Tos is a clumsy hack. It refers to a structure stored at the top of the stack that is used to pass data between the kernel and user space without system calls. See /sys/include/tos.h.
When a Plan 9 binary first starts running, the system call return register (AX in this case) contains a pointer to the Tos structure. /sys/src/libc/386/main9.s saves that value in the global variable named _tos. It sounds like you are not setting AX correctly when you start the programs, so _tos is not initialized correctly. How do you plan to implement rfork(RFMEM|RFPROC), which must share the entire address space between the parent and child except for the stack segment? Russ