--- a/sys/kern/subr_sglist.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/subr_sglist.c	2026-10-26 00:25:42.777043079 +0000
@@ -124,6 +124,10 @@
 	offset = vaddr & PAGE_MASK;
 	if (pmap != NULL) {
 		paddr = pmap_extract(pmap, vaddr, &handle);
+		if (paddr == 0) {
+			pmap_extract_done(handle);
+			return (EFAULT);
+		}
 	} else {
 		paddr = pmap_kextract(vaddr);
 		handle = NULL;
@@ -152,6 +156,10 @@
 		seglen = MIN(len, PAGE_SIZE);
 		if (pmap != NULL) {
 			paddr = pmap_extract(pmap, vaddr, &handle);
+			if (paddr == 0) {
+				pmap_extract_done(handle);
+				return (EFAULT);
+			}
 			error = _sglist_append_range(sg, &ss, paddr, seglen);
 			pmap_extract_done(handle);
 		} else {