Anyone tried to boot NetBSD/arm32 on an NC?

Using the 1.4 release A7INST kernel, BtRiscBSD gets as far as:

1)    memcpy((char *)(bootconfig.kernvirtualbase + aout.a_text),
      (buffer + aout.a_text), (int)aout.a_data);
 
Replacing this by a for loop shows that it hangs when writing to somewhere
around offset 0xb2160 (offset varies slightly).

Using the A7000 kernel (non-inst) is different. A power-on gets as far
as the memcpy prior to 1) above:

2)    memcpy((char *)bootconfig.kernvirtualbase, buffer, (int)aout.a_text);

A subsequent Ctrl-Break will sometimes get it as far as either SVC32()
or entering the kernel. At which point it hangs again.

I've tried using my own homebrew kernel with the EtherN/I driver and with
all the SCSI and IDE drivers removed. That usually just resets when it
gets to point 2), but occasionally gets as far as trying to enter the
kernel.

The verbose output of the loader is shown below:

RiscBSD BootLoader 2.88 Aug 11 1999
Kernel: Boot:netbsd
Args: <BtRiscBSD$Dir>.BtRiscBSD Boot:netbsd root=/dev/md0a screenmode=X640 Y480 C256 F60 maxproc=64 verbose videodram=480K 
filesize = 001265fe
Kernel binary is ZMAGIC a.out format
a_text = 000fd000
a_data = 00010000
a_bss  = 00023cc4
a_syms = 00000000
snames = 00000000
main() = 000080b8
filesize = 001265fe
bootconfig.kernvirtualbase = f0000000
bootconfig.kernsize = 00134000
bootconfig.argvirtualbase = f013400
bootconfig.argsize = 00001000
bootconfig.scratchvirtualbase = f0135000
bootconfig.scratchsize = 0000c000
kernelsize = 00141000
display_start = 04f8a000
display_size = 00076000
physical dstart = 10000000
display log2bpp = 3
1 DRAM blocks, 0 VRAM blocks
DRAM bank 0a = 10000000 01000000
DRAM bank 0b = 00000000 00000000
DRAM bank 1a = 00000000 00000000
DRAM bank 1b = 00000000 00000000
VRAM bank 0  = 00000000 00000000
buffer = 021c37a4
physical = 10ebf000
bootconfig.kernphysicalbase = 10ebf000
bootconfig.argphysicalbase = 10ff3000
bootconfig.scratchphysicalbase = 10ff4000


-- 
Dr. Stephen Borrill