Hi, I think I've found another one :)
in confinit() we do: kmem -= conf.upages*sizeof(Page) + conf.nproc*sizeof(Proc) + conf.nimage*sizeof(KImage) + conf.nswap + conf.nswppo*sizeof(Page); // <- BUG but in swapinit we actually do iolist = xalloc(conf.nswppo*sizeof(Page*)); so in confinit() it should be conf.nswppo*sizeof(Page*)