boot-args site:developer.apple.com gives some good resources.
cpus=1 forces the system to only use a single CPU core.
srv=1 is set on Xserves and machines that have Mac OS X Server installed, and supposedly changes some kernel tuning parameters for server-friendly operation.
_panicd_ip=a.b.c.d Lets you specify the IP address of a panic debug server to write kernel core dumps to.
debug=0xH (Where H is a 1-4 digit hexadecimal number) Lets you set kernel debugging flags from this list:
DB_HALT 0x01 Halt at boot-time and wait for debugger attach (gdb).
DB_PRT 0x02 Send kernel debugging printf output to console.
DB_NMI 0x04 Drop into debugger on NMI (Command–Power, Command-Option-Control-Shift-Escape, or interrupt switch).
DB_KPRT 0x08 Send kernel debugging kprintf output to serial port.
DB_KDB 0x10 Make ddb (kdb) the default debugger (requires a custom kernel).
DB_SLOG 0x20 Output certain diagnostic info to the system log.
DB_ARP 0x40 Allow debugger to ARP and route (allows debugging across routers and removes the need for a permanent ARP entry, but is a potential security hole)—not available in all kernels.
DB_KDP_BP_DIS 0x80 Support old versions of gdb on newer systems.
DB_LOG_PI_SCRN 0x100 Disable graphical panic dialog.
DB_KERN_DUMP_ON_PANIC 0x0400 Causes the kernel to core dump when the system panics.
DB_KERN_DUMP_ON_NMI 0x0800 Causes the kernel to core dump when the user triggers an NMI.
DB_DBG_POST_CORE 0x1000 Controls the kernel's behavior after dumping core in response to an NMI (DB_KERN_DUMP_ON_NMI). If the user triggers an NMI and this flag is clear, the kernel will dump core and then continue. Conversely, if this flag is set the kernel will dump core and then wait for a debugger connection.
DB_PANICLOG_DUMP 0x2000 Controls whether the kernel dumps a full core (if the flag is clear) or simply a panic log (if the flag is set).