hat_unload_callback passes the wrong length to segvn_hat_unload_callback
hat_unload_callback() is supposed to call the specified callback on each range that is unloaded. The only consumer of this is segvn_unmap(), which specifies the segvn_hat_unload_callback().
However, the length passed to the callback is always wrong. It happens to be the number of pages, rather than the number of bytes, but this is also an accident. It's "lucky" that this is less than the correct size, so that segvn_hat_unload_callback() unloads less pages than it should, which is handled properly. If pagesize was different, we could pass a much larger length than we should, causing it to unload too many pages, breaking everything.
The problem is that handle_ranges() computes the length as "rng_cnt << LEVEL_SIZE(rng_level)". LEVEL_SIZE() gives the size in bytes, so we are typically shifting by 4096, with undefined results.
The fix is to shift by LEVEL_SHIFT().