panic: pmap_demote_pde: firstpte and newpte map different physical addresses

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 13c96c4b revert r273728 and parts of r306589, iicbus no-st..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=17416e5ca00000
dashboard link: https://syzkaller.appspot.com/bug?extid=9f82d1ae1d95ceb85eca

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+9f82d1...@syzkaller.appspotmail.com

panic: pmap_demote_pde: firstpte and newpte map different physical addresses
cpuid = 1
time = 550
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame
0xfffffe001f61d1f0
vpanic() at vpanic+0x1e0/frame 0xfffffe001f61d250
panic() at panic+0x43/frame 0xfffffe001f61d2b0
pmap_demote_pde_locked() at pmap_demote_pde_locked+0x127e/frame
0xfffffe001f61d380
pmap_remove_all() at pmap_remove_all+0x38e/frame 0xfffffe001f61d420
vm_object_page_remove() at vm_object_page_remove+0x187/frame
0xfffffe001f61d480
vnode_pager_setsize() at vnode_pager_setsize+0x107/frame 0xfffffe001f61d4d0
vtruncbuf() at vtruncbuf+0x50a/frame 0xfffffe001f61d530
ffs_truncate() at ffs_truncate+0x16bd/frame 0xfffffe001f61d720
ufs_setattr() at ufs_setattr+0x918/frame 0xfffffe001f61d7c0
VOP_SETATTR_APV() at VOP_SETATTR_APV+0xc2/frame 0xfffffe001f61d7f0
vn_truncate() at vn_truncate+0x246/frame 0xfffffe001f61d930
kern_ftruncate() at kern_ftruncate+0x13b/frame 0xfffffe001f61d980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe001f61dab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001f61dab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41311a, rsp =
0x7fffdfffdf38, rbp = 0x2 ---
KDB: enter: panic
[ thread pid 4249 tid 100961 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.