Index: vm/vm_map.c
===================================================================
--- vm/vm_map.c
+++ vm/vm_map.c
@@ -1277,9 +1277,10 @@
 			vm_object_clear_flag(object, OBJ_ONEMAPPING);
 		VM_OBJECT_WUNLOCK(object);
 	} else if (prev_entry != &map->header &&
-	    prev_entry->eflags == protoeflags &&
+	    (prev_entry->eflags & (MAP_ENTRY_IS_SUB_MAP | MAP_ENTRY_COW |
+	    MAP_ENTRY_GROWS_DOWN | MAP_ENTRY_GROWS_UP)) == 0 &&
 	    (cow & (MAP_STACK_GROWS_DOWN | MAP_STACK_GROWS_UP)) == 0 &&
-	    prev_entry->end == start && prev_entry->wired_count == 0 &&
+	    prev_entry->end == start &&
 	    (prev_entry->cred == cred ||
 	    (prev_entry->object.vm_object != NULL &&
 	    prev_entry->object.vm_object->cred == cred)) &&
@@ -1293,9 +1294,11 @@
 		 * can extend the previous map entry to include the
 		 * new range as well.
 		 */
-		if (prev_entry->inheritance == inheritance &&
+		if (prev_entry->eflags == protoeflags &&
 		    prev_entry->protection == prot &&
-		    prev_entry->max_protection == max) {
+		    prev_entry->max_protection == max &&
+		    prev_entry->inheritance == inheritance &&
+		    prev_entry->wired_count == 0) {
 			if ((prev_entry->eflags & MAP_ENTRY_GUARD) == 0)
 				map->size += end - prev_entry->end;
 			prev_entry->end = end;
Index: vm/vm_mmap.c
===================================================================
--- vm/vm_mmap.c
+++ vm/vm_mmap.c
@@ -307,6 +307,9 @@
 		 * There should really be a pmap call to determine a reasonable
 		 * location.
 		 */
+		if (addr == 0 && (flags & (MAP_ANON | MAP_GUARD)) == MAP_ANON)
+			addr = round_page((vm_offset_t)vms->vm_daddr +
+			    2 * lim_max(td, RLIMIT_DATA));
 		if (addr == 0 ||
 		    (addr >= round_page((vm_offset_t)vms->vm_taddr) &&
 		    addr < round_page((vm_offset_t)vms->vm_daddr +