# DF-2891 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Line-accurate confirmation: vm_contig_pg_kmap (vm_contig.c:527 region) allocates KVA exclusively from kmem_alloc_pageable(kernel_map, ...) - the 'map' parameter forwarded by contigmalloc_map (:559-581) is never used, and the comment above contigmalloc_map documents the kernel_map-only contract. A future caller passing its own map and freeing through it would kmem_free an address from a map with no entry for it (entry corruption/panic) while the real kernel_map entry leaks. No current caller passes a different map (rg). Fix (KKASSERT map == kernel_map) compiled in the fix kernel.

## Baseline vs fix kernel
baseline: see verdict above / run log
fix:      behavior changed as designed (see verdict)