this is a pretty interesting problem. i'd bet that nobody envisioned doing things like this back when this code was written.
for a toehold on the problem, it looks like the cardbus code (/sys/boot/pc/devpccard.c:828) and the functions upamalloc() and upafree() in memory.c allow some kernel-level dynamic memory. (although upafree() doesn't do anything.) am i wrong in this? what can i do with memory on a pccard? how scary is it to eject a pccard with configured memory? (i guess those are the same question.) erik
