Index: sys/vm/vm_map.c
===================================================================
--- sys/vm/vm_map.c
+++ sys/vm/vm_map.c
@@ -3285,6 +3285,10 @@
 				vm_object_collapse(src_object);
 				if ((src_object->flags & (OBJ_NOSPLIT |
 				    OBJ_ONEMAPPING)) == OBJ_ONEMAPPING) {
+					/*
+					 * Make sure faults see the split.
+					 */
+					src_map->timestamp++;
 					vm_object_split(src_entry);
 					src_object =
 					    src_entry->object.vm_object;
Index: sys/vm/vm_object.c
===================================================================
--- sys/vm/vm_object.c
+++ sys/vm/vm_object.c
@@ -1434,6 +1434,9 @@
 			goto retry;
 		}
 
+		if (vm_page_lookup(new_object, idx) != NULL)
+			goto busy_orig;
+
 		/* vm_page_rename() will dirty the page. */
 		if (vm_page_rename(m, new_object, idx)) {
 			VM_OBJECT_WUNLOCK(new_object);
@@ -1458,6 +1461,7 @@
 		 */
 		vm_reserv_rename(m, new_object, orig_object, offidxstart);
 #endif
+busy_orig:
 		if (orig_object->type == OBJT_SWAP)
 			vm_page_xbusy(m);
 	}