While writing tests for CloudABI, I noticed that close() on process descriptors returns the process ID of the child process. This is interesting, as close() is only allowed to return 0 or -1. It turns out that we clobber td->td_retval[0] in proc_reap(), so that wait*() properly returns the process ID.
Change proc_reap() to leave td->td_retval[0] alone. Set the process ID in kern_wait6() instead, by keeping track of the PID before we (potentially) reap the process.