Seems like the Linux codepath always sets MAP_32BIT inside vm_acquire. I think the FreeBSD code should do the same (via MAP_FIXED?).