working kernel:

_goa_/netbsd:     file format elf32-sparc
_goa_/netbsd
architecture: sparc, flags 0x00000012:
EXEC_P, HAS_SYMS
start address 0xf0004000

Program Header:
    LOAD off    0x00000074 vaddr 0xf0004000 paddr 0xf0004000 align 2**3
         filesz 0x00139e35 memsz 0x00139e35 flags r-x
    LOAD off    0x00139eb0 vaddr 0xf014de38 paddr 0xf014de38 align 2**8
         filesz 0x0001547c memsz 0x000392a4 flags rw-

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         00120468  f0004000  f0004000  00000074  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .rodata       000199cd  f0124468  f0124468  001204dc  2**3
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  2 .data         0001547c  f014de38  f014de38  00139eb0  2**3
                  CONTENTS, ALLOC, LOAD, DATA
  3 .bss          00023d54  f0163300  f0163300  0014f400  2**8
                  ALLOC
  4 .comment      00004f10  00000000  00000000  0014f400  2**0
                  CONTENTS, READONLY