the + 2MB is to keep some distance to the bss (heap). the assumption might'v been that telnet will not dynamically allocate more than 2MB from the time when the segment is created.
a better solution would be to just pass 0 as va. the kernel will then put the segment downwards from the stack base and finds a hole in the address space for us returning the base address from segattach(). segments cannot expand down. even the stack segment has a fixed size and uses demand paging for downwards expansion, thats why this works :) -- cinap
