Ah yes, from this diff you pretty easily see that the condition matches the one below where the pages are mapped, but maybe not if somebody is later looking at the whole .c file. I guess a comment might be nice, or otherwise putting the hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) > (size_t)PAGE_SIZE expression into a macro, maybe?

Yeah, in the context of this diff it's clear why this is like this but might not be clear for someone looking at this file in the future.

Oh, one more thing, what happens if the phdr starts in the first mapped page but crosses the boundary into the next one?

As far as I can see, the first page would be mapped twice, once with offset 0 (line 360 in the new version), and once with offset hdr->e_phoff. It's not a big issue, but it may waste a page. AFAIK you can map pages multiple times just fine, certainly when they're read-only?

It happens only during parsing, map_object() unmaps both special mappings.

In the case Ed noted, we must map two pages. Test checks that the end of the supposed mapping fits into zero page. If it not, we indeed would map zero page twice, and it must work. For instance, we map shared libraries at different bases.