Line-accurate confirmation (runtime demo = guaranteed allocation stall of all contigmalloc callers - a guest-wide wedge, not run for Info tier): sys/vm/vm_contig.c:268-271 'if ((alignment & (alignment-1)) != 0)' accepts alignment==0; the scan then requires (phys & ULONG_MAX)==0 i.e. physical page 0 - never free -> deterministic failure after three full vm_contig_pg_clean passes over all 1024 per-cpu page queues (with M_WAITOK it also loops 'very very slow') sys/vm/vm_contig.c:594 contigfree zero-size panic names the wrong function ('vm_contig_pg_kmap: size must not be 0' inside contigfree) No in-tree caller passes 0.