pap values accepted by mptable_map() as-is (only check: pap != 0, mptable.c:512):
  pap=0x0009fc00 (sane (EBDA table)   ) -> ACCEPTED, mapped + parsed as MP config table
  pap=0x000f0000 (BIOS ROM area       ) -> ACCEPTED, mapped + parsed as MP config table
  pap=0xfebc0000 (MMIO hole           ) -> ACCEPTED, mapped + parsed as MP config table
  pap=0xa0000000 (PCI MMIO            ) -> ACCEPTED, mapped + parsed as MP config table
  pap=0xffffff00 (top of 4GB - 0x100  ) -> ACCEPTED, mapped + parsed as MP config table
  pap=0xffffffff (last byte of 4G     ) -> ACCEPTED, mapped + parsed as MP config table
  pap=0xdeadbeef (total garbage       ) -> ACCEPTED, mapped + parsed as MP config table

resulting pmap_mapdev spans (pmap.c:6192 accepts ANY pa):
  sane                         pap=0x0009fc00 len=42     map span [0x00009fc00..0x00009fc2a)
  garbage pap                  pap=0xdeadbeef len=65535  map span [0x0deadbeef..0x0deaebeee)
  4GB-crossing                 pap=0xffffff00 len=4096   map span [0x0ffffff00..0x100000f00)  ** CROSSES THE 4GB WRAP **

validation the file NEVER performs (audited by grep of sys/platform/pc64/x86_64/mptable.c):
  MPFPS checksum byte:      0 reads of fps->checksum
  MPCTH 'PCMP' signature:   0 reads of cth->signature
  MPCTH checksum:           0 reads of cth->checksum
  pap/pap+len in RAM:       no range check exists