Sorry about the slow response. Anyway, it seems to come down to "will
a PDE that has been cached in the TLB be referenced while it's
queued for shootdown, but hasn't been invalidated yet".

Another CPU shouldn't reference it; the pmap should be locked at this
point.

As for 'random table walks'.. I guess the manual text you quoted doesn't
rule that out 100%, but it would seem very unlikely. If this really would
be a problem, you'd have to wait with freeing the page until the shootdown
has been handled. Which might not be hard to implement. Though I really
don't see this happening.. I think I need to be convinced by actual
occurences of the problem :-) Or maybe an Intel engineer who will
confirm that this can happen.

- Frank