mm_map_aux() takes in |b._b| which can end up reallocating |km| at the
end of mm_map_frag_core(). Since the address of |km| is cached before
those calls it ends up pointing to freed memory.
This can result in a crash as seen in #1183, however it also happens to
Just Work most of the time since the new allocation often lands at the
same address as the old one. Preloading ASAN or a similar replacement
allocator that doesn't have that behaviour results in a reliable crash.