Need help from a VAX abi expert (was: Reproducable kernel crash)

Hi folks,

new year, new try: I would love to get some help from someone who understands
the low level details of a VAX calls frame better than me:

https://mail-index.netbsd.org/port-vax/2024/02/29/msg004920.html

The problem: I would like to get rid of the superflous (and harmfull)
pmap_activate() call in vax/vm_machdep.c

https://nxr.netbsd.org/xref/src/sys/arch/vax/vax/vm_machdep.c#113


    107 	/*
    108 	 * Activate address space for the new process.	The PTEs have
    109 	 * already been allocated by way of pmap_create().
    110 	 * This writes the page table registers to the PCB.
    111 	 */
    112 	pcb2->pcb_pm = NULL;
->> 113 	pmap_activate(l2);
    114 
    115 	/* Mark guard page invalid in kernel stack */
    116 	kvtopte((uintptr_t)uv + REDZONEADDR)->pg_v = 0;
    117 
    118 	/*
    119 	 * Set up the calls frame above (below) the trapframe and populate
    120 	 * it with something good.  This is so that we can simulate that we
    121 	 * called cpu_lwp_bootstrap with a CALLS insn and it can return to
    122 	 * sret.
    123 	 */

Without that pmap_activate() the new lwp can not start (lwp_startup crashes
when jumping into it). My guess: the pmap_activate() hides something missing
from the cpu_lwp_bootstrap() setup.

Can you help spot what is missing there?

Thanks,

Martin