We set PIPE_DIRECTW to indicate that a direct write (i.e.,
process-to-process copy) is pending on a pipe. When a reader has
copied the full contents of the wired pages, it clears PIPE_DIRECTW and
wakes up the writer, which proceeds to unwire the pages.
Direct writers must be serialized. pipe_direct_write() sleeps if
another thread has already set PIPE_DIRECTW. However, because the
reader clears PIPE_DIRECTW, it may wake up two writers and cause them to
race and access the page array concurrently.
Fix the problem by changing the read to not clear PIPE_DIRECTW.
Instead, a direct writer can determine whether the wired pages have been
read by checking pipe_map.cnt.