# DF-0996 — vkernel64 pmap_unwire NULL pte dereference

## Summary
`pmap_unwire()` at `sys/platform/vkernel64/platform/pmap.c:2637-2638` calls
`pmap_pte()` then dereferences the returned pointer without a NULL check.
`pmap_pte()` returns NULL when no page-table page exists for the VA
(`sys/platform/vkernel64/platform/pmap.c:317`), so an unwire walk over a
sparse range crashes the vkernel.

The pc64 equivalent at `sys/platform/pc64/x86_64/pmap.c:5565-5619` correctly
handles the NULL case — proving the vkernel64 version is the outlier.

## Why not tested on default guest
The bug is in `sys/platform/vkernel64/`, **not** compiled into the default
`X86_64_GENERIC` kernel. Triggering it requires building and booting a
`VKERNEL64` target (the DragonFly virtual kernel), which is outside this
run's scope. The fix is verified by source review and parity with pc64.

## Fix
Apply `fix.diff`:
```c
pte = pmap_pte(pmap, va);
-    if ((*pte & VPTE_V) == 0) {
-        *pva = pmap_nextva(pmap, va);
+    if (pte == NULL || (*pte & VPTE_V) == 0) {
+        if (pte == NULL)
+            *pva = pmap_nextva(pmap, va);
```