> While scrutinizing vm_mmap.c I noticed that a "hint" address
> (non-zero address when the MAP_FIXED flag is NOT set) does
> not appear to be checked to make sure it is in user space.
> 

The address is checked by other vm_map_* routines against the boundaries
in the VM map associated with the process. Though I guess you'll get
ENOMEM in stead of EINVAL.

-pk