Index: vm/vm_fault.c
===================================================================
--- vm/vm_fault.c	(revision 297444)
+++ vm/vm_fault.c	(working copy)
@@ -423,6 +423,8 @@ fast_failed:
 		 * If the object is dead, we stop here
 		 */
 		if (fs.object->flags & OBJ_DEAD) {
+printf("%d vm_fault OBJ_DEAD %p\n", curproc->p_pid, fs.object);
+stack_print(&fs.object->dead_stack);
 			unlock_and_deallocate(&fs);
 			return (KERN_PROTECTION_FAILURE);
 		}
Index: vm/vm_object.c
===================================================================
--- vm/vm_object.c	(revision 297444)
+++ vm/vm_object.c	(working copy)
@@ -265,6 +265,7 @@ _vm_object_allocate(objtype_t type, vm_pindex_t si
 	LIST_INIT(&object->rvq);
 #endif
 	umtx_shm_object_init(object);
+stack_zero(&object->dead_stack);
 }
 
 /*
Index: vm/vm_object.h
===================================================================
--- vm/vm_object.h	(revision 297444)
+++ vm/vm_object.h	(working copy)
@@ -74,6 +74,8 @@
 
 #include <vm/_vm_radix.h>
 
+#include <sys/stack.h>
+
 /*
  *	Types defined:
  *
@@ -175,6 +177,7 @@ struct vm_object {
 	struct ucred *cred;
 	vm_ooffset_t charge;
 	void *umtx_data;
+	struct stack dead_stack;
 };
 
 /*
@@ -257,6 +260,7 @@ static __inline void
 vm_object_set_flag(vm_object_t object, u_short bits)
 {
 
+if ((bits & OBJ_DEAD) != 0) stack_save(&object->dead_stack);
 	object->flags |= bits;
 }