this conversation reminded me of a little piece of annoying behaviour under plan9. [please accept my apologies if you've seen this before - it didn't seem to get through last time]
here's a demonstration: cpu% pwd /usr/rog/c cpu% > /tmp/tst cpu% cp /bin/echo 8.out cpu% bind 8.out /tmp/tst cpu% /tmp/tst -z -z cpu% cp /bin/sed 8.out cpu% /tmp/tst -z tst 424799: suicide: sys: trap: fault write addr=0x24fffbde pc=0x00017e7c the problem seems to be that attachimage() relies on sysexec() giving it a Chan with a currently valid qid.version, but when the last component of the path is translated by a mount point, namec returns the qid in the mount table's Chan, which holds a stale version number, hence the old shared text segment incorrectly used. i can think of several ways of fixing it, but all of them either slow things down slightly, or increase complexity. (for instance, one doesn't really want to do a stat when the version returned from namec *is* current, which is almost all the time).