Unmanaged device pager objects maintain a linked list of pages that were
returned from the fault handler.  Initially, such pages are valid, but
msync(MS_INVALIDATE) can mark them invalid (and clean).  They are not
removed from page tables (since they are unmanaged), but a subsequent
mlock() call can trigger a page fault that is handled by the pager.
dev_pager_getpages() then re-inserts the page into the linked list even
though it's already present there.

This patch fixes the problem by removing the linked list.  OBJ_PG_DTOR
is set, so vm_object_terminate_pages() does nothing, and
dev_pager_dealloc() instead handles cleanup of the object.

Add a regression test case which triggers a queue.h assertion failure in
unpatched kernels.

Note, in stable branches we should avoid changing the layout of struct
vm_object.

Approved by:	so
Security:	FreeBSD-SA-26:37.vm
Security:	CVE-2026-49418
Reported by:	slidybat
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D57743

Sponsored by:	Netflix
Reviewed by:	imp
Differential Revision:	https://reviews.freebsd.org/D52735

some test support libraries had escaped confinement and were found
wandering around the utilities package:

	/usr/tests/lib/csu/dynamiclib/libh_csu.so
	/usr/tests/lib/libthr/dlopen/h_pthread_dlopen.so
	/usr/tests/lib/libthr/dlopen/h_pthread_dlopen.so.1
	/usr/tests/sys/vm/stack/libsoxstack.so

these aren't built using bsd.test.mk, so they don't get the default
PACKAGE=tests option; set this by hand in their Makefiles to put them
back where they belong.

Reviewed by:	manu, des, emaste
Approved by:	des (mentor)
Differential Revision:	https://reviews.freebsd.org/D50147

We were previously unconditionally adding PROT_WRITE to the maxprot of
private mapping (because a private mapping can be written even if the
fd is read-only), but this might violate the user's PROT_MAX request.

While here, rename cap_maxprot to max_maxprot.  This is the intersection
of the maximum protections imposed by capsicum rights on the fd (not
really relevant for private mappings) and the user-required maximum
protections (which were not being obeyed).  In particular, cap_maxprot
is a misnomer after the introduction of PROT_MAX.

Add some regression test cases.  mmap__maxprot_shm fails without this
patch.

Note: Capsicum's CAP_MMAP_W is a bit ambiguous.  Should it be required
in order to create writeable private mappings?  Currently it is, even
though such mappings don't permit writes to the object referenced by the
fd.

Reported by:	brooks
Reviewed by:	brooks
MFC after:	1 month
Fixes:		c7841c6b8e41 ("Relax restrictions on private mappings of POSIX shm objects.")
Differential Revision:	https://reviews.freebsd.org/D46741

This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix

Modern GCC complains when casting pointers to integers of a different
size (even a larger one).  Switch from uint64_t to uintptr_t which will
always be the right size for a stack address instead of maybe being too
big.

Reviewed by:	dchagin, emaste
Differential Revision:	https://reviews.freebsd.org/D45087

The test tries to trigger creation of a superpage mapping in an
mlock()ed region.

MFC after:	2 weeks

To exit gracefully handle SIGSEGV and mark the test as failed.

MFC after:		3 days

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/