kern/60378: vga_post_free: unmap and pmap_update before freeing backing pages

>Number:         60378
>Category:       kern
>Synopsis:       vga_post_free: unmap and pmap_update before freeing backing pages
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jun 28 07:00:00 +0000 2026
>Originator:     Kevin Bowling
>Release:        trunk
>Organization:
NetBSD
>Environment:
>Description:
Move pmap_kremove and pmap_update ahead of uvm_pglistfree.
>How-To-Repeat:

>Fix:
diff --git a/sys/arch/x86/x86/vga_post.c b/sys/arch/x86/x86/vga_post.c
index 1b25623ba21e..07f07e21e91b 100644
--- a/sys/arch/x86/x86/vga_post.c
+++ b/sys/arch/x86/x86/vga_post.c
@@ -257,9 +257,9 @@ void
 vga_post_free(struct vga_post *sc)
 {
 
-       uvm_pglistfree(&sc->ram_backing);
        pmap_kremove(sc->sys_image, 1024 * 1024);
        pmap_update(pmap_kernel());
+       uvm_pglistfree(&sc->ram_backing);
        uvm_km_free(kernel_map, sc->sys_image, 1024 * 1024, UVM_KMF_VAONLY);
        kmem_free(sc, sizeof(*sc));
 }