When pmap_enter_{l2,pde} are called to create a kernel mapping, they are incrementing (and decrementing) the ref_count on kernel page table pages. They should not do this. Kernel page table pages are expected to have a fixed ref_count.
Correctly implement PMAP_ENTER_NOREPLACE in pmap_enter_{l2,pde} on kernel mappings.
Handle a possible page table page leak in pmap_copy(). Suppose that we are determining whether to copy a superpage mapping. If we abort because there is already a mapping in the destination pmap at the current address, then simply decrementing the page table page's ref count is correct, because the page table page must have a ref count > 1. However, if we abort because we failed to allocate a PV entry, this might be a just allocated page table page that has a ref count = 1, so we should call pmap_abort_ptp().
Reduce code duplication by defining a function, pmap_abort_ptp(), for handling a common error case.
Simplify error handling in pmap_enter_quick_locked().