Index: kernel/arch/ia64/src/mm/tlb.c
===================================================================
--- kernel/arch/ia64/src/mm/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/ia64/src/mm/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -484,5 +484,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa; /* faulting address */
@@ -490,11 +490,11 @@
 	ASSERT(!is_kernel_fault(va));
 
-	t = page_mapping_find(AS, va, true);
-	if (t) {
+	bool found = page_mapping_find(AS, va, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in software page hash table.
 		 * Insert it into data translation cache.
 		 */
-		itc_pte_copy(t);
+		itc_pte_copy(&t);
 	} else {
 		/*
@@ -600,11 +600,12 @@
 	
 	
-	pte_t *entry = page_mapping_find(as, va, true);
-	if (entry) {
+	pte_t t;
+	bool found = page_mapping_find(as, va, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into data translation cache.
 		 */
-		dtc_pte_copy(entry);
+		dtc_pte_copy(&t);
 	} else {
 		if (try_memmap_io_insertion(va, istate))
@@ -641,5 +642,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 	
@@ -649,13 +650,16 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, va, true);
-	ASSERT((t) && (t->p));
-	if ((t) && (t->p) && (t->w)) {
+	bool found = page_mapping_find(as, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+
+	if (found && t.p && t.w) {
 		/*
 		 * Update the Dirty bit in page tables and reinsert
 		 * the mapping into DTC.
 		 */
-		t->d = true;
-		dtc_pte_copy(t);
+		t.d = true;
+		dtc_pte_copy(&t);
 	} else {
 		as_page_fault(va, PF_ACCESS_WRITE, istate);
@@ -672,5 +676,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa;  /* faulting address */
@@ -678,13 +682,16 @@
 	ASSERT(!is_kernel_fault(va));
 	
-	t = page_mapping_find(AS, va, true);
-	ASSERT((t) && (t->p));
-	if ((t) && (t->p) && (t->x)) {
+	bool found = page_mapping_find(AS, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+
+	if (found && t.p && t.x) {
 		/*
 		 * Update the Accessed bit in page tables and reinsert
 		 * the mapping into ITC.
 		 */
-		t->a = true;
-		itc_pte_copy(t);
+		t.a = true;
+		itc_pte_copy(&t);
 	} else {
 		as_page_fault(va, PF_ACCESS_EXEC, istate);
@@ -701,5 +708,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 	
@@ -709,13 +716,16 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, va, true);
-	ASSERT((t) && (t->p));
-	if ((t) && (t->p)) {
+	bool found = page_mapping_find(as, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+
+	if (found && t.p) {
 		/*
 		 * Update the Accessed bit in page tables and reinsert
 		 * the mapping into DTC.
 		 */
-		t->a = true;
-		dtc_pte_copy(t);
+		t.a = true;
+		dtc_pte_copy(&t);
 	} else {
 		if (as_page_fault(va, PF_ACCESS_READ, istate) == AS_PF_FAULT) {
@@ -736,5 +746,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa;  /* faulting address */
@@ -745,7 +755,10 @@
 	 * Assume a write to a read-only page.
 	 */
-	t = page_mapping_find(AS, va, true);
-	ASSERT((t) && (t->p));
-	ASSERT(!t->w);
+	bool found = page_mapping_find(AS, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+	ASSERT(!t.w);
+
 	as_page_fault(va, PF_ACCESS_WRITE, istate);
 }
@@ -760,5 +773,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa;  /* faulting address */
@@ -766,16 +779,17 @@
 	ASSERT(!is_kernel_fault(va));
 
-	t = page_mapping_find(AS, va, true);
-	ASSERT(t);
-	
-	if (t->p) {
+	bool found = page_mapping_find(AS, va, true, &t);
+
+	ASSERT(found);
+	
+	if (t.p) {
 		/*
 		 * If the Present bit is set in page hash table, just copy it
 		 * and update ITC/DTC.
 		 */
-		if (t->x)
-			itc_pte_copy(t);
+		if (t.x)
+			itc_pte_copy(&t);
 		else
-			dtc_pte_copy(t);
+			dtc_pte_copy(&t);
 	} else {
 		as_page_fault(va, PF_ACCESS_READ, istate);
Index: kernel/arch/mips32/src/mm/tlb.c
===================================================================
--- kernel/arch/mips32/src/mm/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/mips32/src/mm/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -97,17 +97,17 @@
 	entry_lo_t lo;
 	uintptr_t badvaddr;
-	pte_t *pte;
+	pte_t pte;
 	
 	badvaddr = cp0_badvaddr_read();
 
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p) {
+	bool found = page_mapping_find(AS, badvaddr, true, &pte);
+	if (found && pte.p) {
 		/*
 		 * Record access to PTE.
 		 */
-		pte->a = 1;
-
-		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->d,
-		    pte->cacheable, pte->pfn);
+		pte.a = 1;
+
+		tlb_prepare_entry_lo(&lo, pte.g, pte.p, pte.d,
+		    pte.cacheable, pte.pfn);
 
 		/*
@@ -138,5 +138,5 @@
 	tlb_index_t index;
 	uintptr_t badvaddr;
-	pte_t *pte;
+	pte_t pte;
 
 	/*
@@ -162,6 +162,6 @@
 	badvaddr = cp0_badvaddr_read();
 
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p) {
+	bool found = page_mapping_find(AS, badvaddr, true, &pte);
+	if (found && pte.p) {
 		/*
 		 * Read the faulting TLB entry.
@@ -172,8 +172,8 @@
 		 * Record access to PTE.
 		 */
-		pte->a = 1;
-
-		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->d,
-		    pte->cacheable, pte->pfn);
+		pte.a = 1;
+
+		tlb_prepare_entry_lo(&lo, pte.g, pte.p, pte.d,
+		    pte.cacheable, pte.pfn);
 
 		/*
@@ -200,5 +200,5 @@
 	tlb_index_t index;
 	uintptr_t badvaddr;
-	pte_t *pte;
+	pte_t pte;
 
 	badvaddr = cp0_badvaddr_read();
@@ -224,6 +224,6 @@
 	}
 
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p && pte->w) {
+	bool found = page_mapping_find(AS, badvaddr, true, &pte);
+	if (found && pte.p && pte.w) {
 		/*
 		 * Read the faulting TLB entry.
@@ -234,9 +234,9 @@
 		 * Record access and write to PTE.
 		 */
-		pte->a = 1;
-		pte->d = 1;
-
-		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->w,
-		    pte->cacheable, pte->pfn);
+		pte.a = 1;
+		pte.d = 1;
+
+		tlb_prepare_entry_lo(&lo, pte.g, pte.p, pte.w,
+		    pte.cacheable, pte.pfn);
 
 		/*
Index: kernel/arch/ppc32/src/mm/pht.c
===================================================================
--- kernel/arch/ppc32/src/mm/pht.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/ppc32/src/mm/pht.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -49,21 +49,22 @@
  * @param access   Access mode that caused the fault.
  * @param istate   Pointer to interrupted state.
- *
- * @return PTE on success, NULL otherwise.
- *
- */
-static pte_t *find_mapping_and_check(as_t *as, uintptr_t badvaddr, int access,
-    istate_t *istate)
+ * @param[out] pte Structure that will receive a copy of the found PTE.
+ *
+ * @return True if the mapping was found, false otherwise.
+ *
+ */
+static bool find_mapping_and_check(as_t *as, uintptr_t badvaddr, int access,
+    istate_t *istate, pte_t *pte)
 {
 	/*
 	 * Check if the mapping exists in page tables.
 	 */
-	pte_t *pte = page_mapping_find(as, badvaddr, true);
-	if ((pte) && (pte->present)) {
+	bool found = page_mapping_find(as, badvaddr, true, pte);
+	if (found && pte->present) {
 		/*
 		 * Mapping found in page tables.
 		 * Immediately succeed.
 		 */
-		return pte;
+		return true;
 	}
 	/*
@@ -76,10 +77,13 @@
 		 * The mapping ought to be in place.
 		 */
-		pte = page_mapping_find(as, badvaddr, true);
-		ASSERT((pte) && (pte->present));
-		return pte;
-	}
-
-	return NULL;
+		found = page_mapping_find(as, badvaddr, true, pte);
+
+		ASSERT(found);
+		ASSERT(pte->present);
+
+		return found;
+	}
+
+	return false;
 }
 
@@ -182,11 +186,12 @@
 		badvaddr = istate->pc;
 	
-	pte_t *pte = find_mapping_and_check(AS, badvaddr,
-	    PF_ACCESS_READ /* FIXME */, istate);
-	
-	if (pte) {
+	pte_t pte;
+	bool found = find_mapping_and_check(AS, badvaddr,
+	    PF_ACCESS_READ /* FIXME */, istate, &pte);
+	
+	if (found) {
 		/* Record access to PTE */
-		pte->accessed = 1;
-		pht_insert(badvaddr, pte);
+		pte.accessed = 1;
+		pht_insert(badvaddr, &pte);
 	}
 }
Index: kernel/arch/sparc64/src/mm/sun4u/tlb.c
===================================================================
--- kernel/arch/sparc64/src/mm/sun4u/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/sparc64/src/mm/sun4u/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -197,16 +197,16 @@
 {
 	size_t index = (istate->tpc >> MMU_PAGE_WIDTH) % MMU_PAGES_PER_PAGE;
-	pte_t *t;
-
-	t = page_mapping_find(AS, istate->tpc, true);
-	if (t && PTE_EXECUTABLE(t)) {
+	pte_t t;
+
+	bool found = page_mapping_find(AS, istate->tpc, true, &t);
+	if (found && PTE_EXECUTABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into ITLB.
 		 */
-		t->a = true;
-		itlb_pte_copy(t, index);
+		t.a = true;
+		itlb_pte_copy(&t, index);
 #ifdef CONFIG_TSB
-		itsb_pte_copy(t, index);
+		itsb_pte_copy(&t, index);
 #endif
 	} else {
@@ -233,5 +233,5 @@
 	uintptr_t page_16k;
 	size_t index;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 
@@ -253,14 +253,14 @@
 	}
 
-	t = page_mapping_find(as, page_16k, true);
-	if (t) {
+	bool found = page_mapping_find(as, page_16k, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into DTLB.
 		 */
-		t->a = true;
-		dtlb_pte_copy(t, index, true);
+		t.a = true;
+		dtlb_pte_copy(&t, index, true);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, index, true);
+		dtsb_pte_copy(&t, index, true);
 #endif
 	} else {
@@ -283,5 +283,5 @@
 	uintptr_t page_16k;
 	size_t index;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 
@@ -293,6 +293,6 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, page_16k, true);
-	if (t && PTE_WRITABLE(t)) {
+	bool found = page_mapping_find(as, page_16k, true, &t);
+	if (found && PTE_WRITABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table and is
@@ -300,11 +300,11 @@
 		 * into DTLB.
 		 */
-		t->a = true;
-		t->d = true;
+		t.a = true;
+		t.d = true;
 		dtlb_demap(TLB_DEMAP_PAGE, TLB_DEMAP_SECONDARY,
 		    page_16k + index * MMU_PAGE_SIZE);
-		dtlb_pte_copy(t, index, false);
+		dtlb_pte_copy(&t, index, false);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, index, false);
+		dtsb_pte_copy(&t, index, false);
 #endif
 	} else {
Index: kernel/arch/sparc64/src/mm/sun4v/tlb.c
===================================================================
--- kernel/arch/sparc64/src/mm/sun4v/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/sparc64/src/mm/sun4v/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -211,17 +211,16 @@
 {
 	uintptr_t va = ALIGN_DOWN(istate->tpc, PAGE_SIZE);
-	pte_t *t;
-
-	t = page_mapping_find(AS, va, true);
-
-	if (t && PTE_EXECUTABLE(t)) {
+	pte_t t;
+
+	bool found = page_mapping_find(AS, va, true, &t);
+	if (found && PTE_EXECUTABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into ITLB.
 		 */
-		t->a = true;
-		itlb_pte_copy(t);
+		t.a = true;
+		itlb_pte_copy(&t);
 #ifdef CONFIG_TSB
-		itsb_pte_copy(t);
+		itsb_pte_copy(&t);
 #endif
 	} else {
@@ -244,5 +243,5 @@
 void fast_data_access_mmu_miss(unsigned int tt, istate_t *istate)
 {
-	pte_t *t;
+	pte_t t;
 	uintptr_t va = DMISS_ADDRESS(istate->tlb_tag_access);
 	uint16_t ctx = DMISS_CONTEXT(istate->tlb_tag_access);
@@ -261,14 +260,14 @@
 	}
 
-	t = page_mapping_find(as, va, true);
-	if (t) {
+	bool found = page_mapping_find(as, va, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into DTLB.
 		 */
-		t->a = true;
-		dtlb_pte_copy(t, true);
+		t.a = true;
+		dtlb_pte_copy(&t, true);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, true);
+		dtsb_pte_copy(&t, true);
 #endif
 	} else {
@@ -288,5 +287,5 @@
 void fast_data_access_protection(unsigned int tt, istate_t *istate)
 {
-	pte_t *t;
+	pte_t t;
 	uintptr_t va = DMISS_ADDRESS(istate->tlb_tag_access);
 	uint16_t ctx = DMISS_CONTEXT(istate->tlb_tag_access);
@@ -296,6 +295,6 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, va, true);
-	if (t && PTE_WRITABLE(t)) {
+	bool found = page_mapping_find(as, va, true, &t);
+	if (found && PTE_WRITABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table and is
@@ -303,10 +302,10 @@
 		 * into DTLB.
 		 */
-		t->a = true;
-		t->d = true;
+		t.a = true;
+		t.d = true;
 		mmu_demap_page(va, ctx, MMU_FLAG_DTLB);
-		dtlb_pte_copy(t, false);
+		dtlb_pte_copy(&t, false);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, false);
+		dtsb_pte_copy(&t, false);
 #endif
 	} else {