You have tuned the maximum shm memory to 1G. You are trying to map 285MB into the address space.
In the shm model, an object is specified first using shmget(), but mapped later using(). The limit checking in shmget() succeeds, but shmat() fails to map it, probably here: error = uvm_map(&p->p_vmspace->vm_map, &attach_va, size, shm_handle->shm_object, 0, 0, UVM_MAPFLAG(prot, prot, MAP_INHERIT_SHARE, MADV_RANDOM, flags)); if (error) { Various flags are passed to uvm_map(). One of them is UVM_FLAG_FIXED, if you pass an address to shmat() 40265 probe CALL shmat(786432,0x40000000,0x2000<SHM_RND>) and 19536 probe CALL shmat(917504,0x40000000,0x2000<SHM_RND>) You do. Why do you believe that 285MB of memory is unused at address 0x40000000 ? We have strong address space randomization in many kernel and userland layers, (best to call it ASR instead of ASLR, because we tend to randomize ALL allocators, not just a (L)imited set of them). So on different runtimes, that range of the address space is allocated. There are ways to look at the address space of processes, but they require tweaking the default system behaviour so you're not going to do that. But anyways, in the new world order mmap() MAP_FIXED is hard to use, and so is passing non-NULL address to shmat(). You are better off letting the system choose the address, and if your software demands a certain address, well that's an unfortunate situation and there is no way around this.