@@ -746,58 +771,62 @@ DECLHIDDEN(int) rtR0MemObjNativeMapUser(
     vm_offset_t AddrR3 = round_page((vm_offset_t)pProc->p_vmspace->vm_daddr + lim_max(pProc, RLIMIT_DATA));
     PROC_UNLOCK(pProc);
 
-    /* Insert the object in the map. */
+    // XXX pMemToMap should probably always have a companion vm_object_t
+    vm_pindex_t cPages = atop(pMemToMap->cb);
+    vm_object_t pObject;
+    vm_ooffset_t ObjOffset;
+
+    if (   pMemToMap->enmType == RTR0MEMOBJTYPE_PHYS
+        || pMemToMap->enmType == RTR0MEMOBJTYPE_PHYS_NC)
+    {
+        /* We do not bump object reference, so it should be autodestroyed upon unmapping */
+        ObjOffset = 0;
+        pObject = vm_object_allocate(OBJT_DEFAULT, cPages);
+        if (!pObject)
+            return VERR_NO_MEMORY;
+
+        /* Mapping physical allocations */
+        Assert(cPages == pMemToMapFreeBSD->u.Phys.cPages);
+
+        /* Insert the memory page by page into the object. */
+        for (vm_pindex_t iPage = 0; iPage < cPages; iPage++)
+        {
+            vm_page_t pPage = pMemToMapFreeBSD->u.Phys.apPages[iPage];
+            pPage->valid = VM_PAGE_BITS_ALL; // ???
+            vm_page_insert(pPage, pObject, iPage);
+            //vm_page_dirty(pPage);
+        }
+    }
+    else
+    {
+        /* Mapping cont or low memory types where pages belong to kernel_object */
+        ObjOffset = (vm_offset_t)pMemToMap->pv - VM_MIN_KERNEL_ADDRESS;
+        pObject = kernel_object;
+        vm_object_reference(pObject);
+
+        for (vm_pindex_t iPage = 0; iPage < cPages; iPage++)
+        {
+            vm_page_t pPage = vm_page_lookup(kernel_object, atop(ObjOffset) + iPage);
+            pPage->valid = VM_PAGE_BITS_ALL; // ???
+            //vm_page_dirty(pPage);
+        }
+    }
+
+    /* Insert the pObject in the map. */
     rc = vm_map_find(pProcMap,              /* Map to insert the object in */
-                     NULL,                  /* Object to map */
-                     0,                     /* Start offset in the object */
+                     pObject,               /* Object to map */
+                     ObjOffset,             /* Start offset in the object */
                      &AddrR3,               /* Start address IN/OUT */
                      pMemToMap->cb,         /* Size of the mapping */
-                     TRUE,                  /* Whether a suitable address should be searched for first */
+                     VMFS_ANY_SPACE,        /* Whether a suitable address should be searched for first */
                      ProtectionFlags,       /* protection flags */
                      VM_PROT_ALL,           /* Maximum protection flags */
-                     0);                    /* Copy on write */
+                     0);                    /* */
 
-    /* Map the memory page by page into the destination map. */
     if (rc == KERN_SUCCESS)
     {
-        size_t         cPages       = pMemToMap->cb >> PAGE_SHIFT;;
-        pmap_t         pPhysicalMap = pProcMap->pmap;
-        vm_offset_t    AddrR3Dst    = AddrR3;
-
-        if (   pMemToMap->enmType == RTR0MEMOBJTYPE_PHYS
-            || pMemToMap->enmType == RTR0MEMOBJTYPE_PHYS_NC
-            || pMemToMap->enmType == RTR0MEMOBJTYPE_PAGE)
-        {
-            /* Mapping physical allocations */
-            Assert(cPages == pMemToMapFreeBSD->u.Phys.cPages);
-
-            /* Insert the memory page by page into the mapping. */
-            for (uint32_t iPage = 0; iPage < cPages; iPage++)
-            {
-                vm_page_t pPage = pMemToMapFreeBSD->u.Phys.apPages[iPage];
+        vm_map_wire(pProcMap, AddrR3, AddrR3 + pMemToMap->cb, VM_MAP_WIRE_USER|VM_MAP_WIRE_NOHOLES|VM_MAP_WIRE_WRITE);
 
-                MY_PMAP_ENTER(pPhysicalMap, AddrR3Dst, pPage, ProtectionFlags, TRUE);
-                AddrR3Dst += PAGE_SIZE;
-            }
-        }
-        else
-        {
-            /* Mapping cont or low memory types */
-            vm_offset_t AddrToMap = (vm_offset_t)pMemToMap->pv;
-
-            for (uint32_t iPage = 0; iPage < cPages; iPage++)
-            {
-                vm_page_t pPage = PHYS_TO_VM_PAGE(vtophys(AddrToMap));
-
-                MY_PMAP_ENTER(pPhysicalMap, AddrR3Dst, pPage, ProtectionFlags, TRUE);
-                AddrR3Dst += PAGE_SIZE;
-                AddrToMap += PAGE_SIZE;
-            }
-        }
-    }
-
-    if (RT_SUCCESS(rc))
-    {
         /*
          * Create a mapping object for it.
          */
@@ -817,6 +846,7 @@ DECLHIDDEN(int) rtR0MemObjNativeMapUser(
         AssertMsg(rc == KERN_SUCCESS, ("Deleting mapping failed\n"));
     }
 
+    vm_object_deallocate(pObject);
     return VERR_NO_MEMORY;
 }