Without any Ethernet drivers compiled into the kernel, it still gives me
the same page fault (This was captured with Ethernet drivers, but it
faults at a different address):

uvm_fault(0xc02b1060, 0xc7e7000, 0, 1) -> 1
(without the Ethernet drivers, it's: uvm_fault(0xc026fc00, 0xc7790000, 0,
1) -> 1)
kernel: page fault trap, code=0
Stopped in cu at pcmcia_ccr_read+0x1e: movb 0(%edx, %eax, 1), %al

(This was after closing the tty with ~. from cu.)

Here's what the backtrace shows:
pcmcia_ccr_read(c0566e00,c05024ac,c04fb880,c0570c00) at pcmcia_ccr_disable
pcmcia_intr_disestablish(c0566e00,c04fb880,c0570c00,c77d8014,c77dae18) at
pcmcia_intr_disestablish+0x93
com_pcmcia_disable(c0570c00,c77d8014,c0570c00,c7733360,c77dae2c) at
com_pcmcia_disable+0x1e
com_shutdown(c0570c00,3,0,c77dae70,c01712ee) at com_shutdown+0xd7
comclose(803,3,2000,c75aeb10,3) at comclose+0x7a
(and a bunch of other file/vnode related stuff)

Here's my kernel config:
#	$NetBSD: GENERIC_LAPTOP,v 1.2.2.2 2000/10/30 22:27:19 tv Exp $
#
#	GENERIC -- everything that's currently supported
#

include "arch/i386/conf/std.i386"

#ident 		"GENERIC-$Revision: 1.2.2.2 $"

maxusers	32		# estimated number of users

# CPU support.  At least one is REQUIRED.
options 	I686_CPU

# CPU-related options.
options 	VM86		# virtual 8086 emulation
options 	USER_LDT	# user-settable LDT; used by WINE
options 	DUMMY_NOPS

# Standard system options

options 	UCONSOLE	# users can use TIOCCONS (for xconsole)
options 	INSECURE	# disable kernel security levels
options 	NTP		# NTP phase/frequency locked loop
options 	KTRACE		# system call tracing via ktrace(1)
options 	SYSVMSG		# System V-like message queues
options 	SYSVSEM		# System V-like semaphores
options 	SYSVSHM		# System V-like memory sharing
options 	LKM		# loadable kernel modules

# Diagnostic/debugging support options
options 	DIAGNOSTIC	# cheap kernel consistency checks
options 	KMEMSTATS	# kernel memory statistics (vmstat -m)
options 	DDB		# in-kernel debugger
options 	DDB_HISTORY_SIZE=512	# enable history editing in DDB
makeoptions	DEBUG="-g" # Compile full symbol table

# Compatibility options
options 	COMPAT_NOMID	# compatibility with 386BSD, BSDI, NetBSD 0.8,
options 	COMPAT_09	# NetBSD 0.9,
options 	COMPAT_10	# NetBSD 1.0,
options 	COMPAT_11	# NetBSD 1.1,
options 	COMPAT_12	# NetBSD 1.2,
options 	COMPAT_13	# NetBSD 1.3,
options 	COMPAT_14	# NetBSD 1.4,
options 	COMPAT_43	# and 4.3BSD
options 	COMPAT_386BSD_MBRPART # recognize old partition ID

# File systems
file-system 	FFS		# UFS
file-system 	NFS		# Network File System client
file-system 	CD9660		# ISO 9660 + Rock Ridge file system
file-system 	MSDOSFS		# MS-DOS file system
file-system 	FDESC		# /dev/fd
file-system 	KERNFS		# /kern
file-system 	PROCFS		# /proc

# File system options
options 	FFS_EI		# FFS Endian Independent support
options 	SOFTDEP         # FFS soft updates support.

# Networking options
options 	INET		# IP + ICMP + TCP + UDP
options 	INET6		# IPV6
options 	PPP_BSDCOMP	# BSD-Compress compression support for PPP
options 	PPP_DEFLATE	# Deflate compression support for PPP
options 	PPP_FILTER	# Active filter support for PPP (requires bpf)
options 	PFIL_HOOKS	# pfil(9) packet filter hooks
options 	IPFILTER_LOG	# ipmon(8) log support

# These options enable verbose messages for several subsystems.
# Warning, these may compile large string tables into the kernel!
options 	MIIVERBOSE	# verbose PHY autoconfig messages
options 	PCIVERBOSE	# verbose PCI device autoconfig messages
options 	PCMCIAVERBOSE	# verbose PCMCIA configuration messages
options 	SCSIVERBOSE	# human readable SCSI error messages
options 	USBVERBOSE	# verbose USB device autoconfig messages

options 	NFS_BOOT_DHCP,NFS_BOOT_BOOTPARAM

#
# wscons options
#
# builtin terminal emulations
options 	WSEMUL_VT100		# VT100 / VT220 emulation
# different kernel output - see dev/wscons/wsdisplayvar.h
options 	WS_KERNEL_FG=WSCOL_GREEN
# compatibility to other console drivers
options 	WSDISPLAY_COMPAT_PCVT		# emulate some ioctls
options 	WSDISPLAY_COMPAT_SYSCONS	# emulate some ioctls
options 	WSDISPLAY_COMPAT_USL		# VT handling
options 	WSDISPLAY_COMPAT_RAWKBD		# can get raw scancodes
# use a large software cursor that doesn't blink
options 	PCDISPLAY_SOFTCURSOR

# Kernel root file system and dump configuration.
config		netbsd	root on ? type ?

#
# Device configuration
#

mainbus0 at root

apm0	at mainbus0			# Advanced power management


# Basic Bus Support

# PCI bus support
pci*	at mainbus? bus ?
pci*	at pchb? bus ?
pci*	at ppb? bus ?

# Configure PCI using BIOS information
options 	PCIBIOS			# PCI BIOS support
options 	PCIBIOSVERBOSE		# PCI BIOS verbose info
options 	PCIBIOS_ADDR_FIXUP	# fixup PCI I/O addresses
options 	PCIBIOS_BUS_FIXUP	# fixup PCI bus numbering
options 	PCIBIOS_INTR_FIXUP	# fixup PCI interrupt routing
options 	PCIBIOS_INTR_GUESS	# see pcibios(4)

# PCI bridges
pchb*	at pci? dev ? function ?	# PCI-Host bridges
pcib*	at pci? dev ? function ?	# PCI-ISA bridges
ppb*	at pci? dev ? function ?	# PCI-PCI bridges
# XXX 'puc's aren't really bridges, but there's no better place for them here
puc*	at pci? dev ? function ?	# PCI "universal" comm. cards

# ISA bus support
isa*	at mainbus?
isa*	at pcib?

# PCMCIA bus support
pcmcia*	at pcic? controller ? socket ?

# PCI PCMCIA controllers
pcic0	at pci? dev? function ?

# CardBus bridge support
cbb*		at pci? dev ? function ?
cardslot*	at cbb?	

# CardBus bus support
cardbus*	at cardslot?
pcmcia* 	at cardslot?

# Coprocessor Support

# Math Coprocessor support
npx0	at isa? port 0xf0 irq 13	# x86 math coprocessor


# Console Devices

# wscons
pckbc0		at isa?			# pc keyboard controller
pckbd*		at pckbc?		# PC keyboard
# "opms" should not be enabled together with "pms" or "pmsi"
pms*		at pckbc?		# PS/2 mouse for wsmouse
pmsi*		at pckbc?		# PS/2 "Intelli"mouse for wsmouse
vga0		at isa?
vga*		at pci? dev ? function ?
pcdisplay0	at isa?			# CGA, MDA, EGA, HGA
wsdisplay*	at vga? console ?
wsdisplay*	at pcdisplay? console ?
wskbd* 		at pckbd? console ?
wsmouse*	at pms? mux 0
wsmouse*	at pmsi? mux 0

pcppi0		at isa?
sysbeep0	at pcppi?

# Serial Devices

# PCI serial interfaces
com*	at puc? port ?			# 16x50s on "universal" comm boards

# PCMCIA serial interfaces
com*	at pcmcia? function ?		# Modems and serial cards

pcmcom*	at pcmcia? function ?		# PCMCIA multi-port serial cards
com*	at pcmcom? slave ?		# ...and the slave devices

# CardBus serial interfaces
com*	at cardbus? dev ? function ?	# Modems and serial cards

# ISA serial interfaces
com0	at isa? port 0x3f8 irq 4	# Standard PC serial ports
com1	at isa? port 0x2f8 irq 3
com2	at isa? port 0x3e8 irq 5

# Parallel Printer Interfaces

# ISA parallel printer interfaces
lpt0	at isa? port 0x378 irq 7	# standard PC parallel ports
lpt1	at isa? port 0x278
lpt2	at isa? port 0x3bc

# Hardware monitors 

# IDE and related devices
# PCI IDE controllers - see pciide(4) for supported hardware.
# The 0x0001 flag force the driver to use DMA, even if the driver doesn't know
# how to set up DMA modes for this chip. This may work, or may cause
# a machine hang with some controllers.
pciide* at pci? dev ? function ? flags 0x0000

# PCMCIA IDE controllers
wdc*	at pcmcia? function ?

# ISA ST506, ESDI, and IDE controllers
# Use flags 0x01 if you want to try to use 32bits data I/O (the driver will
# fall back to 16bits I/O if 32bits I/O are not functional).
# Some controllers pass the initial 32bit test, but will fail later.
wdc0	at isa? port 0x1f0 irq 14 flags 0x00
wdc1	at isa? port 0x170 irq 15 flags 0x00

# IDE drives
# Flags are used only with controllers that support DMA operations
# and mode settings (e.g. some pciide controllers)
# The lowest order four bits (rightmost digit) of the flags define the PIO
# mode to use, the next set of four bits the DMA mode and the third set the
# UltraDMA mode. For each set of four bits, the 3 lower bits define the mode
# to use, and the last bit must be 1 for this setting to be used.
# For DMA and UDMA, 0xf (1111) means 'disable'.
# 0x0fac means 'use PIO mode 4, DMA mode 2, disable UltraDMA'.
# (0xc=1100, 0xa=1010, 0xf=1111)
# 0x0000 means "use whatever the drive claims to support".
wd*	at wdc? channel ? drive ? flags 0x0000
wd*	at pciide? channel ? drive ? flags 0x0000

# ATAPI bus support
atapibus* at wdc? channel ?
atapibus* at pciide? channel ?

# ATAPI devices
# flags have the same meaning as for IDE drives.
cd*	at atapibus? drive ? flags 0x0000	# ATAPI CD-ROM drives
sd*	at atapibus? drive ? flags 0x0000	# ATAPI disk drives
uk*	at atapibus? drive ? flags 0x0000	# ATAPI unknown


# Miscellaneous mass storage devices

# ISA floppy
fdc0	at isa? port 0x3f0 irq 6 drq 2	# standard PC floppy controllers
fd*	at fdc? drive ?			# the drives themselves
# some machines need you to do this instead of fd*
#fd0	at fdc0 drive 0

# Network Interfaces

# PCMCIA network interfaces
awi*	at pcmcia? function ?		# BayStack 650/660 (802.11FH/DS)
cnw*	at pcmcia? function ?		# Xircom/Netwave AirSurfer
ep*	at pcmcia? function ?		# 3Com 3c589 and 3c562 Ethernet
mbe*	at pcmcia? function ?		# MB8696x based Ethernet
ne*	at pcmcia? function ?		# NE2000-compatible Ethernet
ray*	at pcmcia? function ?		# Raytheon Raylink (802.11)
sm*	at pcmcia? function ?		# Megahertz Ethernet
wi*	at pcmcia? function ?		# Lucent WaveLan IEEE (802.11)
xi*	at pcmcia? function ?		# Xircom CreditCard Ethernet

mhzc*	at pcmcia? function ?		# Megahertz Ethernet/Modem combo cards
com*	at mhzc?
sm*	at mhzc?

# CardBus network cards
ex*	at cardbus? dev ? function ?	# 3Com 3C575TX
fxp*	at cardbus? dev ? function ?	# Intel i8255x
rtk*	at cardbus? dev ? function ?	# Realtek 8129/8139
tlp*	at cardbus? dev ? function ?	# DECchip 21143

# MII/PHY support
dmphy*	at mii? phy ?			# Davicom DM9101 PHYs
exphy*	at mii? phy ?			# 3Com internal PHYs
icsphy*	at mii? phy ?			# Integrated Circuit Systems ICS1890
inphy*	at mii? phy ?			# Intel 82555 PHYs
iophy*	at mii? phy ?			# Intel 82553 PHYs
lxtphy*	at mii? phy ?			# Level One LXT-970 PHYs
nsphy*	at mii? phy ?			# NS83840 PHYs
nsphyter* at mii? phy ?			# NS83843 PHYs
qsphy*	at mii? phy ?			# Quality Semiconductor QS6612 PHYs
sqphy*	at mii? phy ?			# Seeq 80220/80221/80223 PHYs
tlphy*	at mii? phy ?			# ThunderLAN PHYs
tqphy*	at mii? phy ?			# TDK Semiconductor PHYs
ukphy*	at mii? phy ?			# generic unknown PHYs


# Pull in optional local configuration
include	"arch/i386/conf/GENERIC.local"


# Pseudo-Devices

# network pseudo-devices
pseudo-device	bpfilter	8	# Berkeley packet filter
pseudo-device	loop			# network loopback
pseudo-device	ppp		2	# Point-to-Point Protocol
pseudo-device	tun		2	# network tunneling over tty

# miscellaneous pseudo-devices
pseudo-device	pty		64	# pseudo-terminals
pseudo-device	rnd			# /dev/random and in-kernel generator

# mouse & keyboard multiplexor pseudo-devices
pseudo-device	wsmux		2

And here's my boot messages:
NetBSD 1.5 (DCARMICH) #0: Wed Jan  3 09:28:13 CST 2001
    root@dcarmich.xnet.com:/usr/src/sys/arch/i386/compile/DCARMICH
cpu0: Intel Pentium II (Deschutes) (686-class)
total memory = 97856 KB
avail memory = 88264 KB
using 1248 buffers containing 4992 KB of memory
BIOS32 rev. 0 found at 0xfdb80
PCI BIOS rev. 2.1 found at 0xfdba1
pcibios: config mechanism [1][x], special cycles [x][x], last bus 0
PCI IRQ Routing Table rev. 1.0 found at 0xf5640, size 128 bytes (6 entries)
PCI Interrupt Router at 000:07:0 (Intel 82371MX Mobile PCI I/O IDE Xcelerator (MPIIX))
pciintr_link_alloc: bus 0 device 7: link 0xfe invalid
pciintr_link_alloc: bus 0 device 7: link 0xff invalid
------------------------------------------
  device vendor product pin PIRQ IRQ stage
------------------------------------------
000:02:0 0x1002 0x4c50   A  0x00  10  0    already assigned
000:03:0 0x1180 0x0478   A  0x00  10  0    fixed up
000:03:1 0x1180 0x0478   B  0x01   5  0    fixed up
000:04:0 0x125d 0x1978   A  0x01   5  0    already assigned
000:07:2 0x8086 0x7112   D  0x03   9  1    fixed up
------------------------------------------
PCI bridge 0: primary 0, secondary 1, subordinate 1
PCI bridge 1: primary 0, secondary 2, subordinate 2
PCI bus #2 is the last bus
[System BIOS Setting]-----------------------
  device vendor product
  register space address    size
--------------------------------------------
000:00:0 0x8086 0x7192 
	10h mem  0xe0000000 0x10000000
		[OK]
000:02:0 0x1002 0x4c50 
	10h mem  0xfd000000 0x01000000
	14h port 0x0000ec00 0x00000100
	18h mem  0xfebff000 0x00001000
		[OK]
000:03:0 0x1180 0x0478 
	10h mem  0x00000000 0x00001000
		[NG]
000:03:1 0x1180 0x0478 
	10h mem  0x00000000 0x00001000
		[NG]
000:04:0 0x125d 0x1978 
	10h port 0x0000e800 0x00000100
		[OK]
000:07:0 0x8086 0x7110 
		[OK]
000:07:1 0x8086 0x7111 
	20h port 0x0000ffa0 0x00000010
		[OK]
000:07:2 0x8086 0x7112 
	20h port 0x0000ffe0 0x00000020
		[OK]
000:07:3 0x8086 0x7113 
		[OK]
--------------------------[  2 devices bogus]
 Physical memory end: 0x05fed000
 PCI memory mapped I/O space start: 0x06000000
[PCIBIOS fixup stage]-----------------------
  device vendor product
  register space address    size
--------------------------------------------
000:00:0 0x8086 0x7192 
	10h mem  0xe0000000 0x10000000
		[OK]
000:02:0 0x1002 0x4c50 
	10h mem  0xfd000000 0x01000000
	14h port 0x0000ec00 0x00000100
	18h mem  0xfebff000 0x00001000
		[OK]
000:03:0 0x1180 0x0478 
	10h mem  0x06000000 0x00001000
		[OK]
000:03:1 0x1180 0x0478 
	10h mem  0x06001000 0x00001000
		[OK]
000:04:0 0x125d 0x1978 
	10h port 0x0000e800 0x00000100
		[OK]
000:07:0 0x8086 0x7110 
		[OK]
000:07:1 0x8086 0x7111 
	20h port 0x0000ffa0 0x00000010
		[OK]
000:07:2 0x8086 0x7112 
	20h port 0x0000ffe0 0x00000020
		[OK]
000:07:3 0x8086 0x7113 
		[OK]
--------------------------[  0 devices bogus]
mainbus0 (root)
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled
pchb0 at pci0 dev 0 function 0
pchb0: Intel 82443BX Host Bridge/Controller (AGP disabled) (rev. 0x02)
vga1 at pci0 dev 2 function 0: ATI Technologies Mach64 LP (rev. 0xdc)
wsdisplay0 at vga1: console (80x25, vt100 emulation)
cbb0 at pci0 dev 3 function 0: Ricoh 5C478 PCI-CardBus bridge (rev. 0x02)
cbb1 at pci0 dev 3 function 1: Ricoh 5C478 PCI-CardBus bridge (rev. 0x02)
ESS Technology Inc Maestro 2E PCI Audio Accelerator (audio multimedia) at pci0 dev 4 function 0 not configured
pcib0 at pci0 dev 7 function 0
pcib0: Intel 82371AB PCI-to-ISA Bridge (PIIX4) (rev. 0x02)
pciide0 at pci0 dev 7 function 1: Intel 82371AB IDE controller (PIIX4) (rev. 0x01)
pciide0: bus-master DMA support present
pciide0: primary channel wired to compatibility mode
wd0 at pciide0 channel 0 drive 0: <HITACHI_DK237A-21>
wd0: drive supports 16-sector pio transfers, lba addressing
wd0: 2067 MB, 4200 cyl, 16 head, 63 sec, 512 bytes/sect x 4233600 sectors
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2
pciide0: primary channel interrupting at irq 14
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2 (using DMA data transfers)
pciide0: secondary channel wired to compatibility mode
atapibus0 at pciide0 channel 1
cd0 at atapibus0 drive 0: <TOSHIBA CD-ROM XM-1702B, \134377\134377\134377\134377, 1161> type 5 cdrom removable
cd0: 32-bit data port
cd0: drive supports PIO mode 4, DMA mode 2
pciide0: secondary channel interrupting at irq 15
cd0(pciide0:1:0): using PIO mode 4, DMA mode 2 (using DMA data transfers)
Intel 82371AB USB Host Controller (PIIX4) (USB serial bus, revision 0x01) at pci0 dev 7 function 2 not configured
Intel 82371AB Power Management Controller (PIIX4) (miscellaneous bridge, revision 0x02) at pci0 dev 7 function 3 not configured
cbb0: interrupting at irq 10
cbb0: cacheline 0x0 lattimer 0x20
cbb0: bhlc 0x821000 lscp 0x20010100
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 1 device 0 cacheline 0x0, lattimer 0x20
pcmcia0 at cardslot0
cbb1: interrupting at irq 5
cbb1: cacheline 0x0 lattimer 0x20
cbb1: bhlc 0x821000 lscp 0x20020200
cardslot1 at cbb1 slot 1 flags 0
cardbus1 at cardslot1: bus 2 device 0 cacheline 0x0, lattimer 0x20
pcmcia1 at cardslot1
isa0 at pcib0
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
lpt0 at isa0 port 0x378-0x37b irq 7
pcppi0 at isa0 port 0x61
sysbeep0 at pcppi0
npx0 at isa0 port 0xf0-0xff: using exception 16
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
apm0 at mainbus0: Power Management spec V1.2
biomask ef75 netmask ef75 ttymask fff7
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
wsdisplay0: screen 1 added (80x25, vt100 emulation)
wsdisplay0: screen 2 added (80x25, vt100 emulation)
wsdisplay0: screen 3 added (80x25, vt100 emulation)
wsdisplay0: screen 4 added (80x25, vt100 emulation)
wsmux1: connecting to wsdisplay0
pcmcia0: using CIS quirks for 3Com, Megahertz 3C3
pcmcia0: CIS version PCMCIA 2.0 or 2.1
pcmcia0: CIS info: 3Com, Megahertz 3C3FEM556C, A, 001
pcmcia0: Manufacturer code 0x101, product 0x556
pcmcia0: function 0: network adapter, ccr addr 1000 mask 267
pcmcia0: function 0, config table entry 7: I/O card; irq mask ffff; iomask 5, iospace 0-1f; io8 io16 irqlevel
pcmcia0: function 1: serial port, ccr addr 1100 mask 277
pcmcia0: function 1, config table entry 39: I/O card; irq mask ffff; iomask 3, iospace 0-7; io8 irqlevel
ep0 at pcmcia0 function 0: 3Com/Megahertz 3CCFEM556BI Ethernet/Modem
ep0: address 00:01:02:49:e0:8d, 64KB word-wide FIFO, 1:1 Rx:Tx split
tqphy0 at ep0 phy 0: 78Q2120 10/100 media interface, rev. 11
tqphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
com3 at pcmcia0 function 1: serial device
com3: ns16550a, working fifo

Is there any way to set the Ethernet portion of the card to one IRQ and
the modem to another to work around the interrupt sharing bug?