The addition of a locking assertion to vm_page_zero_invalid() has revealed

a long-time bug: vm_pager_get_pages() assumes that m[reqpage] contains a
valid page upon return from pgo_getpages().  In the case of the device
pager this page has been freed and replaced by a fake page.  The fake page
is properly inserted into the vm object but m[reqpage] is left pointing
to a freed page.  For now, update m[reqpage] to point to the fake page.

Submitted by:	tegge

sys/vm/device_pager.c

@@ -236,6 +236,7 @@ dev_pager_getpages(object, m, count, reqpage)
 		vm_page_free(m[i]);
 	vm_page_unlock_queues();
 	vm_page_insert(page, object, offset);
+	m[reqpage] = page;
 
 	return (VM_PAGER_OK);
 }