protection fault

[Ron Stanonik]

Our Vax 780 running 4.2bsd has been crashing serveral
times a week due to:
	trap type 9, code = 0, pc = 8000ac35
	panic: Protection fault
8000ac35 is the second byte of uiomove's register save mask.
The crash dump:
	sbr 8002dc64 slr 2fdc
	p0br 80544600 p0lr 80 p1br 7fd44a00 p1lr 1ffff2
	_boot()	from 800209f2
	_boot(0,0) from	800209f2
	_panic(8003c8ef) from 8000bfd6
	_trap()	from 80020f8c
	_Xtransflt(801dcab7,1,0,7fffff60) from 80001125
	_rwip(80386868,7fffff60,0) from	8000d17e
	_ino_rw(80393948,0,7fffff60) from 8000cd50
	_rwuio(7fffff60,0) from	8000c732
	_read()	from 8000c59b
	_syscall() from	8002129c
	_Xsyscall(5,7e5d,1) from 80001144
	?(5) from db
	?(7e5a)	from 8b
	?(0,7fffefd8,7fffefdc) from 302
	?(0) from 37
	_Syssize() from	7fffef70
	_Syssize() from	4c20319
	address	out of segment
seems to bear out that we're dying during the call to uiomove
(8000d17e is the next to last byte of 'calls $4, _uiomove').
The program which is almost always running during the crash is
innocuously (I think) reading through /etc/ttys.  Even more
puzzling, a second Vax running identical code except for the
disk driver, doesn't crash.  Maybe bad memory?  But it passes
diagnostics.  I'd appreciate any suggestions/straws/wild guesses.

Thanks,

Ron Stanonik
stanonik at nprdc.arpa