untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ9TdYJa2HDKdITybCISVckLUDZO2kvMBEbWZk8CMFaXMaiAJVyplHeQt612H+qpfyzqeDTLoBKp7gY1G/DimOwE=

OpenBSD 6.0 errata 12, Oct 08, 2016:

Allocation of an amap with at least 131072 slots causes an integer overflow
that leads to an infinite loop.

Apply by doing:
    signify -Vep /etc/signify/openbsd-60-base.pub -x 012_amap.patch.sig \
	-m - | (cd /usr/src && patch -p0)

And then rebuild and install a kernel:
    cd /usr/src/sys/arch/`machine`/conf
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    config $KK
    cd ../compile/$KK
    make
    make install

Index: sys/uvm/uvm_amap.c
===================================================================
RCS file: /cvs/src/sys/uvm/uvm_amap.c,v
retrieving revision 1.75
diff -u -p -r1.75 uvm_amap.c
--- sys/uvm/uvm_amap.c	14 Jul 2016 16:23:49 -0000	1.75
+++ sys/uvm/uvm_amap.c	8 Oct 2016 15:12:14 -0000
@@ -268,7 +268,7 @@ amap_alloc1(int slots, int waitf, int la
 {
 	struct vm_amap *amap;
 	struct vm_amap_chunk *chunk, *tmp;
-	int chunks, chunkperbucket = 1, hashshift = 0;
+	int chunks, log_chunks, chunkperbucket = 1, hashshift = 0;
 	int buckets, i, n;
 	int pwaitf = (waitf == M_WAITOK) ? PR_WAITOK : PR_NOWAIT;
 
@@ -305,8 +305,11 @@ amap_alloc1(int slots, int waitf, int la
 		 * for the hash buckets of all amaps to exceed the maximal
 		 * amount of KVA memory reserved for amaps.
 		 */
+		for (log_chunks = 1; (chunks >> log_chunks) > 0; log_chunks++)
+			continue;
+
 		chunkperbucket = 1 << hashshift;
-		while ((1 << chunkperbucket) * 2 <= chunks) {
+		while (chunkperbucket + 1 < log_chunks) {
 			hashshift++;
 			chunkperbucket = 1 << hashshift;
 		}