Crash in -current amd64 domU

[Jeff Rizzo <riz%tastylime.net@localhost>]

I believe this has been seen before, but I just got a crash in a fairly
-current amd64 domU while building NetBSD.

The only thing in the dom0 dmesg regarding this domain was this:
(XEN) domain.c:652:d40 Attempt to change CR4 flags 00002660 -> 00000620
(XEN) domain.c:652:d40 Attempt to change CR4 flags 00002660 -> 00000620
(XEN) domain.c:652:d40 Attempt to change CR4 flags 00002660 -> 00000620

Here's the uvm_fault, backtrace, and registers.  Let me know if I should
gather anything else.

evtchn_do_event: handler 0xffffffff80120b97 didn't lower ipl 8 7
evtchn_do_event: handler 0xffffffff80120b97 didn't lower ipl 8 7
uvm_fault(0xffffa0005330a5c8, 0x7fbfdfefe000, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff802e63ee cs e030 rflags 10202 cr2 
7fbfdfefeff8 c
pl 0 rsp ffffa000c381b870
db{0}> bt
pmap_enter_ma() at netbsd:pmap_enter_ma+0x23b
pmap_enter() at netbsd:pmap_enter+0x35
uvm_fault_internal() at netbsd:uvm_fault_internal+0xee5
trap() at netbsd:trap+0x4e9
--- trap (number 6) ---
7f7ff6cf8360:
db{0}> show reg
ds          58e8
es          b928
fs          b920
gs          10
rdi         ffffa000527e9298
rsi         ffffffffff000
rbp         ffffa000c381b960
rbx         7fbfdfefeff8
rdx         ffff800000000000
rcx         ffffffff806258e8    cpu_info_primary+0x84e8
rax         2db6f8
r8          0
r9          fbc2b000
r10         ffffa000527e9158
r11         ffffa000527e91a8
r12         2
r13         1fdff
r14         1
r15         3
rip         ffffffff802e63ee    pmap_enter_ma+0x23b
cs          e030
rflags      10202
rsp         ffffa000c381b870
ss          e02b
netbsd:pmap_enter_ma+0x23b:     movq    0(%rbx),%rax
db{0}>