Index: kernel/arch/ia64/src/mm/tlb.c
===================================================================
--- kernel/arch/ia64/src/mm/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/ia64/src/mm/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -484,5 +484,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa; /* faulting address */
@@ -490,11 +490,11 @@
 	ASSERT(!is_kernel_fault(va));
 
-	t = page_mapping_find(AS, va, true);
-	if (t) {
+	bool found = page_mapping_find(AS, va, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in software page hash table.
 		 * Insert it into data translation cache.
 		 */
-		itc_pte_copy(t);
+		itc_pte_copy(&t);
 	} else {
 		/*
@@ -600,11 +600,12 @@
 	
 	
-	pte_t *entry = page_mapping_find(as, va, true);
-	if (entry) {
+	pte_t t;
+	bool found = page_mapping_find(as, va, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into data translation cache.
 		 */
-		dtc_pte_copy(entry);
+		dtc_pte_copy(&t);
 	} else {
 		if (try_memmap_io_insertion(va, istate))
@@ -641,5 +642,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 	
@@ -649,13 +650,16 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, va, true);
-	ASSERT((t) && (t->p));
-	if ((t) && (t->p) && (t->w)) {
+	bool found = page_mapping_find(as, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+
+	if (found && t.p && t.w) {
 		/*
 		 * Update the Dirty bit in page tables and reinsert
 		 * the mapping into DTC.
 		 */
-		t->d = true;
-		dtc_pte_copy(t);
+		t.d = true;
+		dtc_pte_copy(&t);
 	} else {
 		as_page_fault(va, PF_ACCESS_WRITE, istate);
@@ -672,5 +676,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa;  /* faulting address */
@@ -678,13 +682,16 @@
 	ASSERT(!is_kernel_fault(va));
 	
-	t = page_mapping_find(AS, va, true);
-	ASSERT((t) && (t->p));
-	if ((t) && (t->p) && (t->x)) {
+	bool found = page_mapping_find(AS, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+
+	if (found && t.p && t.x) {
 		/*
 		 * Update the Accessed bit in page tables and reinsert
 		 * the mapping into ITC.
 		 */
-		t->a = true;
-		itc_pte_copy(t);
+		t.a = true;
+		itc_pte_copy(&t);
 	} else {
 		as_page_fault(va, PF_ACCESS_EXEC, istate);
@@ -701,5 +708,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 	
@@ -709,13 +716,16 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, va, true);
-	ASSERT((t) && (t->p));
-	if ((t) && (t->p)) {
+	bool found = page_mapping_find(as, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+
+	if (found && t.p) {
 		/*
 		 * Update the Accessed bit in page tables and reinsert
 		 * the mapping into DTC.
 		 */
-		t->a = true;
-		dtc_pte_copy(t);
+		t.a = true;
+		dtc_pte_copy(&t);
 	} else {
 		if (as_page_fault(va, PF_ACCESS_READ, istate) == AS_PF_FAULT) {
@@ -736,5 +746,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa;  /* faulting address */
@@ -745,7 +755,10 @@
 	 * Assume a write to a read-only page.
 	 */
-	t = page_mapping_find(AS, va, true);
-	ASSERT((t) && (t->p));
-	ASSERT(!t->w);
+	bool found = page_mapping_find(AS, va, true, &t);
+
+	ASSERT(found);
+	ASSERT(t.p);
+	ASSERT(!t.w);
+
 	as_page_fault(va, PF_ACCESS_WRITE, istate);
 }
@@ -760,5 +773,5 @@
 {
 	uintptr_t va;
-	pte_t *t;
+	pte_t t;
 	
 	va = istate->cr_ifa;  /* faulting address */
@@ -766,16 +779,17 @@
 	ASSERT(!is_kernel_fault(va));
 
-	t = page_mapping_find(AS, va, true);
-	ASSERT(t);
-	
-	if (t->p) {
+	bool found = page_mapping_find(AS, va, true, &t);
+
+	ASSERT(found);
+	
+	if (t.p) {
 		/*
 		 * If the Present bit is set in page hash table, just copy it
 		 * and update ITC/DTC.
 		 */
-		if (t->x)
-			itc_pte_copy(t);
+		if (t.x)
+			itc_pte_copy(&t);
 		else
-			dtc_pte_copy(t);
+			dtc_pte_copy(&t);
 	} else {
 		as_page_fault(va, PF_ACCESS_READ, istate);
Index: kernel/arch/mips32/src/mm/tlb.c
===================================================================
--- kernel/arch/mips32/src/mm/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/mips32/src/mm/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -97,17 +97,17 @@
 	entry_lo_t lo;
 	uintptr_t badvaddr;
-	pte_t *pte;
+	pte_t pte;
 	
 	badvaddr = cp0_badvaddr_read();
 
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p) {
+	bool found = page_mapping_find(AS, badvaddr, true, &pte);
+	if (found && pte.p) {
 		/*
 		 * Record access to PTE.
 		 */
-		pte->a = 1;
-
-		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->d,
-		    pte->cacheable, pte->pfn);
+		pte.a = 1;
+
+		tlb_prepare_entry_lo(&lo, pte.g, pte.p, pte.d,
+		    pte.cacheable, pte.pfn);
 
 		/*
@@ -138,5 +138,5 @@
 	tlb_index_t index;
 	uintptr_t badvaddr;
-	pte_t *pte;
+	pte_t pte;
 
 	/*
@@ -162,6 +162,6 @@
 	badvaddr = cp0_badvaddr_read();
 
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p) {
+	bool found = page_mapping_find(AS, badvaddr, true, &pte);
+	if (found && pte.p) {
 		/*
 		 * Read the faulting TLB entry.
@@ -172,8 +172,8 @@
 		 * Record access to PTE.
 		 */
-		pte->a = 1;
-
-		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->d,
-		    pte->cacheable, pte->pfn);
+		pte.a = 1;
+
+		tlb_prepare_entry_lo(&lo, pte.g, pte.p, pte.d,
+		    pte.cacheable, pte.pfn);
 
 		/*
@@ -200,5 +200,5 @@
 	tlb_index_t index;
 	uintptr_t badvaddr;
-	pte_t *pte;
+	pte_t pte;
 
 	badvaddr = cp0_badvaddr_read();
@@ -224,6 +224,6 @@
 	}
 
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p && pte->w) {
+	bool found = page_mapping_find(AS, badvaddr, true, &pte);
+	if (found && pte.p && pte.w) {
 		/*
 		 * Read the faulting TLB entry.
@@ -234,9 +234,9 @@
 		 * Record access and write to PTE.
 		 */
-		pte->a = 1;
-		pte->d = 1;
-
-		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->w,
-		    pte->cacheable, pte->pfn);
+		pte.a = 1;
+		pte.d = 1;
+
+		tlb_prepare_entry_lo(&lo, pte.g, pte.p, pte.w,
+		    pte.cacheable, pte.pfn);
 
 		/*
Index: kernel/arch/ppc32/src/mm/pht.c
===================================================================
--- kernel/arch/ppc32/src/mm/pht.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/ppc32/src/mm/pht.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -49,21 +49,22 @@
  * @param access   Access mode that caused the fault.
  * @param istate   Pointer to interrupted state.
- *
- * @return PTE on success, NULL otherwise.
- *
- */
-static pte_t *find_mapping_and_check(as_t *as, uintptr_t badvaddr, int access,
-    istate_t *istate)
+ * @param[out] pte Structure that will receive a copy of the found PTE.
+ *
+ * @return True if the mapping was found, false otherwise.
+ *
+ */
+static bool find_mapping_and_check(as_t *as, uintptr_t badvaddr, int access,
+    istate_t *istate, pte_t *pte)
 {
 	/*
 	 * Check if the mapping exists in page tables.
 	 */
-	pte_t *pte = page_mapping_find(as, badvaddr, true);
-	if ((pte) && (pte->present)) {
+	bool found = page_mapping_find(as, badvaddr, true, pte);
+	if (found && pte->present) {
 		/*
 		 * Mapping found in page tables.
 		 * Immediately succeed.
 		 */
-		return pte;
+		return true;
 	}
 	/*
@@ -76,10 +77,13 @@
 		 * The mapping ought to be in place.
 		 */
-		pte = page_mapping_find(as, badvaddr, true);
-		ASSERT((pte) && (pte->present));
-		return pte;
-	}
-
-	return NULL;
+		found = page_mapping_find(as, badvaddr, true, pte);
+
+		ASSERT(found);
+		ASSERT(pte->present);
+
+		return found;
+	}
+
+	return false;
 }
 
@@ -182,11 +186,12 @@
 		badvaddr = istate->pc;
 	
-	pte_t *pte = find_mapping_and_check(AS, badvaddr,
-	    PF_ACCESS_READ /* FIXME */, istate);
-	
-	if (pte) {
+	pte_t pte;
+	bool found = find_mapping_and_check(AS, badvaddr,
+	    PF_ACCESS_READ /* FIXME */, istate, &pte);
+	
+	if (found) {
 		/* Record access to PTE */
-		pte->accessed = 1;
-		pht_insert(badvaddr, pte);
+		pte.accessed = 1;
+		pht_insert(badvaddr, &pte);
 	}
 }
Index: kernel/arch/sparc64/src/mm/sun4u/tlb.c
===================================================================
--- kernel/arch/sparc64/src/mm/sun4u/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/sparc64/src/mm/sun4u/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -197,16 +197,16 @@
 {
 	size_t index = (istate->tpc >> MMU_PAGE_WIDTH) % MMU_PAGES_PER_PAGE;
-	pte_t *t;
-
-	t = page_mapping_find(AS, istate->tpc, true);
-	if (t && PTE_EXECUTABLE(t)) {
+	pte_t t;
+
+	bool found = page_mapping_find(AS, istate->tpc, true, &t);
+	if (found && PTE_EXECUTABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into ITLB.
 		 */
-		t->a = true;
-		itlb_pte_copy(t, index);
+		t.a = true;
+		itlb_pte_copy(&t, index);
 #ifdef CONFIG_TSB
-		itsb_pte_copy(t, index);
+		itsb_pte_copy(&t, index);
 #endif
 	} else {
@@ -233,5 +233,5 @@
 	uintptr_t page_16k;
 	size_t index;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 
@@ -253,14 +253,14 @@
 	}
 
-	t = page_mapping_find(as, page_16k, true);
-	if (t) {
+	bool found = page_mapping_find(as, page_16k, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into DTLB.
 		 */
-		t->a = true;
-		dtlb_pte_copy(t, index, true);
+		t.a = true;
+		dtlb_pte_copy(&t, index, true);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, index, true);
+		dtsb_pte_copy(&t, index, true);
 #endif
 	} else {
@@ -283,5 +283,5 @@
 	uintptr_t page_16k;
 	size_t index;
-	pte_t *t;
+	pte_t t;
 	as_t *as = AS;
 
@@ -293,6 +293,6 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, page_16k, true);
-	if (t && PTE_WRITABLE(t)) {
+	bool found = page_mapping_find(as, page_16k, true, &t);
+	if (found && PTE_WRITABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table and is
@@ -300,11 +300,11 @@
 		 * into DTLB.
 		 */
-		t->a = true;
-		t->d = true;
+		t.a = true;
+		t.d = true;
 		dtlb_demap(TLB_DEMAP_PAGE, TLB_DEMAP_SECONDARY,
 		    page_16k + index * MMU_PAGE_SIZE);
-		dtlb_pte_copy(t, index, false);
+		dtlb_pte_copy(&t, index, false);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, index, false);
+		dtsb_pte_copy(&t, index, false);
 #endif
 	} else {
Index: kernel/arch/sparc64/src/mm/sun4v/tlb.c
===================================================================
--- kernel/arch/sparc64/src/mm/sun4v/tlb.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/arch/sparc64/src/mm/sun4v/tlb.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -211,17 +211,16 @@
 {
 	uintptr_t va = ALIGN_DOWN(istate->tpc, PAGE_SIZE);
-	pte_t *t;
-
-	t = page_mapping_find(AS, va, true);
-
-	if (t && PTE_EXECUTABLE(t)) {
+	pte_t t;
+
+	bool found = page_mapping_find(AS, va, true, &t);
+	if (found && PTE_EXECUTABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into ITLB.
 		 */
-		t->a = true;
-		itlb_pte_copy(t);
+		t.a = true;
+		itlb_pte_copy(&t);
 #ifdef CONFIG_TSB
-		itsb_pte_copy(t);
+		itsb_pte_copy(&t);
 #endif
 	} else {
@@ -244,5 +243,5 @@
 void fast_data_access_mmu_miss(unsigned int tt, istate_t *istate)
 {
-	pte_t *t;
+	pte_t t;
 	uintptr_t va = DMISS_ADDRESS(istate->tlb_tag_access);
 	uint16_t ctx = DMISS_CONTEXT(istate->tlb_tag_access);
@@ -261,14 +260,14 @@
 	}
 
-	t = page_mapping_find(as, va, true);
-	if (t) {
+	bool found = page_mapping_find(as, va, true, &t);
+	if (found) {
 		/*
 		 * The mapping was found in the software page hash table.
 		 * Insert it into DTLB.
 		 */
-		t->a = true;
-		dtlb_pte_copy(t, true);
+		t.a = true;
+		dtlb_pte_copy(&t, true);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, true);
+		dtsb_pte_copy(&t, true);
 #endif
 	} else {
@@ -288,5 +287,5 @@
 void fast_data_access_protection(unsigned int tt, istate_t *istate)
 {
-	pte_t *t;
+	pte_t t;
 	uintptr_t va = DMISS_ADDRESS(istate->tlb_tag_access);
 	uint16_t ctx = DMISS_CONTEXT(istate->tlb_tag_access);
@@ -296,6 +295,6 @@
 		as = AS_KERNEL;
 
-	t = page_mapping_find(as, va, true);
-	if (t && PTE_WRITABLE(t)) {
+	bool found = page_mapping_find(as, va, true, &t);
+	if (found && PTE_WRITABLE(&t)) {
 		/*
 		 * The mapping was found in the software page hash table and is
@@ -303,10 +302,10 @@
 		 * into DTLB.
 		 */
-		t->a = true;
-		t->d = true;
+		t.a = true;
+		t.d = true;
 		mmu_demap_page(va, ctx, MMU_FLAG_DTLB);
-		dtlb_pte_copy(t, false);
+		dtlb_pte_copy(&t, false);
 #ifdef CONFIG_TSB
-		dtsb_pte_copy(t, false);
+		dtsb_pte_copy(&t, false);
 #endif
 	} else {
Index: kernel/genarch/src/mm/page_ht.c
===================================================================
--- kernel/genarch/src/mm/page_ht.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/genarch/src/mm/page_ht.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -59,5 +59,5 @@
 static void ht_mapping_insert(as_t *, uintptr_t, uintptr_t, unsigned int);
 static void ht_mapping_remove(as_t *, uintptr_t);
-static pte_t *ht_mapping_find(as_t *, uintptr_t, bool);
+static bool ht_mapping_find(as_t *, uintptr_t, bool, pte_t *);
 static void ht_mapping_make_global(uintptr_t, size_t);
 
@@ -248,12 +248,12 @@
 /** Find mapping for virtual page in page hash table.
  *
- * @param as     Address space to which page belongs.
- * @param page   Virtual page.
- * @param nolock True if the page tables need not be locked.
- *
- * @return NULL if there is no such mapping; requested mapping otherwise.
- *
- */
-pte_t *ht_mapping_find(as_t *as, uintptr_t page, bool nolock)
+ * @param as       Address space to which page belongs.
+ * @param page     Virtual page.
+ * @param nolock   True if the page tables need not be locked.
+ * @param[out] pte Structure that will receive a copy of the found PTE.
+ *
+ * @return True if the mapping was found, false otherwise.
+ */
+bool ht_mapping_find(as_t *as, uintptr_t page, bool nolock, pte_t *pte)
 {
 	sysarg_t key[2] = {
@@ -266,7 +266,7 @@
 	link_t *cur = hash_table_find(&page_ht, key);
 	if (cur)
-		return hash_table_get_instance(cur, pte_t, link);
-	
-	return NULL;
+		*pte = *hash_table_get_instance(cur, pte_t, link);
+	
+	return cur != NULL;
 }
 
Index: kernel/genarch/src/mm/page_pt.c
===================================================================
--- kernel/genarch/src/mm/page_pt.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/genarch/src/mm/page_pt.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -53,5 +53,5 @@
 static void pt_mapping_insert(as_t *, uintptr_t, uintptr_t, unsigned int);
 static void pt_mapping_remove(as_t *, uintptr_t);
-static pte_t *pt_mapping_find(as_t *, uintptr_t, bool);
+static bool pt_mapping_find(as_t *, uintptr_t, bool, pte_t *pte);
 static void pt_mapping_make_global(uintptr_t, size_t);
 
@@ -291,13 +291,12 @@
 /** Find mapping for virtual page in hierarchical page tables.
  *
- * @param as     Address space to which page belongs.
- * @param page   Virtual page.
- * @param nolock True if the page tables need not be locked.
- *
- * @return NULL if there is no such mapping; entry from PTL3 describing
- *         the mapping otherwise.
- *
- */
-pte_t *pt_mapping_find(as_t *as, uintptr_t page, bool nolock)
+ * @param as       Address space to which page belongs.
+ * @param page     Virtual page.
+ * @param nolock   True if the page tables need not be locked.
+ * @param[out] pte Structure that will receive a copy of the found PTE.
+ *
+ * @return True if the mapping was found, false otherwise.
+ */
+bool pt_mapping_find(as_t *as, uintptr_t page, bool nolock, pte_t *pte)
 {
 	ASSERT(nolock || page_table_locked(as));
@@ -305,5 +304,5 @@
 	pte_t *ptl0 = (pte_t *) PA2KA((uintptr_t) as->genarch.page_table);
 	if (GET_PTL1_FLAGS(ptl0, PTL0_INDEX(page)) & PAGE_NOT_PRESENT)
-		return NULL;
+		return false;
 
 	read_barrier();
@@ -311,5 +310,5 @@
 	pte_t *ptl1 = (pte_t *) PA2KA(GET_PTL1_ADDRESS(ptl0, PTL0_INDEX(page)));
 	if (GET_PTL2_FLAGS(ptl1, PTL1_INDEX(page)) & PAGE_NOT_PRESENT)
-		return NULL;
+		return false;
 
 #if (PTL1_ENTRIES != 0)
@@ -322,5 +321,5 @@
 	pte_t *ptl2 = (pte_t *) PA2KA(GET_PTL2_ADDRESS(ptl1, PTL1_INDEX(page)));
 	if (GET_PTL3_FLAGS(ptl2, PTL2_INDEX(page)) & PAGE_NOT_PRESENT)
-		return NULL;
+		return false;
 
 #if (PTL2_ENTRIES != 0)
@@ -333,5 +332,6 @@
 	pte_t *ptl3 = (pte_t *) PA2KA(GET_PTL3_ADDRESS(ptl2, PTL2_INDEX(page)));
 	
-	return &ptl3[PTL3_INDEX(page)];
+	*pte = ptl3[PTL3_INDEX(page)];
+	return true;
 }
 
Index: kernel/generic/include/mm/page.h
===================================================================
--- kernel/generic/include/mm/page.h	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/generic/include/mm/page.h	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -48,5 +48,5 @@
 	void (* mapping_insert)(as_t *, uintptr_t, uintptr_t, unsigned int);
 	void (* mapping_remove)(as_t *, uintptr_t);
-	pte_t *(* mapping_find)(as_t *, uintptr_t, bool);
+	bool (* mapping_find)(as_t *, uintptr_t, bool, pte_t *);
 	void (* mapping_make_global)(uintptr_t, size_t);
 } page_mapping_operations_t;
@@ -60,5 +60,5 @@
 extern void page_mapping_insert(as_t *, uintptr_t, uintptr_t, unsigned int);
 extern void page_mapping_remove(as_t *, uintptr_t);
-extern pte_t *page_mapping_find(as_t *, uintptr_t, bool);
+extern bool page_mapping_find(as_t *, uintptr_t, bool, pte_t *);
 extern void page_mapping_make_global(uintptr_t, size_t);
 extern pte_t *page_table_create(unsigned int);
Index: kernel/generic/src/mm/as.c
===================================================================
--- kernel/generic/src/mm/as.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/generic/src/mm/as.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -888,10 +888,11 @@
 		
 				for (; i < node_size; i++) {
-					pte_t *pte = page_mapping_find(as,
-					    ptr + P2SZ(i), false);
+					pte_t pte;
+					bool found = page_mapping_find(as,
+					    ptr + P2SZ(i), false, &pte);
 					
-					ASSERT(pte);
-					ASSERT(PTE_VALID(pte));
-					ASSERT(PTE_PRESENT(pte));
+					ASSERT(found);
+					ASSERT(PTE_VALID(&pte));
+					ASSERT(PTE_PRESENT(&pte));
 					
 					if ((area->backend) &&
@@ -899,5 +900,5 @@
 						area->backend->frame_free(area,
 						    ptr + P2SZ(i),
-						    PTE_GET_FRAME(pte));
+						    PTE_GET_FRAME(&pte));
 					}
 					
@@ -1002,10 +1003,11 @@
 			
 			for (size = 0; size < (size_t) node->value[i]; size++) {
-				pte_t *pte = page_mapping_find(as,
-				     ptr + P2SZ(size), false);
+				pte_t pte;
+				bool found = page_mapping_find(as,
+				     ptr + P2SZ(size), false, &pte);
 				
-				ASSERT(pte);
-				ASSERT(PTE_VALID(pte));
-				ASSERT(PTE_PRESENT(pte));
+				ASSERT(found);
+				ASSERT(PTE_VALID(&pte));
+				ASSERT(PTE_PRESENT(&pte));
 				
 				if ((area->backend) &&
@@ -1013,5 +1015,5 @@
 					area->backend->frame_free(area,
 					    ptr + P2SZ(size),
-					    PTE_GET_FRAME(pte));
+					    PTE_GET_FRAME(&pte));
 				}
 				
@@ -1314,12 +1316,13 @@
 			
 			for (size = 0; size < (size_t) node->value[i]; size++) {
-				pte_t *pte = page_mapping_find(as,
-				    ptr + P2SZ(size), false);
+				pte_t pte;
+				bool found = page_mapping_find(as,
+				    ptr + P2SZ(size), false, &pte);
 				
-				ASSERT(pte);
-				ASSERT(PTE_VALID(pte));
-				ASSERT(PTE_PRESENT(pte));
+				ASSERT(found);
+				ASSERT(PTE_VALID(&pte));
+				ASSERT(PTE_PRESENT(&pte));
 				
-				old_frame[frame_idx++] = PTE_GET_FRAME(pte);
+				old_frame[frame_idx++] = PTE_GET_FRAME(&pte);
 				
 				/* Remove old mapping */
@@ -1451,10 +1454,11 @@
 	 * we need to make sure the mapping has not been already inserted.
 	 */
-	pte_t *pte;
-	if ((pte = page_mapping_find(AS, page, false))) {
-		if (PTE_PRESENT(pte)) {
-			if (((access == PF_ACCESS_READ) && PTE_READABLE(pte)) ||
-			    (access == PF_ACCESS_WRITE && PTE_WRITABLE(pte)) ||
-			    (access == PF_ACCESS_EXEC && PTE_EXECUTABLE(pte))) {
+	pte_t pte;
+	bool found = page_mapping_find(AS, page, false, &pte);
+	if (found) {
+		if (PTE_PRESENT(&pte)) {
+			if (((access == PF_ACCESS_READ) && PTE_READABLE(&pte)) ||
+			    (access == PF_ACCESS_WRITE && PTE_WRITABLE(&pte)) ||
+			    (access == PF_ACCESS_EXEC && PTE_EXECUTABLE(&pte))) {
 				page_table_unlock(AS, false);
 				mutex_unlock(&area->lock);
Index: kernel/generic/src/mm/backend_anon.c
===================================================================
--- kernel/generic/src/mm/backend_anon.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/generic/src/mm/backend_anon.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -131,17 +131,21 @@
 			
 			for (j = 0; j < count; j++) {
-				pte_t *pte;
+				pte_t pte;
+				bool found;
 			
 				page_table_lock(area->as, false);
-				pte = page_mapping_find(area->as,
-				    base + P2SZ(j), false);
-				ASSERT(pte && PTE_VALID(pte) &&
-				    PTE_PRESENT(pte));
+				found = page_mapping_find(area->as,
+				    base + P2SZ(j), false, &pte);
+
+				ASSERT(found);
+				ASSERT(PTE_VALID(&pte));
+				ASSERT(PTE_PRESENT(&pte));
+
 				btree_insert(&area->sh_info->pagemap,
 				    (base + P2SZ(j)) - area->base,
-				    (void *) PTE_GET_FRAME(pte), NULL);
+				    (void *) PTE_GET_FRAME(&pte), NULL);
 				page_table_unlock(area->as, false);
 
-				pfn_t pfn = ADDR2PFN(PTE_GET_FRAME(pte));
+				pfn_t pfn = ADDR2PFN(PTE_GET_FRAME(&pte));
 				frame_reference_add(pfn);
 			}
Index: kernel/generic/src/mm/backend_elf.c
===================================================================
--- kernel/generic/src/mm/backend_elf.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/generic/src/mm/backend_elf.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -184,5 +184,6 @@
 			
 			for (j = 0; j < count; j++) {
-				pte_t *pte;
+				pte_t pte;
+				bool found;
 			
 				/*
@@ -196,14 +197,17 @@
 				
 				page_table_lock(area->as, false);
-				pte = page_mapping_find(area->as,
-				    base + P2SZ(j), false);
-				ASSERT(pte && PTE_VALID(pte) &&
-				    PTE_PRESENT(pte));
+				found = page_mapping_find(area->as,
+				    base + P2SZ(j), false, &pte);
+
+				ASSERT(found);
+				ASSERT(PTE_VALID(&pte));
+				ASSERT(PTE_PRESENT(&pte));
+
 				btree_insert(&area->sh_info->pagemap,
 				    (base + P2SZ(j)) - area->base,
-				    (void *) PTE_GET_FRAME(pte), NULL);
+				    (void *) PTE_GET_FRAME(&pte), NULL);
 				page_table_unlock(area->as, false);
 
-				pfn_t pfn = ADDR2PFN(PTE_GET_FRAME(pte));
+				pfn_t pfn = ADDR2PFN(PTE_GET_FRAME(&pte));
 				frame_reference_add(pfn);
 			}
@@ -335,11 +339,14 @@
 			dirty = true;
 		} else {
-			pte_t *pte = page_mapping_find(AS_KERNEL,
-			    base + i * FRAME_SIZE, true);
-
-			ASSERT(pte);
-			ASSERT(PTE_PRESENT(pte));
-
-			frame = PTE_GET_FRAME(pte);
+			pte_t pte;
+			bool found;
+
+			found = page_mapping_find(AS_KERNEL,
+			    base + i * FRAME_SIZE, true, &pte);
+
+			ASSERT(found);
+			ASSERT(PTE_PRESENT(&pte));
+
+			frame = PTE_GET_FRAME(&pte);
 		}	
 	} else if (upage >= start_anon) {
Index: kernel/generic/src/mm/page.c
===================================================================
--- kernel/generic/src/mm/page.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/generic/src/mm/page.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -137,13 +137,13 @@
 /** Find mapping for virtual page.
  *
- * @param as     Address space to which page belongs.
- * @param page   Virtual page.
- * @param nolock True if the page tables need not be locked.
- *
- * @return NULL if there is no such mapping; requested mapping
- *         otherwise.
- *
- */
-NO_TRACE pte_t *page_mapping_find(as_t *as, uintptr_t page, bool nolock)
+ * @param as       Address space to which page belongs.
+ * @param page     Virtual page.
+ * @param nolock   True if the page tables need not be locked.
+ * @param[out] pte Structure that will receive a copy of the found PTE.
+ *
+ * @return True if the mapping was found, false otherwise.
+ */
+NO_TRACE bool page_mapping_find(as_t *as, uintptr_t page, bool nolock,
+    pte_t *pte)
 {
 	ASSERT(nolock || page_table_locked(as));
@@ -153,5 +153,5 @@
 	
 	return page_mapping_operations->mapping_find(as,
-	    ALIGN_DOWN(page, PAGE_SIZE), nolock);
+	    ALIGN_DOWN(page, PAGE_SIZE), nolock, pte);
 }
 
@@ -173,11 +173,12 @@
 	page_table_lock(AS, true);
 	
-	pte_t *pte = page_mapping_find(AS, virt, false);
-	if ((!PTE_VALID(pte)) || (!PTE_PRESENT(pte))) {
+	pte_t pte;
+	bool found = page_mapping_find(AS, virt, false, &pte);
+	if (!found || !PTE_VALID(&pte) || !PTE_PRESENT(&pte)) {
 		page_table_unlock(AS, true);
 		return ENOENT;
 	}
 	
-	*phys = PTE_GET_FRAME(pte) +
+	*phys = PTE_GET_FRAME(&pte) +
 	    (virt - ALIGN_DOWN(virt, PAGE_SIZE));
 	
Index: kernel/generic/src/synch/futex.c
===================================================================
--- kernel/generic/src/synch/futex.c	(revision dc05a9a597536a77b10988235cdf855c96b15084)
+++ kernel/generic/src/synch/futex.c	(revision 38dc82d20695b43a799be28d4fd2b2cd2c5bb785)
@@ -291,10 +291,14 @@
 	spinlock_lock(&futex_ht_lock);
 
-	bool found = false;
-	pte_t *t = page_mapping_find(AS, ALIGN_DOWN(uaddr, PAGE_SIZE), true);
-	
-	if (t && PTE_VALID(t) && PTE_PRESENT(t)) {
-		found = true;
-		*paddr = PTE_GET_FRAME(t) + (uaddr - ALIGN_DOWN(uaddr, PAGE_SIZE));
+	bool success = false;
+
+	pte_t t;
+	bool found;
+
+	found = page_mapping_find(AS, ALIGN_DOWN(uaddr, PAGE_SIZE), true, &t);
+	if (found && PTE_VALID(&t) && PTE_PRESENT(&t)) {
+		success = true;
+		*paddr = PTE_GET_FRAME(&t) +
+		    (uaddr - ALIGN_DOWN(uaddr, PAGE_SIZE));
 	}
 	
@@ -302,5 +306,5 @@
 	page_table_unlock(AS, false);
 	
-	return found;
+	return success;
 }