pmap_extract()/pmap_kextract() return (va & PAGE_MASK)-only garbage as a physical address when the PT exists but the PTE is empty — vkernel twin of pc64 DF-5245; live caller kvm_access_check() (/dev/kmem) then accepts unmapped KVA and mem I/O lands on guest-physical page 0

Summary

Both extract fns test the PDE only: with a present PT page but zero PTE they return rtval = 0|offset - a non-zero bogus PA for unmapped VA. Live caller kvm_access_check uses kextract==0 as the unmapped test: root-in-guest /dev/kmem I/O to hole KVA passes and resolves to guest-phys page 0 instead of EFAULT. Other callers landmine-only (no live vkernel drivers do user-pmap bus_dma). Test-the-PTE fix, twin of DF-5245.