include "arch/macppc/conf/GENERIC"

options         INSECURE
options         L2CR_CONFIG="(L2SIZ_512K|L2CLK_20|L2RAM_PIPELINE_BURST)"
options         SHMMAXPGS=2048

ld -N -Ttext 0x100000 -e __start -S -o netbsd ${SYSTEM_OBJ} ${EXTRA_OBJ} vers.o
text    data    bss     dec     hex     filename
4526544 68680   335256  4930480 4b3bb0  netbsd
576.522u 56.980s 10:38.43 99.2% 0+0k 5+6946io 18pf+0w
ttyp0:makoto@quick  9:18:14/040420(...compile/INSECURE-L2PB2-SHM)> 

0 > boot cd:,ofwboot.elf hd:10/netbsd.3 load-size=e7d4 adler32=89dfe1f5 

Loading ELF

>> NetBSD/macppc OpenFirmware Boot, Revision 1.5
>> (root@serv, Sun Jun 22 22:03:04 JST 2003)
4595224+335260 [228416+204409|
 DEFAULT CATCH!, code=300 at   %SRR0: 006007b0   %SRR1: 00083030 
 ok
0 > 

ofwboot.elf が kernel を読んでいる途中の 0x00600000 付近で .. でも、

0 > boot cd:,ofwboot.elf hd:10/netbsd

とした時には

>> NetBSD/macppc OpenFirmware Boot, Revision 1.5
>> (root@serv, Sun Jun 22 22:03:04 JST 2003)
4098024+266740 [205568+183116]=0x488b04
 start=0x100000
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 1.6ZG (INSECURE-ZS-L2PB2-SHM-PCI) #0: Sun Jan  4 09:15:20 JST 2004

となるのだが ..

○ 4098024+266740 [205568+183116]=0x488b04 
× 4595224+335260 [228416+204409|

4098024+266740+205568+183116 = 4753448
4595224+335260+228416+204409 = 5363309

5M を越えるとだめ ?

0 > setenv real-base F00000 

$SETENV: invalid number
 ok
0 > setenv real-base -100000  ok
0 > reset-all 
erasing fff06000 
flashing fff06000 
swapping blocks

応答なし。修復不能 for the time being ;-( 中にあるボタンは、リセットでなくて電源 OFF ?
電池と電源を抜いて 5 分放置も効果なし。