By default, our ASLR implementation is supposed to cluster anonymous memory allocations, unless the application's mmap(..., MAP_ANON, ...) call includes a non-zero address hint. Unfortunately, clustering never occurred because kern_mmap() always replaced the given address hint when it was zero. So, the ASLR implementation believed that a non-zero hint had been provided and randomized the mapping's location in the address space. Essentially, I'm pushing down the point at which we convert a hint of zero to a minimum address into vm_map_find_min().
See D39845 for the discussion leading to this revision.