Index: /trunk/include/iprt/err.h
===================================================================
--- /trunk/include/iprt/err.h	(revision 216)
+++ /trunk/include/iprt/err.h	(revision 217)
@@ -188,5 +188,15 @@
 /** The operation was cancelled by the user. */
 #define VERR_CANCELLED                      (-70)
-
+/** Failed to initialize a memory object.
+ * Exactly what this means is OS specific. */
+#define VERR_MEMOBJ_INIT_FAILED             (-71)
+/** Out of memory condition when allocating memory with low physical backing. */
+#define VERR_NO_LOW_MEMORY                  (-72)
+/** Out of memory condition when allocating physical memory (without mapping). */
+#define VERR_NO_PHYS_MEMORY                 (-73)
+/** The address (virtual or physical) is too big. */
+#define VERR_ADDRESS_TOO_BIG                (-74)
+/** Failed to map a memory object. */
+#define VERR_MAP_FAILED                     (-75)
 /** @} */
 
Index: /trunk/src/VBox/Runtime/include/internal/memobj.h
===================================================================
--- /trunk/src/VBox/Runtime/include/internal/memobj.h	(revision 216)
+++ /trunk/src/VBox/Runtime/include/internal/memobj.h	(revision 217)
@@ -186,5 +186,4 @@
     } u;
 
-
 } RTR0MEMOBJINTERNAL;
 
Index: /trunk/src/VBox/Runtime/r0drv/alloc-r0drv.cpp
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/alloc-r0drv.cpp	(revision 216)
+++ /trunk/src/VBox/Runtime/r0drv/alloc-r0drv.cpp	(revision 217)
@@ -157,5 +157,8 @@
 RTDECL(void) RTMemFree(void *pv)
 {
-    PRTMEMHDR pHdr = (PRTMEMHDR)pv - 1;
+    PRTMEMHDR pHdr;
+    if (!pv)
+        return;
+    pHdr = (PRTMEMHDR)pv - 1;
     if (pHdr->u32Magic == RTMEMHDR_MAGIC)
     {
Index: /trunk/src/VBox/Runtime/r0drv/darwin/memobj-r0drv-darwin.cpp
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/darwin/memobj-r0drv-darwin.cpp	(revision 216)
+++ /trunk/src/VBox/Runtime/r0drv/darwin/memobj-r0drv-darwin.cpp	(revision 217)
@@ -35,12 +35,306 @@
 
 
+/*******************************************************************************
+*   Structures and Typedefs                                                    *
+*******************************************************************************/
+/**
+ * The Darwin version of the memory object structure.
+ */
+typedef struct RTR0MEMOBJDARWIN
+{
+    /** The core structure. */
+    RTR0MEMOBJINTERNAL  Core;
+    /** Pointer to the memory descriptor created for allocated and locked memory. */
+    IOMemoryDescriptor *pMemDesc;
+    /** Pointer to the memory mapping object for mapped memory. */
+    IOMemoryMap        *pMemMap;
+} RTR0MEMOBJDARWIN, *PRTR0MEMOBJDARWIN;
+
 
 int rtR0MemObjNativeFree(RTR0MEMOBJ pMem)
 {
+    PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)pMem;
+
+    /*
+     * Release the IOMemoryDescriptor/IOMemoryMap associated with the object.
+     */
+    if (pMemDarwin->pMemDesc)
+    {
+        pMemDarwin->pMemDesc->release();
+        pMemDarwin->pMemDesc = NULL;
+        Assert(!pMemDarwin->pMemMap);
+    }
+    else if (pMemDarwin->pMemMap)
+    {
+        pMemDarwin->pMemMap->release();
+        pMemDarwin->pMemMap = NULL;
+    }
+
+    /*
+     * Release any memory that we've allocated or locked.
+     */
+    switch (pMemDarwin->Core.enmType)
+    {
+        case RTR0MEMOBJTYPE_PAGE:
+            IOFreeAligned(pMemDarwin->Core.pv, pMemDarwin->Core.cb);
+            break;
+
+        /*case RTR0MEMOBJTYPE_LOW: => RTR0MEMOBJTYPE_CONT
+            break;*/
+
+        case RTR0MEMOBJTYPE_CONT:
+            IOFreeContiguous(pMemDarwin->Core.pv, pMemDarwin->Core.cb);
+            break;
+
+        case RTR0MEMOBJTYPE_LOCK:
+            AssertMsgFailed(("RTR0MEMOBJTYPE_LOCK\n"));
+            return VERR_INTERNAL_ERROR;
+            break;
+
+        case RTR0MEMOBJTYPE_PHYS:
+            /*if (pMemDarwin->Core.u.Phys.fAllocated)
+                IOFreePhysical(pMemDarwin->Core.u.Phys.PhysBase, pMemDarwin->Core.cb);*/
+            Assert(!pMemDarwin->Core.u.Phys.fAllocated);
+            break;
+
+        case RTR0MEMOBJTYPE_RES_VIRT:
+            AssertMsgFailed(("RTR0MEMOBJTYPE_RES_VIRT\n"));
+            return VERR_INTERNAL_ERROR;
+            break;
+
+        case RTR0MEMOBJTYPE_MAPPING:
+            /* nothing to do here. */
+            break;
+
+        default:
+            AssertMsgFailed(("enmType=%d\n", pMemDarwin->Core.enmType));
+            return VERR_INTERNAL_ERROR;
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+int rtR0MemObjNativeAllocPage(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+{
+    /*
+     * Try allocate the memory and create it's IOMemoryDescriptor first.
+     */
+    int rc = VERR_NO_PAGE_MEMORY;
+    AssertCompile(sizeof(IOPhysicalAddress) == 4);
+    void *pv = IOMallocAligned(cb, PAGE_SIZE);
+    if (pv)
+    {
+        IOMemoryDescriptor *pMemDesc = IOMemoryDescriptor::withAddress((vm_address_t)pv, cb, kIODirectionInOut, kernel_task);
+        if (pMemDesc)
+        {
+            /*
+             * Create the IPRT memory object.
+             */
+            PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)rtR0MemObjNew(sizeof(*pMemDarwin), RTR0MEMOBJTYPE_PAGE, pv, cb);
+            if (pMemDarwin)
+            {
+                pMemDarwin->pMemDesc = pMemDesc;
+                *ppMem = &pMemDarwin->Core;
+                return VINF_SUCCESS;
+            }
+
+            rc = VERR_NO_MEMORY;
+            pMemDesc->release();
+        }
+        else
+            rc = VERR_MEMOBJ_INIT_FAILED;
+        IOFreeAligned(pv, cb);
+    }
+    return rc;
+}
+
+
+int rtR0MemObjNativeAllocLow(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+{
+    /*
+     * IOMallocContiguous is the most suitable API.
+     */
+    return rtR0MemObjNativeAllocCont(ppMem, cb, fExecutable);
+}
+
+
+int rtR0MemObjNativeAllocCont(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+{
+    /*
+     * Try allocate the memory and create it's IOMemoryDescriptor first.
+     */
+    int rc = VERR_NO_CONT_MEMORY;
+    AssertCompile(sizeof(IOPhysicalAddress) == 4);
+    void *pv = IOMallocContiguous(cb, PAGE_SIZE, NULL);
+    if (pv)
+    {
+        IOMemoryDescriptor *pMemDesc = IOMemoryDescriptor::withAddress((vm_address_t)pv, cb, kIODirectionInOut, kernel_task);
+        if (pMemDesc)
+        {
+            /* a bit of useful paranoia. */
+            addr64_t PhysAddr = pMemDesc->getPhysicalSegment64(0, NULL);
+            Assert(PhysAddr == pMemDesc->getPhysicalAddress());
+            if (    PhysAddr > 0
+                &&  PhysAddr <= _4G
+                &&  PhysAddr + cb <= _4G)
+            {
+                /*
+                 * Create the IPRT memory object.
+                 */
+                PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)rtR0MemObjNew(sizeof(*pMemDarwin), RTR0MEMOBJTYPE_CONT, pv, cb);
+                if (pMemDarwin)
+                {
+                    pMemDarwin->Core.u.Cont.Phys = PhysAddr;
+                    pMemDarwin->pMemDesc = pMemDesc;
+                    *ppMem = &pMemDarwin->Core;
+                    return VINF_SUCCESS;
+                }
+
+                rc = VERR_NO_MEMORY;
+            }
+            else
+            {
+                AssertMsgFailed(("PhysAddr=%llx\n", (unsigned long long)PhysAddr));
+                rc = VERR_INTERNAL_ERROR;
+            }
+            pMemDesc->release();
+        }
+        else
+            rc = VERR_MEMOBJ_INIT_FAILED;
+        IOFreeContiguous(pv, cb);
+    }
+    return rc;
+}
+
+
+int rtR0MemObjNativeAllocPhys(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, RTHCPHYS PhysHighest)
+{
+#if 0 /* turned out IOMallocPhysical isn't exported yet. sigh. */
+    /*
+     * Try allocate the memory and create it's IOMemoryDescriptor first.
+     * Note that IOMallocPhysical is not working correctly (it's ignoring the mask).
+     */
+
+    /* first calc the mask (in the hope that it'll be used) */
+    IOPhysicalAddress PhysMask = ~(IOPhysicalAddress)PAGE_OFFSET_MASK;
+    if (PhysHighest != NIL_RTHCPHYS)
+    {
+        PhysMask = ~(IOPhysicalAddress)0;
+        while (PhysMask > PhysHighest)
+            PhysMask >>= 1;
+        AssertReturn(PhysMask + 1 < cb, VERR_INVALID_PARAMETER);
+        PhysMask &= ~(IOPhysicalAddress)PAGE_OFFSET_MASK;
+    }
+
+    /* try allocate physical memory. */
+    int rc = VERR_NO_PHYS_MEMORY;
+    mach_vm_address_t PhysAddr64 = IOMallocPhysical(cb, PhysMask);
+    if (PhysAddr64)
+    {
+        IOPhysicalAddress PhysAddr = PhysAddr64;
+        if (    PhysAddr == PhysAddr64
+            &&  PhysAddr < PhysHighest
+            &&  PhysAddr + cb <= PhysHighest)
+        {
+            /* create a descriptor. */
+            IOMemoryDescriptor *pMemDesc = IOMemoryDescriptor::withPhysicalAddress(PhysAddr, cb, kIODirectionInOut);
+            if (pMemDesc)
+            {
+                Assert(PhysAddr == pMemDesc->getPhysicalAddress());
+
+                /*
+                 * Create the IPRT memory object.
+                 */
+                PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)rtR0MemObjNew(sizeof(*pMemDarwin), RTR0MEMOBJTYPE_PHYS, NULL, cb);
+                if (pMemDarwin)
+                {
+                    pMemDarwin->Core.u.Phys.PhysBase = PhysAddr;
+                    pMemDarwin->Core.u.Phys.fAllocated = true;
+                    pMemDarwin->pMemDesc = pMemDesc;
+                    *ppMem = &pMemDarwin->Core;
+                    return VINF_SUCCESS;
+                }
+
+                rc = VERR_NO_MEMORY;
+                pMemDesc->release();
+            }
+            else
+                rc = VERR_MEMOBJ_INIT_FAILED;
+        }
+        else
+        {
+            AssertMsgFailed(("PhysAddr=%#llx PhysAddr64=%#llx PhysHigest=%#llx\n", (unsigned long long)PhysAddr,
+                             (unsigned long long)PhysAddr64, (unsigned long long)PhysHighest));
+            rc = VERR_INTERNAL_ERROR;
+        }
+
+        IOFreePhysical(PhysAddr64, cb);
+    }
+
+    /*
+     * Just in case IOMallocContigus doesn't work right, we can try fall back
+     * on a contiguous allcation.
+     */
+    if (rc == VERR_INTERNAL_ERROR || rc == VERR_NO_PHYS_MEMORY)
+    {
+        int rc2 = rtR0MemObjNativeAllocCont(ppMem, cb, false);
+        if (RT_SUCCESS(rc2))
+            rc = rc2;
+    }
+
+    return rc;
+
+#else
+
+    return rtR0MemObjNativeAllocCont(ppMem, cb, false);
+#endif
+}
+
+
+int rtR0MemObjNativeEnterPhys(PPRTR0MEMOBJINTERNAL ppMem, RTHCPHYS Phys, size_t cb)
+{
+    /*
+     * Validate the address range and create a descriptor for it.
+     */
+    int rc = VERR_ADDRESS_TOO_BIG;
+    IOPhysicalAddress PhysAddr = Phys;
+    if (PhysAddr == Phys)
+    {
+        IOMemoryDescriptor *pMemDesc = IOMemoryDescriptor::withPhysicalAddress(PhysAddr, cb, kIODirectionInOut);
+        if (pMemDesc)
+        {
+            Assert(PhysAddr == pMemDesc->getPhysicalAddress());
+
+            /*
+             * Create the IPRT memory object.
+             */
+            PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)rtR0MemObjNew(sizeof(*pMemDarwin), RTR0MEMOBJTYPE_PHYS, NULL, cb);
+            if (pMemDarwin)
+            {
+                pMemDarwin->Core.u.Phys.PhysBase = PhysAddr;
+                pMemDarwin->Core.u.Phys.fAllocated = false;
+                pMemDarwin->pMemDesc = pMemDesc;
+                *ppMem = &pMemDarwin->Core;
+                return VINF_SUCCESS;
+            }
+
+            rc = VERR_NO_MEMORY;
+            pMemDesc->release();
+        }
+    }
+    else
+        AssertMsgFailed(("%#llx\n", (unsigned long long)Phys));
+    return rc;
+}
+
+
+int rtR0MemObjNativeLockUser(PPRTR0MEMOBJINTERNAL ppMem, void *pv, size_t cb)
+{
     return VERR_NOT_IMPLEMENTED;
 }
 
 
-int rtR0MemObjNativeAllocPage(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+int rtR0MemObjNativeLockKernel(PPRTR0MEMOBJINTERNAL ppMem, void *pv, size_t cb)
 {
     return VERR_NOT_IMPLEMENTED;
@@ -48,5 +342,5 @@
 
 
-int rtR0MemObjNativeAllocLow(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+int rtR0MemObjNativeReserveKernel(PPRTR0MEMOBJINTERNAL ppMem, void *pvFixed, size_t cb, size_t uAlignment)
 {
     return VERR_NOT_IMPLEMENTED;
@@ -54,5 +348,5 @@
 
 
-int rtR0MemObjNativeAllocCont(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, bool fExecutable)
+int rtR0MemObjNativeReserveUser(PPRTR0MEMOBJINTERNAL ppMem, void *pvFixed, size_t cb, size_t uAlignment)
 {
     return VERR_NOT_IMPLEMENTED;
@@ -60,43 +354,44 @@
 
 
-int rtR0MemObjNativeLockUser(PPRTR0MEMOBJINTERNAL ppMem, void *pv, size_t cb)
-{
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
-int rtR0MemObjNativeLockKernel(PPRTR0MEMOBJINTERNAL ppMem, void *pv, size_t cb)
-{
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
-int rtR0MemObjNativeAllocPhys(PPRTR0MEMOBJINTERNAL ppMem, size_t cb, RTHCPHYS PhysHighest)
-{
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
-int rtR0MemObjNativeEnterPhys(PPRTR0MEMOBJINTERNAL ppMem, RTHCPHYS Phys, size_t cb)
-{
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
-int rtR0MemObjNativeReserveKernel(PPRTR0MEMOBJINTERNAL ppMem, void *pvFixed, size_t cb, size_t uAlignment)
-{
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
-int rtR0MemObjNativeReserveUser(PPRTR0MEMOBJINTERNAL ppMem, void *pvFixed, size_t cb, size_t uAlignment)
-{
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
 int rtR0MemObjNativeMapKernel(PPRTR0MEMOBJINTERNAL ppMem, RTR0MEMOBJ pMemToMap, void *pvFixed, size_t uAlignment, unsigned fProt)
 {
-    return VERR_NOT_IMPLEMENTED;
+    /*
+     * Must have a memory descriptor.
+     */
+    int rc = VERR_INVALID_PARAMETER;
+    PRTR0MEMOBJDARWIN pMemToMapDarwin = (PRTR0MEMOBJDARWIN)pMemToMap;
+    if (pMemToMapDarwin->pMemDesc)
+    {
+        IOMemoryMap *pMemMap = pMemToMapDarwin->pMemDesc->map(kernel_task, kIOMapAnywhere,
+                                                              kIOMapAnywhere | kIOMapDefaultCache);
+        if (pMemMap)
+        {
+            IOVirtualAddress VirtAddr = pMemMap->getVirtualAddress();
+            void *pv = (void *)(uintptr_t)VirtAddr;
+            if ((uintptr_t)pv == VirtAddr)
+            {
+                /*
+                 * Create the IPRT memory object.
+                 */
+                PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)rtR0MemObjNew(sizeof(*pMemDarwin), RTR0MEMOBJTYPE_MAPPING,
+                                                                                pv, pMemToMapDarwin->Core.cb);
+                if (pMemDarwin)
+                {
+                    pMemDarwin->Core.u.Mapping.Process = NIL_RTPROCESS;
+                    pMemDarwin->pMemMap = pMemMap;
+                    *ppMem = &pMemDarwin->Core;
+                    return VINF_SUCCESS;
+                }
+
+                rc = VERR_NO_MEMORY;
+            }
+            else
+                rc = VERR_ADDRESS_TOO_BIG;
+            pMemMap->release();
+        }
+        else
+            rc = VERR_MAP_FAILED;
+    }
+    return rc;
 }
 
@@ -104,11 +399,67 @@
 int rtR0MemObjNativeMapUser(PPRTR0MEMOBJINTERNAL ppMem, RTR0MEMOBJ pMemToMap, void *pvFixed, size_t uAlignment, unsigned fProt)
 {
-    return VERR_NOT_IMPLEMENTED;
-}
-
-
-RTHCPHYS rtR0MemObjNativeGetPagePhysAddr(RTR0MEMOBJ pMem, unsigned iPage)
-{
-    return NIL_RTHCPHYS;
-}
-
+    /*
+     * Must have a memory descriptor.
+     */
+    int rc = VERR_INVALID_PARAMETER;
+    PRTR0MEMOBJDARWIN pMemToMapDarwin = (PRTR0MEMOBJDARWIN)pMemToMap;
+    if (pMemToMapDarwin->pMemDesc)
+    {
+        Assert(current_task() != kernel_task);
+        IOMemoryMap *pMemMap = pMemToMapDarwin->pMemDesc->map(current_task(), kIOMapAnywhere,
+                                                              kIOMapAnywhere | kIOMapDefaultCache);
+        if (pMemMap)
+        {
+            IOVirtualAddress VirtAddr = pMemMap->getVirtualAddress();
+            void *pv = (void *)(uintptr_t)VirtAddr;
+            if ((uintptr_t)pv == VirtAddr)
+            {
+                /*
+                 * Create the IPRT memory object.
+                 */
+                PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)rtR0MemObjNew(sizeof(*pMemDarwin), RTR0MEMOBJTYPE_MAPPING,
+                                                                                pv, pMemToMapDarwin->Core.cb);
+                if (pMemDarwin)
+                {
+                    pMemDarwin->Core.u.Mapping.Process = /*RTProcSelf()*/(RTPROCESS)current_task();
+                    pMemDarwin->pMemMap = pMemMap;
+                    *ppMem = &pMemDarwin->Core;
+                    return VINF_SUCCESS;
+                }
+
+                rc = VERR_NO_MEMORY;
+            }
+            else
+                rc = VERR_ADDRESS_TOO_BIG;
+            pMemMap->release();
+        }
+        else
+            rc = VERR_MAP_FAILED;
+    }
+    return rc;
+}
+
+
+RTHCPHYS rtR0MemObjNativeGetPagePhysAddr(PRTR0MEMOBJINTERNAL pMem, unsigned iPage)
+{
+    PRTR0MEMOBJDARWIN pMemDarwin = (PRTR0MEMOBJDARWIN)pMem;
+
+    /*
+     * Get the memory descriptor.
+     */
+    IOMemoryDescriptor *pMemDesc = pMemDarwin->pMemDesc;
+    if (!pMemDesc)
+        pMemDesc = pMemDarwin->pMemMap->getMemoryDescriptor();
+    AssertReturn(pMemDesc, NIL_RTHCPHYS);
+
+
+    /*
+     * If we've got a memory descriptor, use getPhysicalSegment64().
+     */
+    addr64_t Addr = pMemDesc->getPhysicalSegment64(iPage * PAGE_SIZE, NULL);
+    AssertMsgReturn(Addr, ("iPage=%u\n", iPage), NIL_RTHCPHYS);
+    RTHCPHYS PhysAddr = Addr;
+    AssertMsgReturn(PhysAddr == Addr, ("PhysAddr=%VHp Addr=%RX64\n", PhysAddr, (uint64_t)Addr), NIL_RTHCPHYS);
+    return PhysAddr;
+}
+
Index: /trunk/src/VBox/Runtime/r0drv/darwin/the-darwin-kernel.h
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/darwin/the-darwin-kernel.h	(revision 216)
+++ /trunk/src/VBox/Runtime/r0drv/darwin/the-darwin-kernel.h	(revision 217)
@@ -60,4 +60,6 @@
 #include <IOKit/IOTypes.h>
 #include <IOKit/IOLib.h>
+#include <IOKit/IOMemoryDescriptor.h>
+#include <IOKit/IOMapper.h>
 
 
Index: /trunk/src/VBox/Runtime/r0drv/memobj-r0drv.cpp
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/memobj-r0drv.cpp	(revision 216)
+++ /trunk/src/VBox/Runtime/r0drv/memobj-r0drv.cpp	(revision 217)
@@ -92,4 +92,5 @@
             return VERR_NO_MEMORY;
         pParent->uRel.Parent.papMappings = (PPRTR0MEMOBJINTERNAL)pv;
+        pParent->uRel.Parent.cMappingsAllocated = i + 32;
         Assert(i == pParent->uRel.Parent.cMappings);
     }
@@ -97,4 +98,5 @@
     /* do the linking. */
     pParent->uRel.Parent.papMappings[i] = pChild;
+    pParent->uRel.Parent.cMappings++;
     pChild->uRel.Child.pParent = pParent;
 
@@ -188,5 +190,15 @@
     }
 
-    /* return the size. */
+    /*
+     * We know the address of physically contiguous allocations and mappings.
+     */
+    if (pMem->enmType == RTR0MEMOBJTYPE_CONT)
+        return pMem->u.Cont.Phys + iPage * PAGE_SIZE;
+    if (pMem->enmType == RTR0MEMOBJTYPE_PHYS)
+        return pMem->u.Phys.PhysBase + iPage * PAGE_SIZE;
+
+    /*
+     * Do the job.
+     */
     return rtR0MemObjNativeGetPagePhysAddr(pMem, iPage);
 }
@@ -263,4 +275,6 @@
             AssertFatal(pParent->enmType > RTR0MEMOBJTYPE_INVALID && pParent->enmType < RTR0MEMOBJTYPE_END);
             AssertFatal(!rtR0MemObjIsMapping(pParent));
+            AssertFatal(pParent->uRel.Parent.cMappings > 0);
+            AssertPtr(pParent->uRel.Parent.papMappings);
 
             /* locate and remove from the array of mappings. */
@@ -436,4 +450,5 @@
     const size_t cbAligned = RT_ALIGN_Z(cb, PAGE_SIZE);
     AssertReturn(cb <= cbAligned, VERR_INVALID_PARAMETER);
+    AssertReturn(PhysHighest >= cb, VERR_INVALID_PARAMETER);
 
     /* do the allocation. */
