Hi Michael, > It seems to be writing into the word starting at paca[x].lppaca.reserved2, > which I guess it's allowed to do seeing as it's reserved. Ouch! Nice work hunting this down. I think there is an unregister vpa hcall, for a clean kexec boot perhaps we could have a shutdown method that calls this. Anton