mmap( MAP_ANON) is broken on current. (was Still seeing Failed assertion: "p[i] == 0" on armv7 buildworld)

I have confirmed that jmalloc assertions are caused by mmap() failure. 
It can return non-zeroed page(s) for mmap(MAP_ANON), which is clearly a bug.

I have confirmed this on native ARMv7, and according to Mark, it is also 
reproducible on ARM32 and i386 jails. I think I saw it also on a 
memory-constrained (4 GB) aarch64, but I cannot reproduce it yet.

Have somebody idea how to identify vm faults associated with anon mmap 
to  trigger detection of this failure in kernel? Or any other hint?


Thanks,
Michal