In uvm/sproc/x86/sproc_syscall.c:oskit_sproc_syscall_handler() /* Dispatch the system call */ error = (*func)(sthread, (void*)arg_kv, rval); Shouldn't this be error = (*func)(sthread, (void*)args, rval); Or maybe it doesn't matter - because it is a single linear address space (without LDTs) and kernel has access to all of it? --suresh