_set_page_writable / MakePTWritable derived table pointers with entry & ~0xFFF, which keeps reserved bits 52..62 and NX. An invalid entry (P=1, PS=0, reserved bits set) produced 0xfffffffffffff000 and a boot-time #PF in _set_page_writable. Add _table_phys: keep address bits 12..51 and require reserved bits 52..62 to be zero. Use it at every non-leaf level in both walkers.