Index: sys/arm64/arm64/pmap.c
===================================================================
--- sys/arm64/arm64/pmap.c
+++ sys/arm64/arm64/pmap.c
@@ -4971,6 +4971,7 @@
 restart:
 	if (!pmap_bti_same(pmap, va, va + pagesizes[psind]))
 		return (KERN_PROTECTION_FAILURE);
+	newpte |= pmap_pte_bti(pmap, va);
 	if (psind == 2) {
 		PMAP_ASSERT_L1_BLOCKS_SUPPORTED;
 
@@ -5123,9 +5124,6 @@
 
 	lock = NULL;
 	PMAP_LOCK(pmap);
-	/* Wait until we lock the pmap to protect the bti rangeset */
-	new_l3 |= pmap_pte_bti(pmap, va);
-
 	if ((flags & PMAP_ENTER_LARGEPAGE) != 0) {
 		KASSERT((m->oflags & VPO_UNMANAGED) != 0,
 		    ("managed largepage va %#lx flags %#x", va, flags));
@@ -5197,6 +5195,7 @@
 	orig_l3 = pmap_load(l3);
 	opa = PTE_TO_PHYS(orig_l3);
 	pv = NULL;
+	new_l3 |= pmap_pte_bti(pmap, va);
 
 	/*
 	 * Is the specified virtual address already mapped?
@@ -5483,6 +5482,7 @@
 		pmap_abort_ptp(pmap, va, l2pg);
 		return (KERN_PROTECTION_FAILURE);
 	}
+	new_l2 |= pmap_pte_bti(pmap, va);
 
 	/*
 	 * If there are existing mappings, either abort or remove them.
@@ -5746,6 +5746,7 @@
 			*ml3p = NULL;
 			return (KERN_PROTECTION_FAILURE);
 		}
+		l3e |= pmap_pte_bti(pmap, va);
 	} else {
 		*ml3p = NULL;