iounmap() passes a raw physical address to pmap_change_attr(), which requires a kernel virtual address — RAM-backed ioremap cleanup writes PTEs via vtopte() on a user-range address (page-fault panic or silent cache-attr corruption)

Summary

The restore-WB fixup hands paddr to a VA-taking API - every physaddr takes the non-DMAP vtopte branch on a user-range address with no intermediate tables in kernel_pmap: panic or silent cache-attr rewrite of an unrelated mapping. Root-gated via the ADDMAP/RMMap path (x86-64 offset check compiled out there). PHYS_TO_DMAP fix.