diff --git a/sys/cddl/dev/kinst/trampoline.c b/sys/cddl/dev/kinst/trampoline.c
--- a/sys/cddl/dev/kinst/trampoline.c
+++ b/sys/cddl/dev/kinst/trampoline.c
@@ -134,6 +134,16 @@
 
 	sx_assert(&kinst_tramp_sx, SX_XLOCKED);
 
+#if defined(__riscv) || defined(__aarch64__)
+	/*
+	 * XXX: RISCV and ARM64 use PAGE_SIZE-long trampolines as a workaround
+	 * to a QEMU bug. However, BITSET(9) doesn't seem to be working
+	 * properly when the bitset size is 1, so in this case we skip the bit
+	 * searching completely.
+	 */
+	chunk = NULL;
+	off = 0;
+#else
 	TAILQ_FOREACH(chunk, &kinst_trampchunks, next) {
 		/* All trampolines from this chunk are already allocated. */
 		if ((off = BIT_FFS(KINST_TRAMPS_PER_CHUNK, &chunk->free)) == 0)
@@ -142,6 +152,7 @@
 		off--;
 		break;
 	}
+#endif
 	if (chunk == NULL) {
 		if ((how & M_NOWAIT) != 0)
 			return (NULL);