An alternative to D36038 -- experimental, works for me (tm).
I have to say I don't know the requirements to safely traverse the object chain list. However, vm_fault_object at some point can wunlock and wlock the object again, all while only having "paging in progress" on it. Assuming this is correct, the patch below should also be fine in that regard. That is the object used is still protected with PIP and after the page is busied and re-checked for identity + validity + the object not being dead, the guarantees should be the same as with the current code *after* the lock is dropped when FAULT_SOFT is returned. Finally, if the aforementioned wunlock/wlock is indeed fine, it should also be fine to just wlock as fallback.
I did not use vm_page_grab_unlocked(..., VM_ALLOC_NOCREAT) because it would mean the vm_page_all_valid check could only be performed after busying -- for pages which are not valid this only increases contention, all while it is avoidable. Additionally the sleeping mechanism is different so I would have to add VM_ALLOC_NOWAIT and handle it on my own anyway.