From 643fd0d1e81003d08ec1b1c26ae77c0ef119dc70 Mon Sep 17 00:00:00 2001
From: Aiken Harris <harraiken91@gmail.com>
Date: Mon, 22 Dec 2025 15:00:14 +0100
Subject: [PATCH] Fix PTE free list sentinel handling

---
 xtoskrnl/mm/i686/pagemap.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/xtoskrnl/mm/i686/pagemap.cc b/xtoskrnl/mm/i686/pagemap.cc
index 2ca3cd6..ee66229 100644
--- a/xtoskrnl/mm/i686/pagemap.cc
+++ b/xtoskrnl/mm/i686/pagemap.cc
@@ -226,8 +226,8 @@ XTAPI
 ULONG_PTR
 MM::PageMapBasic::GetNextEntry(IN PMMPTE Pte)
 {
-    /* Return next entry in PTE list */
-    return Pte->Pml2.List.NextEntry;
+    /* Return next entry in PTE list, translating the hardware limit (0xFFFFF) to the logical sentinel (MAXULONG) */
+    return (Pte->Pml2.List.NextEntry == 0xFFFFF) ? MAXULONG : Pte->Pml2.List.NextEntry;
 }
 
 /**
@@ -435,8 +435,8 @@ VOID
 MM::PageMapBasic::SetNextEntry(IN PMMPTE Pte,
                                IN ULONG_PTR Value)
 {
-    /* Set next entry in PTE list */
-    Pte->Pml2.List.NextEntry = Value;
+    /* Set next entry in PTE list, translating the logical sentinel (MAXULONG) to the 20-bit hardware limit (0xFFFFF) */
+    Pte->Pml2.List.NextEntry = (Value == MAXULONG) ? 0xFFFFF : Value;
 }
 
 /**