--- a/sys/kern/imgact_elf.c
+++ b/sys/kern/imgact_elf.c
@@ -1195,6 +1195,8 @@ each_segment(struct proc *p, segment_callback func, void *closure, int writable)
 	int error = 0;
 	vm_map_t map = &p->p_vmspace->vm_map;
 	vm_map_entry_t entry;
+	boolean_t want_write = 0;
+
+	vm_map_lock(map);	/* stable traversal vs concurrent mmap/munmap */
 
 	RB_FOREACH(entry, vm_map_rb_tree, &map->rb_root) {
 		vm_map_backing_t ba;
@@ -1254,6 +1256,7 @@ each_segment(struct proc *p, segment_callback func, void *closure, int writable)
 			vm_object_drop(obj);
 		}
 	}
+	vm_map_unlock(map);
 	return (error);
 }