diff --git a/sys/vm/vm_fault.c b/sys/vm/vm_fault.c
--- a/sys/vm/vm_fault.c
+++ b/sys/vm/vm_fault.c
@@ -2296,8 +2296,13 @@
 		 * deeper page to be mapped read-only, in which case the
 		 * unlock*(fs) will free first_m.
 		 */
-		if (fs->ba == fs->first_ba)
+		if (fs->ba == fs->first_ba) {
+			if (fs->mary[0] == NULL) {
+				unlock_things(fs);
+				return (KERN_FAILURE);
+			}
 			fs->first_m = fs->mary[0];
+		}
 
 		/*
 		 * Move on to the next object.  The chain lock should prevent