I did some backtracking today how the permission flow worked. With the maximum VM flags defined for a page, what if EADD is done after mmap()? E.g. we first do mmap() with RWX and later EADD with lets say RW. The first thing that comes to mind is that the #PF handler should caught this corner case. Now the code correctly validates when you do either mmap() and mprotect() after EADD(s) but I think "other way around" is missing. /Jarkko