1. when reading the referenced/modified bits the TLB entry must be flushed
before reading the in-core version.
2. when wrapping up an entire segment in pmap_page_protect(), flush the PTPs
from the TLB to prevent a table-walking operation to pick up stale - or
possibly bogus - PTEs.
(hopefully I'll get a few of my hairs back now..)
57e61589e7