diff --git a/src/context/memory.rs b/src/context/memory.rs
index 8fab963661..908f31e58d 100644
--- a/src/context/memory.rs
+++ b/src/context/memory.rs
@@ -695,6 +695,7 @@ impl Grant {
         dst_mapper: &mut PageMapper,
         dst_flusher: impl Flusher<RmmA>,
         eager: bool,
+        allow_phys: bool,
     ) -> Result<Vec<Grant>> {
         /*
         if eager {
@@ -737,8 +738,12 @@ impl Grant {
                             src_base,
                             address_space: Arc::clone(&src_address_space_lock),
                         },
-                        Provider::PhysBorrowed { base: src_phys_base } => Provider::PhysBorrowed {
-                            base: src_phys_base.next_by(offset_from_src_base),
+                        Provider::PhysBorrowed { base: src_phys_base } => if allow_phys {
+                            Provider::PhysBorrowed {
+                                base: src_phys_base.next_by(offset_from_src_base),
+                            }
+                        } else {
+                            return Err(Error::new(EACCES));
                         },
                         Provider::External { ref address_space, src_base } => Provider::External { address_space: Arc::clone(address_space), src_base },
                         Provider::FmapBorrowed { ref file_ref } => Provider::FmapBorrowed { file_ref: file_ref.clone() }
diff --git a/src/scheme/proc.rs b/src/scheme/proc.rs
index 5dc12e32b1..9e910eb353 100644
--- a/src/scheme/proc.rs
+++ b/src/scheme/proc.rs
@@ -717,7 +717,7 @@ impl KernelScheme for ProcScheme {
 
                     dst_addr_space.mmap(requested_dst_page, src_page_count, map.flags, |dst_page, _flags, dst_mapper, dst_flusher| Grant::transfer(middle, dst_page, src_mapper, dst_mapper, InactiveFlusher::new(), dst_flusher))?
                 } else {
-                    dst_addr_space.mmap_multiple(requested_dst_page, src_page_count, map.flags, |dst_page, flags, dst_mapper, flusher| Ok(Grant::borrow(Arc::clone(addrspace), src_addr_space, src_grant_span.base, dst_page, src_grant_span.count, flags, dst_mapper, flusher, true)?))?
+                    dst_addr_space.mmap_multiple(requested_dst_page, src_page_count, map.flags, |dst_page, flags, dst_mapper, flusher| Ok(Grant::borrow(Arc::clone(addrspace), src_addr_space, src_grant_span.base, dst_page, src_grant_span.count, flags, dst_mapper, flusher, true, true)?))?
                 };
 
                 Ok(result_base.start_address().data())
diff --git a/src/scheme/user.rs b/src/scheme/user.rs
index 09720f36a7..9e8e7acb6c 100644
--- a/src/scheme/user.rs
+++ b/src/scheme/user.rs
@@ -264,7 +264,16 @@ impl UserInner {
 
         if let Some(middle_page_count) = NonZeroUsize::new(middle_page_count) {
             dst_space.mmap_multiple(Some(first_middle_dst_page), middle_page_count, map_flags, move |dst_page, page_flags, mapper, flusher| {
-                Ok(Grant::borrow(Arc::clone(&cur_space_lock), &mut *cur_space_lock.write(), first_middle_src_page, dst_page, middle_page_count.get(), page_flags, mapper, flusher, true)?)
+                let eager = true;
+
+                // It doesn't make sense to allow a context, that has borrowed non-RAM physical
+                // memory, to DIRECTLY do scheme calls onto that memory.
+                //
+                // (TODO: Maybe there are some niche use cases for that, possibly PCI transfer
+                // BARs, but it doesn't make sense yet.)
+                let allow_phys = false;
+
+                Ok(Grant::borrow(Arc::clone(&cur_space_lock), &mut *cur_space_lock.write(), first_middle_src_page, dst_page, middle_page_count.get(), page_flags, mapper, flusher, eager, allow_phys)?)
             })?;
         }