By default, our ASLR implementation is supposed to cluster anonymous memory allocations, unless the application's mmap(..., MAP_ANON, ...) call includes a non-zero address hint. Unfortunately, clustering never occurred because kern_mmap() always replaced the address hint when it was zero. So, the ASLR implementation believed that a non-zero hint had been provided and randomized the mapping's location in the address space. Essentially, I'm pushing down the point at which we convert a hint of zero to a minimum address into vm_map_find_min().