Debugging 64-bit kernel crashes involving tst-fork1.

I did some analysis last night, results follow.

Problem:
tst-fork1 crashes the kernel.

Reproduces:
Always.

Prodcedure:
Given the lastest 2.6.20 form our shared tree and compiled for 64-bit,
I enabled slab debugging, and memory allocation debugging, and reran
tst-fork1-static against the kernel. This is a highly reliable test
that can crash your kernel.

Notice the "exited with preempt_count 1", what does that mean?
This time the kernel died in pa_memcpy.

Results:
     _______________________________
     < Your System ate a SPARC! Gah! >
      -------------------------------
             \   ^__^
              \  (xx)\_______
                 (__)\       )\/\
                  U  ||----w |
                     ||     ||
tst-fork1-stati (pid 1567): Protection id trap (code 27)

     YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00001000000001000001110100001111 Not tainted
r00-03  0000000008041d0f 000000004080c2f8 0000000040334bf4 00000000000aac8c
r04-07  00000000408aaf60 000000009b3d8848 000000009ad38378 000000009ad38350
r08-11  0000000000000000 000000004080ccf8 000000009ad38360 7fffffffffffffff
r12-15  0000000000000002 0000000000000007 00000000000a7dd0 0000000000000000
r16-19  00000000000a55d0 00000000c02008d4 00000000000103f8 0000000000000000
r20-23  000000009ad38000 00000000000aac8c 00000000000aac8c 000000009ad383b0
r24-27  0000000000000004 00000000000aac8c 000000009ad383b0 00000000408aaf60
r28-31  0000000000000000 000000009ad383b0 000000009ad38580 0000000000000004
sr00-03  00000000000e2800 00000000000e2800 0000000000000000 00000000000e2800
sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000

IASQ: 0000000000000000 0000000000000000 IAOQ: 0000000040334894 0000000040334898
 IIR: 0ec25033    ISR: 00000000000e2800  IOR: 00000000000aac8c
 CPU:        0   CR30: 000000009ad38000 CR31: 0000000040848000
 ORIG_R28: 00000000407f6c00
 IAOQ[0]: pa_memcpy+0x114/0x2d0
 IAOQ[1]: pa_memcpy+0x118/0x2d0
 RP(r2): copy_from_user+0x34/0x40
Backtrace:

note: tst-fork1-stati[1567] exited with preempt_count 1
      _______________________________
     < Your System ate a SPARC! Gah! >
      -------------------------------
             \   ^__^
              \  (xx)\_______
                 (__)\       )\/\
                  U  ||----w |
                     ||     ||
tst-fork1-stati (pid 1567): Protection id trap (code 27)
die_if_kernel() recursion detected.