> I think I've come up with one... :) It only took many many hours of > staring at code to come up with: > > 1. Fault in PUD_SIZE-aligned hugetlb mapping > 2. fork() (to actually share the PMDs) Erm, I mean: mmap(), then fork(), then fault in both processes.