vm_map_entry_set_max_free depends on using the next and prev fields of vm_map_entries to find neighbors and compute gap sizes. There's no need to use these fields, since their values are already present in one of the local variables of vm_map_splay_split. Change splay_split to use this information and to update max_free values on the search path so that splay_merge can update max_free values without looking at entries not on the search path.
In splay_split, build the left and right reverse-branches beginning with the map->header field, to avoid some special cases that arose with the previous NULL terminator, and more that would arise after the elimination of vm_map_entry_set_max_free.