Create the temp file with all zeros (this is required to generate the false PV entries)
```
# dd if=/dev/zero of=/tmp/mapfile bs=1m count=5
```
The following reproducer will trigger the panic upon the exit of the second child process:
```
#include <assert.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <malloc.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/wait.h>
#define PAGE_SIZE 4096
/* Larger than one superpage: 2MiB + 7 * 4KiB */
#define MAP_LENGTH ((1UL << 21) + 7 * PAGE_SIZE)
void
child_run(int fd)
{
char buf[16];
char *addr, *cpyaddr;
/* mmap the first MAP_LENGTH bytes of the file into the process. */
addr = mmap(NULL, MAP_LENGTH, PROT_READ, MAP_PRIVATE, fd, 0);
if (addr == MAP_FAILED) {
err(1, "mmap failed");
}
/* Now madvise() with WILLNEED, so that the mappings are (re-)created. */
if (madvise(addr, MAP_LENGTH, MADV_WILLNEED) == -1) {
err(1, "madvise(MADV_WILLNEED) failed");
}
close(fd);
/* Read a few bytes from every page in the mapped region, so that they
* are paged in. */
cpyaddr = addr;
for (cpyaddr = addr; cpyaddr < (addr + MAP_LENGTH); cpyaddr += PAGE_SIZE) {
memcpy(buf, cpyaddr, sizeof(buf));
}
if (munmap(addr, MAP_LENGTH) == -1) {
err(1, "munmap failed");
}
/* exit process */
exit(0);
}
int
main(int arg, char *argv[])
{
pid_t pid;
int fd, status;
fd = open("/tmp/mapfile", O_RDONLY);
if (fd == -1) {
err(1, "failed to open mapfile");
}
for (int i = 0; i < 2; i++) {
pid = fork();
if (pid == -1) {
err(1, "Failed to fork");
} else if (pid == 0) {
child_run(fd);
} else {
/* Allow the child to exit before running again. */
waitpid(pid, &status, 0);
}
}
return (0);
}
```