re: Reproducable kernel crash

> The VAX implementation of pmap_remove_all() merely returns 'false', 
> which seems a bit odd.

pmap_remove_all() is an optimisation.  it allows the pmap to
clear the entire thing via perhaps a single operation (eg,
demap the context/pcid/asid in the TLB), so that a (later)
loop that clears all pages individually can avoid doing this
multiple times .. perhaps many thousands of them.  see pmap(9):

bool pmap_remove_all(pmap_t pmap)
        This function is a hint to the pmap implementation that all
        entries in pmap will be removed before any more entries are
        entered.  Following this call, there will be pmap_remove()
        calls resulting in every mapping being removed, followed by
        either pmap_destroy() or pmap_update().  No other pmap
        interfaces which take pmap as an argument will be called
        during this process.  Other interfaces which might need to
        access pmap (such as pmap_page_protect()) are permitted
        during this process.