The "oh...." moment came thanks to jsg@
> CVSROOT: /cvs
> Module name: src
> Changes by: [email protected] 2013/10/20 03:41:31
>
> Modified files:
> sys/arch/i386/i386: hibernate_machdep.c
> sys/arch/amd64/amd64: hibernate_machdep.c
>
> Log message:
> SMEP (on Ivy Bridge and later CPUs) require page protections that include
> at least one supervisor mode (U/S bit = 0) setting in higher level paging
> structures. This diff removes PG_u flags from the hibernate resume time
> pmap (there was really no reason we needed it), to allow hibernate to
> work on Ivy Bridge and later CPUs.
>
> ok deraadt
