Index: sys/uvm/uvm_map.c
===================================================================
RCS file: /cvsroot/src/sys/uvm/uvm_map.c,v
retrieving revision 1.341
diff -u -p -r1.341 uvm_map.c
--- sys/uvm/uvm_map.c	6 Aug 2016 15:13:14 -0000	1.341
+++ sys/uvm/uvm_map.c	25 Nov 2016 07:34:19 -0000
@@ -100,7 +100,7 @@ __KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 
 #endif
 
 #ifdef UVMHIST
-static struct kern_history_ent maphistbuf[100];
+static struct kern_history_ent maphistbuf[20000];
 UVMHIST_DEFINE(maphist) = UVMHIST_INITIALIZER(maphist, maphistbuf);
 #endif
 
@@ -1839,12 +1839,12 @@ uvm_map_findspace(struct vm_map *map, va
 		return (NULL);
 	}
 
-	/*
-	 * Look for the first possible address; if there's already
-	 * something at this address, we have to start after it.
-	 */
+	UVMHIST_LOG(maphist, "(hint=%l#x, topdown=%lu... post range check)",
+	    hint, topdown, 0, 0);
 
 	/*
+	 * Look for the first possible address
+	 *
 	 * @@@: there are four, no, eight cases to consider.
 	 *
 	 * 0: found,     fixed,     bottom up -> fail
@@ -1867,21 +1867,33 @@ uvm_map_findspace(struct vm_map *map, va
 
 	if ((flags & UVM_FLAG_FIXED) == 0 && hint == vm_map_min(map)) {
 		entry = map->first_free;
+		UVMHIST_LOG(maphist, "(entry=%#x... first_free)",
+		    entry, 0, 0, 0);
 	} else {
 		if (uvm_map_lookup_entry(map, hint, &entry)) {
+			UVMHIST_LOG(maphist, "(entry=%#x... found)",
+			    entry, 0, 0, 0);
 			/* "hint" address already in use ... */
 			if (flags & UVM_FLAG_FIXED) {
 				UVMHIST_LOG(maphist, "<- fixed & VA in use",
 				    0, 0, 0, 0);
 				return (NULL);
 			}
-			if (topdown)
+			if (topdown) {
 				/* Start from lower gap. */
 				entry = entry->prev;
+				UVMHIST_LOG(maphist, "(entry=%#x... topdown)",
+				    entry, 0, 0, 0);
+			}
 		} else if (flags & UVM_FLAG_FIXED) {
 			if (entry->next->start >= hint + length &&
-			    hint + length > hint)
+			    entry->end <= hint &&
+			    hint + length > hint) {
+				UVMHIST_LOG(maphist, "%#x <= %#x && %#x <= %#x",
+			   		 entry->end, hint, hint + length, entry->next->start);
+
 				goto found;
+			}
 
 			/* "hint" address is gap but too small */
 			UVMHIST_LOG(maphist, "<- fixed mapping failed",
@@ -1894,6 +1906,8 @@ uvm_map_findspace(struct vm_map *map, va
 			switch (uvm_map_space_avail(&hint, length,
 			    uoffset, align, flags, topdown, entry)) {
 			case 1:
+				UVMHIST_LOG(maphist, "(hint=%l#x, entry=%x... space_avail found)",
+				    hint, entry, 0, 0);
 				goto found;
 			case -1:
 				goto wraparound;
@@ -1911,6 +1925,8 @@ uvm_map_findspace(struct vm_map *map, va
 					goto notfound;
 				goto nextgap;
 			}
+			UVMHIST_LOG(maphist, "(hint=%l#x, entry=%x... fallthrough)",
+			    hint, entry, 0, 0);
 		}
 	}
 
@@ -1921,17 +1937,25 @@ uvm_map_findspace(struct vm_map *map, va
 
 	/* Try to find the space in the red-black tree */
 
+	UVMHIST_LOG(maphist, "(hint=%l#x, entry=%x... not fixed)",
+	    hint, entry, 0, 0);
 	/* Check slot before any entry */
 	hint = topdown ? entry->next->start - length : entry->end;
+	UVMHIST_LOG(maphist, "(hint=%l#x... not fixed updated)",
+	    hint, entry, 0, 0);
 	switch (uvm_map_space_avail(&hint, length, uoffset, align, flags,
 	    topdown, entry)) {
 	case 1:
+		UVMHIST_LOG(maphist, "(hint=%l#x, entry=%x... space_avail found)",
+		    hint, entry, 0, 0);
 		goto found;
 	case -1:
 		goto wraparound;
 	}
 
 nextgap:
+	UVMHIST_LOG(maphist, "(hint=%l#x... next gap)",
+	    hint, 0, 0, 0);
 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
 	/* If there is not enough space in the whole tree, we fail */
 	tmp = ROOT_ENTRY(map);
@@ -2013,6 +2037,8 @@ nextgap:
 		KASSERT(orig_hint <= prev->end);
 		hint = prev->end;
 	}
+	UVMHIST_LOG(maphist, "(hint=%l#x, prev=%x... )",
+	    hint, prev, 0, 0);
 	switch (uvm_map_space_avail(&hint, length, uoffset, align,
 	    flags, topdown, prev)) {
 	case 1:
@@ -2068,6 +2094,8 @@ nextgap:
 	 * restrictions.  Search the list instead.
 	 */
  listsearch:
+	UVMHIST_LOG(maphist, "(... listsearch)",
+	    0, 0, 0, 0);
 	/*
 	 * Look through the rest of the map, trying to fit a new region in
 	 * the gap between existing regions, or after the very last region.
@@ -2083,6 +2111,8 @@ nextgap:
 		switch (uvm_map_space_avail(&hint, length, uoffset, align,
 		    flags, topdown, entry)) {
 		case 1:
+			UVMHIST_LOG(maphist, "(hint=%l#x entry=%x...)",
+			    hint, entry, 0, 0);
 			goto found;
 		case -1:
 			goto wraparound;