MADV_FREE and wait4 EFAULT

[Carl Shapiro]

I am seeing wait4 system calls failing with an EFAULT and I am trying to
understand what might be going wrong.

An inspection of the wait4 implementation suggests the  opportunity for
EFAULT is within its invocations of copyout.  In my situation, the status
and rusage pointer arguments contain addresses to mmaped pages which have
been madvised as MADV_FREE.

Is it permissible to pass pages which have been madvised MADV_FREE to wait4
or any other system call for that matter?  Might there be another
opportunity for a wait4 to EFAULT?