msync(..., MS_INVALIDATE) will incorrectly remove dirty pages without

msync(..., MS_INVALIDATE) will incorrectly remove dirty pages without
synchronizing them to their backing store under certain circumstances,
and can also cause struct buf's to become inconsistent.  This can be
particularly gruesome when MS_INVALIDATE is used on a range of memory that
is mmap()'d to be read-only.

Fix MS_INVALIDATE's operation (1) by making UFS honor the invalidation
request when flushing to backing store to destroy the related struct buf
and (2) by never removing pages wired into the buffer cache and never
removing pages that are found to still be dirty.

Note that NFS was already coded to honor invalidation requests in
nfs_write().  Filesystems other then NFS and UFS do not currently support
buffer-invalidation-on-write but all that means now is that the pages
will remain in cache, rather then be incorrectly removed and cause corruption.

Reported-by: Stephan Uphoff <ups@tree.com>, Julian Elischer <julian@elischer.org>