OK, so I enabled SYSCALL_DEBUG in netbsd-1.5R (I had to fix arch/mips/mips/
syscall.c in order for it to work).

Here's the weird thing..  I can get to a shell now!  I see all the output
of syscalls, with no errors, and I can get to a shell in single-user mode
so far.  Why oh why would enabling SYSCALL_DEBUG get me any further?
Very strange.  I did an "ls", which worked fine, then I did a "netstat -rn"
which seems to have frozen...  So the machine did eventually hang, but I
could still get to DDB.  The last thing netstat did was call mprotect(),
but the return value was fine...

...
proc 13 (netstat): netbsd num 74 call: mprotect(0xc4719f78, 0x20002400, 0x20106300)
proc 13 (netstat): netbsd num 74 ret: err = 0, rv = 0x0,0x20002000

Then it froze.

I just booted a second time, and again I got the "Enter shell..." prompt,
but when I hit return, init forked and exec'd "sh", then sh froze.
So this isn't very consistent.  Here's that output...

proc 10 (init): netbsd num 59 call: execve(0xc4717f78, 0x7fffebe8, 0x100013e0)
proc 10 (sh): netbsd num 59 ret: err = -2, rv = 0x0,0x0
proc 10 (sh): netbsd num 20 call: getpid()
proc 10 (sh): netbsd num 20 ret: err = 0, rv = 0xa,0x1
proc 10 (sh): netbsd num 202 call: __sysctl(0xc4717f08, 0xa, 0x10009190, 0xa, 0x4a7df8, 0x100003ac)
proc 10 (sh): netbsd num 202 ret: err = 0, rv = 0x0,0x8
proc 10 (sh): netbsd num 58 call: readlink(0xc4717f78, 0xa, 0x0)
proc 10 (sh): netbsd num 58 ret: err = 2, rv = 0x2,0x1000
proc 10 (sh): netbsd num 197 call: mmap(0xc4717f08, 0xa, 0xffffffff, 0xffffffff, 0x4a7df8, 0x3, 0x7fffea30, 0x0)
proc 10 (sh): netbsd num 197 ret: err = 0, rv = 0x20000000,0x0
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0x1000968c
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0x1000968c
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0xfffff000
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0x1000b000
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0xfffff000
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0x1000c000
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0xfffff000
proc 10 (sh): netbsd num 25 call: geteuid()
proc 10 (sh): netbsd num 25 ret: err = 0, rv = 0x0,0x10009120
proc 10 (sh): netbsd num 54 call: ioctl(0xc4717f78, 0x1, 0x1000020d)
proc 10 (sh): netbsd num 54 ret: err = 0, rv = 0x0,0x2
proc 10 (sh): netbsd num 54 call: ioctl(0xc4717f78, 0x1, 0x1000020d)
proc 10 (sh): netbsd num 54 ret: err = 0, rv = 0x0,0x2
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x1, 0x7fffeaa0)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x0
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x2, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x2, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0xfffffffd
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x2, 0x2)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x2
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x2, 0x7fffeaa0)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x0
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0xfffffffd
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x3)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x7fffeaa0)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x0
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0xf, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0xfffffffd
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0xf, 0xf)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4000
proc 10 (sh): netbsd num 54 call: ioctl(0xc4717f78, 0x1, 0x1)
proc 10 (sh): netbsd num 54 ret: err = 0, rv = 0x0,0x1000a060
proc 10 (sh): netbsd num 81 call: getpgrp()
proc 10 (sh): netbsd num 81 ret: err = 0, rv = 0xa,0xa
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x1, 0x7fffeaa0)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x0
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x12, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0xfffffffd
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x12, 0x12)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x20000
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x7fffeaa0)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x0
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x3, 0x7fffeaa0)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x0
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x1, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x4
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x15, 0x1)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0xfffffffd
proc 10 (sh): netbsd num 291 call: __sigaction14(0xc4717f78, 0x15, 0x15)
proc 10 (sh): netbsd num 291 ret: err = 0, rv = 0x0,0x100000
proc 10 (sh): netbsd num 82 call: setpgid(0xc4717f78, 0x1)
proc 10 (sh): netbsd num 82 ret: err = 1, rv = 0x1,0x100000
proc 10 (sh): netbsd num 54 call: ioctl(0xc4717f78, 0x1, 0x1)
proc 10 (sh): netbsd num 54 ret: err = 0, rv = 0x0,0xffffffff
proc 10 (sh): netbsd num 5 call: open(0xc4717f78, 0x0, 0x1)
proc 10 (sh): netbsd num 5 ret: err = 0, rv = 0x3,0x1
proc 10 (sh): netbsd num 92 call: fcntl(0xc4717f78, 0x3, 0x1)
proc 10 (sh): netbsd num 92 ret: err = 0, rv = 0x0,0x1
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0x1000d000
proc 10 (sh): netbsd num 17 call: break(0xc4717f78)
proc 10 (sh): netbsd num 17 ret: err = 0, rv = 0x0,0xfffff000
proc 10 (sh): netbsd num 3 call: read(0xc4717f78, 0x0, 0x1000d000)
proc 10 (sh): netbsd num 3 ret: err = 0, rv = 0x62,0x1000c080
proc 10 (sh): netbsd num 3 call: read(0xc4717f78, 0x0, 0x1000d000)
proc 10 (sh): netbsd num 3 ret: err = 0, rv = 0x0,0x1000c080
proc 10 (sh): netbsd num 6 call: close(0xc4717f78)
proc 10 (sh): netbsd num 6 ret: err = 0, rv = 0x0,0x1f8
proc 10 (sh): netbsd num 5 call: open(0xc4717f78, 0x0, 0x1)
proc 10 (sh): netbsd num 5 ret: err = 0, rv = 0x3,0x1
proc 10 (sh): netbsd num 92 call: fcntl(0xc4717f78, 0x0, 0x1)
proc 10 (sh): netbsd num 92 ret: err = 0, rv = 0x0,0x1
proc 10 (sh): netbsd num 3 call: read(0xc4717f78, 0x0, 0x1000d000)
proc 10 (sh): netbsd num 3 ret: err = 0, rv = 0x1ee,0x1000c080

I'll continue this after some sleep.  Comments are welcome!

-Mark