diff --git a/src/kernel/page_manager.cpp b/src/kernel/page_manager.cpp
index e550569..c12742d 100644
--- a/src/kernel/page_manager.cpp
+++ b/src/kernel/page_manager.cpp
@@ -247,6 +247,11 @@ page_manager::free_table_pages(void *pages, size_t count)
 void *
 page_manager::map_pages(uintptr_t address, size_t count, bool user, page_table *pml4)
 {
+	if (!address) {
+		kassert(!user, "Cannot call map_pages with 0 address for user mapping");
+		address = m_addrs.allocate(count * frame_size);
+	}
+
 	void *ret = reinterpret_cast<void *>(address);
 	if (!pml4) pml4 = get_pml4();
 
@@ -338,6 +343,9 @@ page_manager::unmap_pages(void* address, size_t count, page_table *pml4)
 {
 	if (!pml4) pml4 = get_pml4();
 	page_out(pml4, reinterpret_cast<uintptr_t>(address), count, true);
+	if (address >= kernel_offset) {
+		m_addrs.free(address, count);
+	}
 }
 
 void
diff --git a/src/kernel/page_manager.h b/src/kernel/page_manager.h
index 15fbbec..7a2a765 100644
--- a/src/kernel/page_manager.h
+++ b/src/kernel/page_manager.h
@@ -66,7 +66,8 @@ public:
 			page_table_indices index = {});
 
 	/// Allocate and map pages into virtual memory.
-	/// \arg address  The virtual address at which to map the pages
+	/// \arg address  The virtual address at which to map the pages, or zero
+	///               for any free kernel space.
 	/// \arg count    The number of pages to map
 	/// \arg user     True is this memory is user-accessible
 	/// \arg pml4     The pml4 to map into - null for the current one