i'm sure i'm missing something obvious here, but exec has something like this
up->seg[ESEG] = newseg(SG_STACK, TSTKTOP-USTKSIZE, TSTKTOP/BY2PG); (some versions may not have /BY2PG, but that's beside the point.) what happens if there is already a segment at TSTKTOP-USTKSIZE that has been faulted in? i would think that argc, argv could end up in the wrong physical page. - erik