Right now I have some code for mapping a kernel VA into userspace using IoAllocateMdl, calling MmBuildMdlForNonPagedPool, then getting the user VA with MmMapLockedPagesSpecifyCache. My requirements have changed and I now need to be able to map multiple fragmented kernel VAs to user-mode. Is there a way to do this in such a way that it maps to a contiguous user-mode VA, or do I need to send back an array of addresses back to usermode?