A Protect or Unmap that ran out of memory while applying its range patch
had already changed the host mapping, leaving the registry and the mapping
disagreeing. The replacement nodes are now allocated before the apply
callback runs, so applying the patch cannot fail. guest_allocations_oom
injects an allocation failure at every allocation of a Protect and of an
Unmap and checks that the registry is unchanged when the call throws.
