> So: am I completely wrong in my reading of the relevant source, or is
> NetBSD's xbd backend broken?

you're right.  our (netbsd's) backends are broken.

> And no, I don't see the point in scatter/gathering a single page of I/O
> into individual segments for each constituent sector, which is what it
> looks like the problematic guest is doing, but that doesn't change that
> the backend should answer it correctly.

besides that, xen_shm assumes an arbitrary request can be mapped into
a single contiguous virtual address range.  it's wrong.

YAMAMOTO Takashi