> Hum
> could you try a netbsd-XEN3_U.gz from current instead ? There
> should be one in ftp://ftp.netbsd.org/pub/NetBSD-daily/current/

I couldn't find that directory. Instead, I downloaded
ftp://ftp.netbsd.org/pub/NetBSD-daily/HEAD/200604170000Z/i386/binary/kernel=
/netbsd-INSTALL_XENU.gz
but still no luck:

Using config file "./netbsd.cfg".
Started domain netbsd
[ Kernel symbol table missing! ]
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2=
006
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 3.99.18 (INSTALL_XEN3_U) #0: Mon Apr 17 08:22:55 UTC 2006
=09builds@b4.netbsd.org:/home/builds/ab/HEAD/i386/200604170000Z-obj/home/bu=
ilds/ab/HEAD/src/sys/arch/i386/compile/INSTALL_XEN3_U
total memory =3D 128 MB
avail memory =3D 118 MB
mainbus0 (root)
cpu0 at mainbus0: (uniprocessor)
cpu0: Intel Pentium II (Klamath) (686-class), 299.94 MHz, id 0x633
cpu0: features 80f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR>
cpu0: features 80f9ff<PGE,MCA,CMOV,MMX>
cpu0: I-cache 16 KB 32B/line 4-way, D-cache 16 KB 32B/line 4-way
cpu0: L2 cache 512 KB 32B/line 4-way
cpu0: ITLB 32 4 KB entries 4-way, 2 4 MB entries fully associative
cpu0: DTLB 64 4 KB entries 4-way, 8 4 MB entries 4-way
cpu0: 32 page colors
hypervisor0 at mainbus0
debug virtual interrupt using event channel 3
xenbus0 at hypervisor0: Xen Virtual Bus Interface
xenbus0: using event channel 1
xencons0 at hypervisor0: Xen Virtual Console Driver
xencons0: console major 143, unit 0
xencons0: using event channel 2
npx0 at hypervisor0: using exception 16
Xen clock: using event channel 4
get_tsc_offset_ns: tsc_delta=3D159778128 offset=3D532698719
get_tsc_offset_ns: tsc_delta=3D164904641 offset=3D549790463
get_tsc_offset_ns: tsc_delta=3D170526639 offset=3D568534150
get_tsc_offset_ns: tsc_delta=3D171460881 offset=3D571648903
get_tsc_offset_ns: tsc_delta=3D176559943 offset=3D588649126
raidattach: Asked for 8 units
Kernelized RAIDframe activated
get_tsc_offset_ns: tsc_delta=3D177563937 offset=3D591996433
get_tsc_offset_ns: tsc_delta=3D182592175 offset=3D608760529
md0: internal 5000 KB image area
get_tsc_offset_ns: tsc_delta=3D183617979 offset=3D612180549
get_tsc_offset_ns: tsc_delta=3D188671715 offset=3D629029656
get_tsc_offset_ns: tsc_delta=3D189550229 offset=3D631958613
get_tsc_offset_ns: tsc_delta=3D194527317 offset=3D648552176
get_tsc_offset_ns: tsc_delta=3D195652938 offset=3D652304985
get_tsc_offset_ns: tsc_delta=3D200779803 offset=3D669397903
panic: HYPERVISOR_mmu_update failed

Stopped in pid 0.1 (swapper) at 0xc021b0f7:     leave
db> trace
?(c0747d60,7ff0,0,c0792cec,c0227d0b) at 0xc021b0f7
?(c0256877,0,820ee63,8f486f0,c0792d58) at 0xc01d9298
?(0,c0792d24,c01a8802,1,1) at 0xc0227d0b
?(c0762da0,ca1bc000,820e000,7fad000,7) at 0xc022472b
?(c0762da0,ca1bc000,7fad000,7,37) at 0xc02248ff
?(c0743e20,ca1bc000,7,1,ca1cbef4) at 0xc019ecdc
?(c0743e20,ca1bc000,ca1c0000,3,0) at 0xc019edd4
?(c075fdc0,ca1cbef4,0,0,c01b3ade) at 0xc019f17e
?(c075fdc0,ca1c2d00,ca1bc000,0,0) at 0xc01c0752
?(c075fdc0,0,14,0,0) at 0xc01be16d
?(0,0,0,0,0) at 0xc01b3790

> If it works with current then it means it can be an issue with the
> pullup. This happens before any process is started, right ?

Yes. It seems the kernel panics before trying to exec init.

Any ideas?