I think I have narrowed this down to the stack being overflown. I have taken the push/pop of %fs out, it shouldn't be needed anyway, but the real & correct solution might to save the registers on the stack in locore.s before calling this stuff.
Submitted by: HOSOKAWA Tatsumi