There was a diff a while back (4 Dec 2019) that fixed a bad offset calculation in this function, but it seems to me that it made a couple other lines of code incorrect as a result. The diff below tweaks the lines so that they have their original intent (based on looking at the diff from when the function was introduced on 5 Jun 2016).
diff --git a/sys/uvm/uvm_map.c b/sys/uvm/uvm_map.c index 9ee15eaab94..6507fa66f65 100644 --- a/sys/uvm/uvm_map.c +++ b/sys/uvm/uvm_map.c @@ -3567,7 +3567,7 @@ uvm_share(struct vm_map *dstmap, vaddr_t dstaddr, vm_prot_t prot, /* hole in address space, bail out */ if (psrc_entry != NULL && psrc_entry->end != src_entry->start) break; - if (src_entry->start >= srcaddr + sz) + if (src_entry->start >= srcaddr + n) break; if (UVM_ET_ISSUBMAP(src_entry)) @@ -3603,7 +3603,7 @@ uvm_share(struct vm_map *dstmap, vaddr_t dstaddr, vm_prot_t prot, n -= len; dstva += len; srcaddr += len; - unmap_end = dstva + len; + unmap_end = dstva; if (n == 0) goto exit_unlock; }