pmap_kextract() can race with promotion/demotion on the kernel page table, in which case current non-atomic 64bit read would see torn value, breaking pmap_kextract(). pmap_kextract() would correctly handle either promoted or demoted PDE, but not the mix where one word is from a different state.

It requires PAE and > 4G memory to reproduce. We observed this in real loads, both for intensive use of malloc()/free() where vtoslab() returned invalid pointer to the slab, and with the use of busdma_bounce, where incorrect page was bounced.

In collaboration with: pho