arrrg... i found the problem... of course! Plan9 *does* restore/reload the
segment registers! It does it still in kernel mode. So if a segment
register is set (from usermode) with a selector pointing to my TLS
descriptor, and that descriptor gets changed to {0, 0} again, forkret()
restores/reloads the segment register and *kernel* gets a GP fault.

Now the selector checking in trap() makes sense... arrg >_<

sorry for the noise...