> how you can guarantee that you've fixed up all pointers to an unmapped virtual page so you can reuse it.
Maybe they don't.
amd64 effectively has a 48-bit addressing limit. You can unmap 1,000 4K pages each second for over two years before you need to reuse a page address.