As reported in review D20709 by brooks calling vm_map_protect to set a new max_protection value downgrades existing mappings if necessary (as opposed to returning an error). Reported by: brooks MFC after: 1 week Sponsored by: The FreeBSD Foundation