interesting...
[    0.000000]   mapped low ram: 0 - 
20000000
[    0.000000]   low ram: 
00000000 - 
1fff0000
[    0.000000]   bootmap 
00002000 - 
00006000
max_pfn_mapped > max_low_pfn?
it seems init_memory_mapping reveals an old bug.
please check attached test patch.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
        find_low_pfn_range();
 
        /* max_pfn_mapped is updated here */
-       init_memory_mapping(0, (max_low_pfn << PAGE_SHIFT));
+       max_pfn_mapped = init_memory_mapping(0, (max_low_pfn << PAGE_SHIFT));
 
        reserve_initrd();