=== BASELINE (unpatched kernel DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC) ===

$ kldload /root/mddiag/mddiag.ko
$ sysctl debug.mddiag=maptest        # maps 2 fresh pages: slot 8191 + slot 8190 control

serial console (dmesg):
DFRIG: VM_MIN_KERNEL_ADDRESS = 0xfffff80040000000
DFRIG: KPDPPHYS_KVA          = 0xfffff80000000000     <- PDP slot 0 reserved; VMINK is slot 1
DFRIG: KERNBASE              = 0xffffffff80000000     <- PDP slot 8190
DFRIG: KvaEnd                = 0xffffffffff1ff000
DFRIG: KPDPphys=0x22df000, pdp array entries = NKPML4E*NPDPEPG = 8192
DFRIG: pdp[8190] = 0x00000000022f0023 (frame 0x0022f0000 V=1)   <- kernel-image PD page
DFRIG: pdp[8191] = 0x00000000022f1023 (frame 0x0022f1000 V=1)   <- last-KVA-slot PD page
DFRIG: walk1 computes i = (va - VM_MIN_KERNEL_ADDRESS) >> PDPSHIFT
DFRIG:   for va=KERNBASE: walk1 i = 8189, correct slot = 8190
DFRIG:   walk1 max i (va=KvaEnd-1) = 8190, so pdp[8191] is never read
DFRIG: slot8191 PD page (0x22f1000): 512/512 present entries (first j=0 val=0x1fe6003)
DFRIG: slot8191 content: 512 PT pages, 0 2M pages, 0 leaf 4K mappings LOST from dump
DFRIG: maptest: va1=0xffffffffd0000000 (slot 8191) -> pa 0xaa603000, pre-panic bit=0
DFRIG: maptest: va2=0xffffffffa0000000 (slot 8190) -> pa 0xaae01000, pre-panic bit=0
panic: DF-5535 maptest: slot-8191 mapping vs slot-8190 control
...
Physical memory: 4060 MB
Dumping 680 MB: 665 649 ... 9
Dump complete

(after reboot, savecore -> /var/crash/vmcore.1)

$ /root/mddiag/dumpchk /var/crash/vmcore.1 0xaa603000 0xaae01000
minidump: version=2 msgbufsize=1048544 bitmapsize=163840 ptesize=2097152
bitmap at file offset 1052672 (163840 bytes)
pa 0x0aa603000 (page 697859): CLEAR (MISSING from dump)     <- slot 8191 page
pa 0x0aae01000 (page 699905): SET (in dump)                 <- slot 8190 control

RESULT: page mapped at va 0xffffffffd0000000 (PDP slot 8191) is silently absent
from the minidump; the identically-created page in slot 8190 is present.
Root cause: minidump_machdep.c:238/252 index the KPDPPHYS_KVA-based pdp[] array
with a VM_MIN_KERNEL_ADDRESS-relative index (off by one slot; slot 0 reserved),
so i never reaches 8191 and pdp[8191] (the PD for the last 1GB of KVA,
[0xffffffffc0000000, KvaEnd)) is never walked.