KASSERT in old_dev_pager_fault checks paddr instead of dev_dmmap return value, never fires

Summary

old_dev_pager_fault at device_pager.c:360-361: paddr = pmap_phys_address(dev_dmmap(...)); KASSERT(paddr != -1). pmap_phys_address = ppn << PAGE_SHIFT, so dev_dmmap return -1 becomes 0xFFFFFFFFFFFFF000 (== -4096) never -1. KASSERT never fires when driver returns error at fault time after accepting at ctor time. Documented safety check is dead code. If it did fire, consequence would be mapping phys_addr=0xFFFFFFFFFFFFF000 (reserved bits set) -> MMU rejects -> SIGSEGV. No info disclosure/priv escalation. Fix: capture dev_dmmap return, KASSERT on that before the shift.