I compiled in debugging code this evening and here is the first trap

vm_fault(f86b3700, deadb000, 1, 0) -> 1
page fault trap in _sorflush + 0xf
movl 0xc(%esi),%ecx

the trace looked like this:

_sorflush(deadbeef, ...)
_unp_detach
_uipc_usrreq
_soclose
_soo_close
_closef
_fdrelease
_close
syscall() + 0x1f9
syscall number 6

-j