--- sys/vm/vm_page.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/v26/fixtree/sys/vm/vm_page.c	2026-10-24 16:33:07.741716173 +0000
@@ -2865,13 +2865,19 @@
 		kprintf("vm_page_free_contig:  %016jx/%ldk\n",
 			(intmax_t)pa, size / 1024);
 	}
-	if (pa < vm_low_phys_reserved) {
+	if (pa < vm_low_phys_reserved ||
+	    ((m->flags & PG_FICTITIOUS) != 0 &&
+	     (m->flags & PG_MARKER) == 0)) {
 		/*
 		 * Just assert check the first page for convenience.
+		 *
+		 * DF-2678: fictitious pages allocated from the DMA alist
+		 * must be returned to the alist even if the watermark has
+		 * since been lowered below them (vm_page_startup_finish).
+		 * The old pa-only test leaked such pages permanently.
 		 */
 		KKASSERT(m->wire_count == 1);
 		KKASSERT(m->flags & PG_FICTITIOUS);
-		KKASSERT(pa + size <= vm_low_phys_reserved);
 		spin_lock(&vm_contig_spin);
 		alist_free(&vm_contig_alist, start, pages);
 		spin_unlock(&vm_contig_spin);