From David M-T.

When this function successfully merges the new range into an existing
VMA, it forgets to extend the new protection mode into the just-merged
pages.