I've been sitting on my thumbs ever since this thread started, expecting the, "Ahah!" post at any minute ... but it's not arrived.
If I'm reading the problem definition correctly we have a consistent, repeatable problem - that alone makes me suspect that it's not a dodgy chunk of pagespace. However, it DOES get me asking, "Why not TRACE the beastie"? If you set traces before issuing the IPL command you will, "see" the IPL Command Simulator running in guest storage and will (hopefully) gain some insight as to exactly what's happening at the moment that the error occur s. In extremis, assuming that the problem can be recreated 2nd-level and the guest trace is insufficient to generate that, "Ahah!" moment, you could even enjoy a day tracing it through CP . It just depends on how stubborn you really are. I have 5 cents that says we're all going to feel dreadfully dumb once thi s one is bottomed out. (Well, actually, it might have to be a Euro - not sure if there are any nickels left in my coin collection - any takers?)
