Index: vm_reserv.c
===================================================================
--- vm_reserv.c
+++ vm_reserv.c
@@ -1174,20 +1174,25 @@
  * The free page queue lock must be held.
  */
 static bool
-vm_reserv_test_contig(vm_reserv_t rv, u_long npages, vm_paddr_t low,
+vm_reserv_test_contig(vm_reserv_t rv, u_int npages, vm_paddr_t low,
     vm_paddr_t high, u_long alignment, vm_paddr_t boundary)
 {
 	vm_paddr_t pa, size;
 	u_long changes;
-	int bitpos, bits_left, i, hi, lo, n;
+	u_int hi, lo;
+	int bitpos, bits_left, i, n;
 
 	vm_reserv_assert_locked(rv);
 	size = npages << PAGE_SHIFT;
 	pa = VM_PAGE_TO_PHYS(&rv->pages[0]);
+	KASSERT(pa + VM_LEVEL_0_SIZE - size >= low,
+	    ("%s: reservation is too low", __func__));
 	lo = (pa < low) ?
 	    ((low + PAGE_MASK - pa) >> PAGE_SHIFT) : 0;
 	i = lo / NBPOPMAP;
 	changes = rv->popmap[i] | ((1UL << (lo % NBPOPMAP)) - 1);
+	KASSERT(pa + size <= high,
+	    ("%s: reservation is too high", __func__));
 	hi = (pa + VM_LEVEL_0_SIZE > high) ?
 	    ((high + PAGE_MASK - pa) >> PAGE_SHIFT) : VM_LEVEL_0_NPAGES;
 	n = hi / NBPOPMAP;
@@ -1231,7 +1236,7 @@
 					return (false);
 				pa = VM_PAGE_TO_PHYS(&rv->pages[lo]);
 			}
-			if (lo * PAGE_SIZE + size <= hi * PAGE_SIZE)
+			if (lo + npages <= hi)
 				return (true);
 			lo = hi;
 		}