sched_4bsd startup crash trying to run a bound thread on an AP that hasn't started

I'm running into a bootup crash under sched_4bsd on HEAD.  The crash
happens when I have a thread bound to a single CPU that isn't the BSP,
and that thread is scheduled.  If the AP that the thread is bound
hasn't been started up, kick_other_cpu() crashes because
pcpu->pc_curthread is NULL for the AP.

I've put a small test kld in
http://people.freebsd.org/~rstone/4bsd_bind/ that reproduces the
problem.  I'm not sure what the best way to address the crash is.  ULE
is not affected by the problem; it seems to run the swi thread on CPU
0 until CPU 1 is running.

Here's a sample backtrace:
Fatal trap 12: page fault while in kernel mode^M^M
cpuid = 0; apic id = 00^M^M
fault virtual address   = 0x2fa^M^M
fault code              = supervisor read data, page not present^M^M
instruction pointer     = 0x20:0xffffffff803b473b^M^M
stack pointer           = 0x28:0xffffffff80a2c740^M^M
frame pointer           = 0x28:0xffffffff80a2c790^M^M
code segment            = base 0x0, limit 0xfffff, type 0x1b^M^M
                        = DPL 0, pres 1, long 1, def32 0, gran 1^M^M
processor eflags        = resume, IOPL = 0^M^M
current process         = 0 (swapper)^M^M
trap number             = 12^M^M
panic: page fault^M^M
cpuid = 0^M^M
KDB: stack backtrace:^M^M
db_trace_self_wrapper() at 0xffffffff801cac8a = db_trace_self_wrapper+0x2a^M^M
panic() at 0xffffffff8038ef92 = panic+0x182^M^M
trap_fatal() at 0xffffffff8057d32d = trap_fatal+0x2ad^M^M
trap() at 0xffffffff8057e01f = trap+0x29f^M^M
calltrap() at 0xffffffff80561397 = calltrap+0x8^M^M
--- trap 0xc, rip = 0xffffffff803b473b, rsp = 0xffffffff80a2c740, rbp
= 0xfffffff
f80a2c790 ---^M^M
sched_add() at 0xffffffff803b473b = sched_add+0xeb^M^M
intr_event_schedule_thread() at 0xffffffff803633e0 =
intr_event_schedule_thread+0
xa0^M^M
hardclock_device_poll() at 0xffffffff8037f9a5 = hardclock_device_poll+0x35^M^M
hardclock() at 0xffffffff80342dd3 = hardclock+0x43^M^M
lapic_handle_timer() at 0xffffffff80568033 = lapic_handle_timer+0xf3^M^M
Xtimerint() at 0xffffffff80561ecc = Xtimerint+0x8c^M^M