ddb under NetBSD/sparc (on an IPX) doesn't appear to be very useful
right now; as soon as a breakpoint is triggered, if I use "s" or "c"
or "n", I get a panic.  So I wasn't able to step through any
functions.

Nevertheless, I was able to narrow down the alignment faults under
Solaris emulation to fcntl(), as demonstrated by the following short C
program, linked statically:

	#include <sys/types.h>
	#include <sys/stat.h>
	#include <fcntl.h>
	#include <unistd.h>

	int main()
	{
	    int fd;

	    fd = open(".", O_RDONLY|O_NDELAY, 0755);
	    if (fd)
		fcntl(fd, F_SETFD, FD_CLOEXEC);
	    _exit(0);
	}

(I've put a statically linked binary of this program up for FTP at
sipb.mit.edu:pub/ghudson/crash-sparc in case anyone who wants to look
at this doesn't have a convenient Solaris environment.)  Solaris truss
reports the following system calls when this program is run under
Solaris:

	execve("./a.out", 0xEFFFF950, 0xEFFFF958)  argc = 1
	open(".", O_RDONLY|O_NDELAY, 0755)              = 3
	fcntl(3, F_SETFD, 0x00000001)                   = 0
	_exit(0)

I know from setting breakpoints in ddb that this program gets as far
as svr4_fcntl().

I can't determine much more than this with what I know about the
source right now.