Ahh, I see what's going on.

The buffer is mapped with vmapbuf() in vm_machdep.c, which allocates
zero-fill VA space for the buffer, and then diddles the PTE's directly
to point them at the buffer's pages, without creating a pv_entry for
the requisite page.  

Then vunmapbuf calls uvm_km_free_wakeup to nuke the mapping, which
eventually winds up in pmap_remove_pv unable to find a pv_entry
which doesn't exist.

					- Bill