Summary

vunmap() searches vmap_list for addr on match does pmap_qremove/kmem_free then goto found. found: label at line 87 is ALSO fall-through target when SLIST_FOREACH_MUTABLE loop (77-85) exhausts without finding addr -- vmp is NULL (loop terminates var==NULL per queue.h:177-180). Execution then unconditionally reaches SLIST_REMOVE(&vmap_list NULL vmap vm_vmaps) (line 89) which dereferences NULL inside SLIST_REMOVE macro (queue.h:208-220) and panics. Calling vunmap() on any address not currently in vmap_list (double-vunmap error path or TOCTOU with concurrent vunmap) is guaranteed deterministic kernel panic. Reachable: local user with DRM device access DRM ioctls cause i915 to call vunmap(). i915 guards with is_vmalloc_addr(ptr) but is_vmalloc_addr takes no lock reads same shared list concurrent vmap/vunmap can remove entries between check and call making vunmap fail to find ptr hit NULL-deref.