Finally found the pmap bug that kept Cortex-A7 from working. Turns out we have to flush the TLB when removing a L1 slot as well. Already committed the diff, but here it is for those that are interested.
Index: arch/arm/arm/pmap7.c =================================================================== RCS file: /cvs/src/sys/arch/arm/arm/pmap7.c,v retrieving revision 1.36 diff -u -p -r1.36 pmap7.c --- arch/arm/arm/pmap7.c 9 Aug 2016 13:13:51 -0000 1.36 +++ arch/arm/arm/pmap7.c 11 Aug 2016 00:21:09 -0000 @@ -850,6 +850,7 @@ pmap_free_l2_bucket(pmap_t pm, struct l2 if (l1pd == (L1_C_DOM(pm->pm_domain) | L1_TYPE_C)) { *pl1pd = L1_TYPE_INV; PTE_SYNC(pl1pd); + pmap_tlb_flushID_SE(pm, l1idx << L1_S_SHIFT); } /*