This function handles invalid intermediate PTP entries, but there's no
reason for this: the passed range should be mapped. In particular, we
assert that all L3 entries encountered are mapped. So let's simplify
the code a bit. No functional change intended.