How is the buffer lock stopping the VM system from changing the state of the valid field? Suppose that the containing object is logically mapped in an address space. In that case, it's not clear to me that everything that might affect the valid field is going to acquire a buffer lock.

It isn't. I guess "most cases" is misleading, but I added it because of the cases that you and Jeff described.

How about, "The valid bits will be stable unless the page is mapped or referenced by multiple buffers, and we expect races to be rare in those cases."

Okay. I would suggest swapping the second and third sentences. In other words, I would talk about the likelihood of the race before talking about the consequences.

What do you mean by 'mapped' there ? And what is the difference with 'referenced' ?

"mapped into a process' address space" as opposed to having multiple buffers which contain pointers to the same page. I thought the latter is possible e.g., with sub-page FFS block fragments.

Then I miss something. Mapped page must be valid.

Other part, about sub-page fragments, sounds correct.

"in the process of being mapped" is closer to what I meant. I think there is a possibility (perhaps impossible in practice) that a concurrent fault might mark the page valid.

So it is really any invalid page. But the page is still fine.