alignment==0 passes the power-of-two check but means 'physical address 0' — guaranteed allocation failure after three full page-queue flush passes; plus copy-paste panic string in contigfree

Summary

(alignment & (alignment-1)) != 0 accepts alignment==0, but the scan then requires (phys & (alignment-1)) == 0 == phys == 0 — never free on real hardware. A caller passing 0 in the "no constraint" sense gets a deterministic failure that first runs three full passes of vm_contig_pg_clean over all 1024 inactive queues (and with M_WAITOK the active queues — "very, very slow"), stalling every contigmalloc caller including M_NOWAIT ones. boundary==0 is likewise accepted but harmless. Separately contigfree's zero-size panic names the wrong function ('vm_contig_pg_kmap' at :594). No in-tree caller passes 0 (all pass PAGE_SIZE/16/order-derived) — hardening. Fix: reject alignment==0 explicitly + fix the panic string.

Timeline

• 2026-09-02 Discovered during pass-2 audit of vm_contig.c (GLM 5.3).