# DF-5245 — pmap_extract() KVA path checks the PDE instead of the PTE

## What
`pmap_extract()` (sys/platform/pc64/x86_64/pmap.c:1717-1769), kernel-address
branch:

```c
1733  pt = pmap_pt(pmap, va);              /* PD slot (pointer to PT entry) */
1734  if (pt && (*pt & pmap->pmap_bits[PG_V_IDX])) {   /* PDE valid */
1735      if (*pt & PG_PS) { ... 2MB case ok ... }
1737      else {
1738          ptep = pmap_pt_to_pte(*pt, va);          /* PTE slot */
1739          if (*pt & pmap->pmap_bits[PG_V_IDX]) {   /* BUG: re-tests *pt
                                                         (the PDE), should
                                                         test *ptep */
1740              rtval = *ptep & PG_FRAME;
1741              rtval |= va & PAGE_MASK;
1742          }
      }
  }
```

Line 1739 duplicates the PDE validity test instead of testing the PTE
(`*ptep`). When the page-table page exists (PDE valid) but the PTE is 0 (page
not entered / already removed), `pmap_extract()` returns
`(va & PAGE_MASK)` — the page offset — as a "valid" physical address instead
of 0 (its documented failure value).

## Impact
Callers that use the return value without re-validating (e.g.
`_sglist_append_buf()` in sys/kern/subr_sglist.c:126-160, which feeds
`ss_paddr` straight into a scatter/gather list for DMA) can program a bogus
low physical address into device I/O. On pc64 the KVA branch of
`pmap_extract()` currently has no in-tree caller that passes a kernel VA
(busdma uses `pmap_kextract()`; sglist user paths use the correctly-checked
user branch at pmap.c:1756), so no live impact is demonstrated — filed as a
Low-severity correctness landmine with certain code-level confidence.

## Fix
```diff
--- a/sys/platform/pc64/x86_64/pmap.c
+++ b/sys/platform/pc64/x86_64/pmap.c
@@ -1736,7 +1736,7 @@
 			} else {
 				ptep = pmap_pt_to_pte(*pt, va);
-				if (*pt & pmap->pmap_bits[PG_V_IDX]) {
+				if (*ptep & pmap->pmap_bits[PG_V_IDX]) {
 					rtval = *ptep & PG_FRAME;
 					rtval |= va & PAGE_MASK;
 				}
```

## Verification
Not executed on the guest: the buggy branch is not reachable from any
in-tree caller with a kernel VA on this platform (verified by grepping all
`pmap_extract` call sites), so there is no runtime trigger to build —
finding is certain by inspection, severity Low, no runtime impact
demonstrated. No fix.diff beyond the one-liner above (also embedded here and
in the finding markdown).