[OpenBIOS] Sparc64 memory allocation problem

[Blue Swirl]

Here's last lines from OpenBSD 4.3 boot, with DEBUG_CIF enabled:

Booting cdrom:f/bsd
2590536 at 0x1000000of_client_interface: call-method 80aec8 ffe880f8 0
278748 1000000
call-method claim ([5] -- [2])
handle_calls return: 0 1000000
of_client_interface: call-method 80aec8 ffe88838 400000 278748
call-method claim ([4] -- [3])
handle_calls return: 0 0 400000
of_client_interface: call-method 80aed0 ffe880f8 ffffffffffffffff
278748 1000000 0 400000
call-method map ([7] -- [1])
handle_calls return: 0
of_client_interface: call-method 80aec8 ffe880f8 2000 4000
call-method claim ([4] -- [2])
handle_calls return: 0 2001e000
of_client_interface: call-method 80aec8 ffe88838 2000 4000
call-method claim ([4] -- [3])
handle_calls return: 0 0 1e000
of_client_interface: call-method 80aed0 ffe880f8 ffffffffffffffff 4000
2001e000 0 1e000
call-method map ([7] -- [1])
handle_calls return: 0
+3236576 at 0x1800000of_client_interface: call-method 80aec8 ffe880f8 0
400000 1800000
call-method claim ([5] -- [2])
handle_calls return: 0 1800000
of_client_interface: call-method 80aec8 ffe88838 400000 400000
call-method claim ([4] -- [3])
handle_calls return: 0 0 800000
^ badness, mem_claim returns 0x800000
of_client_interface: call-method 80aed0 ffe880f8 ffffffffffffffff
400000 1800000 0 800000
call-method map ([7] -- [1])
handle_calls return: 0
Unhandled Exception 0x0000000000000010
PC = 0x0000000000803e20 NPC = 0x0000000000803e24
Stopping execution

The client executes near 0x800000. However, the ofmem_claim_phys()
(called from mem_claim() in lib.c) will happily allocate and return
that range. BSD loader then crashes because it tries to zero the BSS
which will be at 0x800000 and zeroing reaches PC value.

Here's the loader code:
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/arch/sparc64/stand/ofwboot/elf64_exec.c?rev=1.1

Maybe some memory allocation method (FCode?) still does not use ofmem.