Here's last lines from OpenBSD 4.3 boot, with DEBUG_CIF enabled:
Booting cdrom:f/bsd 2590536@0x1000000of_client_interface: call-method 80aec8 ffe880f8 0 278748 1000000 call-method claim ([5] -- [2]) handle_calls return: 0 1000000 of_client_interface: call-method 80aec8 ffe88838 400000 278748 call-method claim ([4] -- [3]) handle_calls return: 0 0 400000 of_client_interface: call-method 80aed0 ffe880f8 ffffffffffffffff 278748 1000000 0 400000 call-method map ([7] -- [1]) handle_calls return: 0 of_client_interface: call-method 80aec8 ffe880f8 2000 4000 call-method claim ([4] -- [2]) handle_calls return: 0 2001e000 of_client_interface: call-method 80aec8 ffe88838 2000 4000 call-method claim ([4] -- [3]) handle_calls return: 0 0 1e000 of_client_interface: call-method 80aed0 ffe880f8 ffffffffffffffff 4000 2001e000 0 1e000 call-method map ([7] -- [1]) handle_calls return: 0 +3236576@0x1800000of_client_interface: call-method 80aec8 ffe880f8 0 400000 1800000 call-method claim ([5] -- [2]) handle_calls return: 0 1800000 of_client_interface: call-method 80aec8 ffe88838 400000 400000 call-method claim ([4] -- [3]) handle_calls return: 0 0 800000 ^ badness, mem_claim returns 0x800000 of_client_interface: call-method 80aed0 ffe880f8 ffffffffffffffff 400000 1800000 0 800000 call-method map ([7] -- [1]) handle_calls return: 0 Unhandled Exception 0x0000000000000010 PC = 0x0000000000803e20 NPC = 0x0000000000803e24 Stopping execution
The client executes near 0x800000. However, the ofmem_claim_phys() (called from mem_claim() in lib.c) will happily allocate and return that range. BSD loader then crashes because it tries to zero the BSS which will be at 0x800000 and zeroing reaches PC value.
Here's the loader code: http://www.openbsd.org/cgi-bin/cvsweb/src/sys/arch/sparc64/stand/ofwboot/elf...
Maybe some memory allocation method (FCode?) still does not use ofmem.