Index: sys/vm/vm_fault.c
===================================================================
--- sys/vm/vm_fault.c
+++ sys/vm/vm_fault.c
@@ -1651,8 +1651,10 @@
 		crhold(dst_object->cred);
 		*fork_charge += dst_object->charge;
 	} else if (dst_object->cred == NULL) {
-		KASSERT(dst_entry->cred != NULL, ("no cred for entry %p",
-		    dst_entry));
+		KASSERT(dst_entry->cred != NULL ||
+		    (dst_object->type != OBJT_SWAP &&
+		    dst_object->type != OBJT_DEFAULT),
+		    ("no cred for entry %p", dst_entry));
 		dst_object->cred = dst_entry->cred;
 		dst_entry->cred = NULL;
 	}
@@ -1738,8 +1740,9 @@
 			if (vm_page_sleep_if_busy(dst_m, "fltupg"))
 				goto again;
 			vm_page_xbusy(dst_m);
-			KASSERT(dst_m->valid == VM_PAGE_BITS_ALL,
-			    ("invalid dst page %p", dst_m));
+			if (dst_m->pindex < dst_object->size)
+				KASSERT(dst_m->valid == VM_PAGE_BITS_ALL,
+				    ("invalid dst page %p", dst_m));
 		}
 		VM_OBJECT_WUNLOCK(dst_object);
 
@@ -1748,8 +1751,9 @@
 		 * mapping is being replaced by a write-enabled
 		 * mapping, then wire that new mapping.
 		 */
-		pmap_enter(dst_map->pmap, vaddr, dst_m, prot,
-		    access | (upgrade ? PMAP_ENTER_WIRED : 0), 0);
+		if (dst_m->valid == VM_PAGE_BITS_ALL)
+			pmap_enter(dst_map->pmap, vaddr, dst_m, prot,
+			    access | (upgrade ? PMAP_ENTER_WIRED : 0), 0);
 
 		/*
 		 * Mark it no longer busy, and put it on the active list.