Specifically, the pv entry was always being freed to the caller's pmap instead of the pmap to which the pv entry belongs.