a pv chain was being traversed while interrupts were fully enabled in pmap_remove_all ... this is bogus, and has been fixed in pmap.c. (sorry for adding the splimp)