From 2a7831466c95bbadb381eb9ed0d5b1068917ed45 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 17 Oct 2021 13:29:32 +0100
Subject: [PATCH] Layers: Fix bug where PAT flag is treated as address

---
 volatility3/framework/layers/intel.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py
index 4a582f1fb..1f997c410 100644
--- a/volatility3/framework/layers/intel.py
+++ b/volatility3/framework/layers/intel.py
@@ -135,6 +135,9 @@ class Intel(linear.LinearlyMappedLayer):
                                                               "Page Fault at entry " + hex(entry) + " in table " + name)
             # Check if we're a large page
             if large_page and (entry & (1 << 7)):
+                # Mask off the PAT bit
+                if entry & (1 << 12):
+                    entry -= (1 << 12)
                 # We're a large page, the rest is finished below
                 # If we want to implement PSE-36, it would need to be done here
                 break