If I move the stage2 text address from 0x1000 to 0x2000 (see arch/x86/Makefile: -T 0x1000), I get past the problem. It's dying later but I think I know what that is. But what piece of code is trashing memory at 0x1000? Could it be VSA? If so, do we just go with moving the text address to 0x2000, instead of 0x1000? thanks ron