Bug is in kern/pmap.c  boot_alloc() :
use ROUNDUP(n, PGSIZE), not ROUNDUP(nextfree, PGSIZE)
but who know why......