Line-accurate confirmation:
sys/vm/vm_contig.c:527 vm_contig_pg_kmap allocates KVA with
   kmem_alloc_pageable(kernel_map, ...) - the 'map' parameter is
   never used (the doc comment above contigmalloc_map admits the
   contract is kernel_map-only)
sys/vm/vm_contig.c:559-581 contigmalloc_map forwards map into the
   unused parameter; a future caller freeing via its own map would
   kmem_free an address from the wrong vm_map (entry corruption /
   panic) while the real kernel_map entry leaks. No current caller
   passes a different map; latent API trap.