It is possible, for complex fork()/collapse situations, to have sibling address spaces to partially share shadow chains. If one sibling performs wiring, it can happen that a transient page, invalid and busy, is installed into a shadow object which is visible to other sibling. If the backing object contains the valid page, and the wiring is performed on read-only entry, the transient page is eventually removed.

But the sibling which observed the transient page might perform the unwire, executing vm_object_unwire(). There, the first page found in the shadow chain is considered as the page that was wired for the mapping. It is really the page below it which is wired. So we unwire the wrong page, either triggering the asserts of breaking the page' wire counter.

As the fix, wait for the busy state to finish if we find such page during unwire.

See for instance https://people.freebsd.org/~pho/stress/log/kostik1083.txt which demonstrates the situation.

Reported and tested by: pho