Index: kern/kern_exit.c
===================================================================
RCS file: /usr/cvs/src/sys/kern/kern_exit.c,v
retrieving revision 1.263.2.5
diff -u -r1.263.2.5 kern_exit.c
--- kern/kern_exit.c	10 Dec 2005 20:14:42 -0000	1.263.2.5
+++ kern/kern_exit.c	3 Feb 2006 21:26:32 -0000
@@ -172,6 +172,13 @@
 	}
 
 	p->p_flag |= P_WEXIT;
+
+	/*
+	 * Wait for any processes that have a hold on our vmspace to
+	 * release their reference.
+	 */
+	while (p->p_lock > 0)
+		msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0);
 	PROC_UNLOCK(p);
 
 	/* Are we a task leader? */
Index: sys/proc.h
===================================================================
RCS file: /usr/cvs/src/sys/sys/proc.h,v
retrieving revision 1.432.2.2
diff -u -r1.432.2.2 proc.h
--- sys/proc.h	4 Oct 2005 04:41:26 -0000	1.432.2.2
+++ sys/proc.h	3 Feb 2006 21:25:46 -0000
@@ -776,6 +776,7 @@
 } while (0)
 #define	_PHOLD(p) do {							\
 	PROC_LOCK_ASSERT((p), MA_OWNED);				\
+	KASSERT(!((p)->p_flag & P_WEXIT), ("PHOLD of exiting process"));\
 	(p)->p_lock++;							\
 	if (((p)->p_sflag & PS_INMEM) == 0)				\
 		faultin((p));						\
@@ -789,6 +790,8 @@
 #define	_PRELE(p) do {							\
 	PROC_LOCK_ASSERT((p), MA_OWNED);				\
 	(--(p)->p_lock);						\
+	if (((p)->p_flag & P_WEXIT) && (p)->p_lock == 0)		\
+		wakeup(&(p)->p_lock);					\
 } while (0)
 
 /* Check whether a thread is safe to be swapped out. */