The DIAGNOSTIC consistency walk searches the tree from the root for
every entry, so it is O(n * depth). vmspace_fork() links the copied
entries in address order, leaving the child's tree a path, so the
child's first fault pays an O(n^2) walk. A forked smbd with over
70000 map entries makes over a billion node visits in that fault.
Walk the tree depth-first instead, carrying each subtree's bounds, in
O(n). Visit the smaller address span first; each push at least halves
the span, so one pending slot per address bit suffices.
Checking the bounds and the header links covers the threads, which
makes the list walk redundant.