XENMEM_populate_physmap in Xen 4.0 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier when translating paging mode is not used allows local PV OS guest kernels to cause a denial of service (BUG triggered and host crash) via invalid flags such as MEMF_populate_on_demand.