pmap_remove_pages skips cross-CPU TLB invalidation (cpu_invltlb only, no smp_invltlb)

Summary

pmap_remove_pages at pmap.c:5728-5732: pmap_remove_noinval (smp_inval=0, no per-page IPI) then cpu_invltlb() local CPU only. Used during process exit for speed. Other CPUs with stale TLB entries for dying process retain them until next CR3 load. DFly x86-64 no PCID in this path (load_cr3 at :6456) so non-global entries flushed on context switch. Residual risk: interrupt-time speculative access on idle CPU with stale CR3 to page being reclaimed by page daemon -> transient info leak of <=1 cache-line. Defense-in-depth. Fix: smp_invltlb() or use pmap_remove (with SMP inval).