Index: sys/vm/vm_fault.c
===================================================================
--- sys/vm/vm_fault.c
+++ sys/vm/vm_fault.c
@@ -2157,10 +2157,9 @@
 	 * with the source object, all of its pages must be dirtied,
 	 * regardless of whether they can be written.
 	 */
-	mpred = (src_object == dst_object) ?
-	   vm_page_mpred(src_object, src_pindex) : NULL;
-	for (vaddr = dst_entry->start, dst_pindex = 0;
-	    vaddr < dst_entry->end;
+	dst_pindex = (src_object == dst_object) ? src_pindex : 0;
+	mpred = vm_page_mpred(src_object, dst_pindex);
+	for (vaddr = dst_entry->start; vaddr < dst_entry->end;
 	    vaddr += PAGE_SIZE, dst_pindex++, mpred = dst_m) {
 again:
 		/*
@@ -2171,7 +2170,7 @@
 		if (src_object != dst_object)
 			VM_OBJECT_RLOCK(src_object);
 		object = src_object;
-		pindex = src_pindex + dst_pindex;
+		pindex = dst_pindex;
 		while ((src_m = vm_page_lookup(object, pindex)) == NULL &&
 		    (backing_object = object->backing_object) != NULL) {
 			/*
@@ -2199,14 +2198,14 @@
 			/*
 			 * Allocate a page in the destination object.
 			 */
-			dst_m = vm_page_alloc_after(dst_object, (src_object ==
-			    dst_object ? src_pindex : 0) + dst_pindex,
+			dst_m = vm_page_alloc_after(dst_object, dst_pindex,
 			    VM_ALLOC_NORMAL, mpred);
 			if (dst_m == NULL) {
 				VM_OBJECT_WUNLOCK(dst_object);
 				VM_OBJECT_RUNLOCK(object);
 				vm_wait(dst_object);
 				VM_OBJECT_WLOCK(dst_object);
+				dst_m = vm_page_mpred(src_object, dst_pindex);
 				goto again;
 			}