There's a chunk of memory in LSI pmon that is supposed to contain pointers to `system call' handlers. However, sim_open() will clobber the valid addresses it stores in this table with code bare code (as opposed to pointers to code) that was meant to catch invalid accesses. This is obviously wrong. I'm checking this in, since Frank Ch. Eigler and Eric Christopher agreed it was a reasonable thing to do. I'll leave the complete fix for someone who has a real understanding of what was supposed to be done there.