> from pmap.c:
> #ifdef DIAGNOSTIC
>  if (*zero_ptr)
>   panic("pmap_zero_page_uncached: lock botch");
> #endif

uhh, at least in my copy, it's:

 if (*zero_pte)
  panic("pmap_zero_page: lock botch");

"pte" as in "page table entry"


> 
> If I'm wrong, please somebody correct me, but from what I understand
> this checks to see if the page was actually zero'd. If not (*zero_ptr is
> non-zero), then it panics. This doesn't get checked unless DIAGNOSTIC is
> defined.

This checks to see if another page-zero is already in progress or was
interrupted while in progress.

 *zero_pte = (pa & PG_FRAME) | PG_V | PG_RW; /* map in */
 memset(zerop, 0, NBPG);    /* zero */
 *zero_pte = 0;    /* zap! */

Hmm.  I wonder..

Could you change the panic code to:

 if (*zero_pte)
  panic("pmap_zero_page: lock botch, pte %x", *zero_pte);

Maybe the "dirty" and/or "referenced" bits of the pte will be set and
the rest will be zero..
      - Bill