ld8 r21=[r21] // check VHPT tag
Are you sure you cannot enter a nested TLB miss fault here on IA64
implementations that do not have the VHPT walker implemented? You
wouldn't get fault 0x0000 since there is no walker that throws that
Er... I can't remember seeing anywhere that implementing the VHPT
walker in the CPU is optional. Anyhow, I'd imagine that the VHPT is
located in a place that is backed by a pinned TR. But I'm not really
familiar with FreeBSD internals, so...