Turns out Linux on PA-RISC does system calls in a pretty fascinating way; see arch/parisc/kernel/syscall.S for details.