diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -2596,6 +2596,21 @@
 	}
 }
 
+static int
+vmprot2kveprot(int prot)
+{
+	int res;
+
+	res = 0;
+	if (prot & VM_PROT_READ)
+		res |= KVME_PROT_READ;
+	if (prot & VM_PROT_WRITE)
+		res |= KVME_PROT_WRITE;
+	if (prot & VM_PROT_EXECUTE)
+		res |= KVME_PROT_EXEC;
+	return (res);
+}
+
 /*
  * Must be called with the process locked and will return unlocked.
  */
@@ -2667,12 +2682,8 @@
 		kve->kve_end = entry->end;
 		kve->kve_offset += entry->offset;
 
-		if (entry->protection & VM_PROT_READ)
-			kve->kve_protection |= KVME_PROT_READ;
-		if (entry->protection & VM_PROT_WRITE)
-			kve->kve_protection |= KVME_PROT_WRITE;
-		if (entry->protection & VM_PROT_EXECUTE)
-			kve->kve_protection |= KVME_PROT_EXEC;
+		kve->kve_protection = vmprot2kveprot(entry->protection);
+		kve->kve_max_protection = vmprot2kveprot(entry->max_protection);
 
 		if (entry->eflags & MAP_ENTRY_COW)
 			kve->kve_flags |= KVME_FLAG_COW;
diff --git a/sys/sys/user.h b/sys/sys/user.h
--- a/sys/sys/user.h
+++ b/sys/sys/user.h
@@ -569,7 +569,8 @@
 		uint64_t _kve_obj;		/* handle of anon obj */
 	} kve_type_spec;
 	uint64_t kve_vn_rdev;			/* Device id if device. */
-	int	 _kve_ispare[8];		/* Space for more stuff. */
+	int	 kve_max_protection;		/* Max protection bitmask. */
+	int	 _kve_ispare[7];		/* Space for more stuff. */
 	/* Truncated before copyout in sysctl */
 	char	 kve_path[PATH_MAX];		/* Path to VM obj, if any. */
 };