When trying to unregister a fictitious range in vm_phys_fictitious_unreg_range(), the function checks the properties of the looked up segment, but it does not check if a segment was found in the first place.
This can happen with the amdgpu DRM driver which could call vm_phys_fictitious_unreg_range() without a fictitious range registered if the initialisation of the driver failed (for example because firmwares are unavailable).
The code in the DRM driver was improved to avoid that, but vm_phys_fictitious_unreg_range() should still check the return value of RB_FIND() before trying to dereference the segment pointer and panic with a page fault.
Sponsored by: The FreeBSD Foundation