> Very interesting!  Can you describe when case 1 happens?

It happens in exactly the case I mentioned -- prefaulting.  UVM will
attempt to (depending on the `advice' for that region of memory) load
in some pages before and/or after the one that was faulted on, in
order to avoid the overhead of taking multiple faults and possibly
doing scattered pageins.

Since we don't actually know that these pages are going to be used, we
map them with an `access_type' of 0 and gather R/M information as they
are used (possibly by taking additional faults on machines where it's
emulated).

> (I thought pmap_enter was ONLY called by vm_fault!)

This case actually happens inside uvm_fault().  However, pmap_enter()
is *certainly* used in other places -- to map file system buffers, the
message buffer, internal pmap structures (on some ports),
vmapbuf()/vunmapbuf() (on some ports), bus_dma (on some ports), etc,
etc.  All you have to do is grep for it...