It's seem that there's been some info missing from the DDK documentation for quite a while.

When you call either MmMapLockedPagesSpecifyCache or the (now deprecated) MmMapLockedPages, and you specify UserMode (to map the pages into the user address space), you must wrap this call with an exception handler.

So, for example:

    __try {
        mappedVa = MmMapLockedPagesSpecifyCache(myMdl,
            UserMode,
            MmNonCached,
            NULL,
            FALSE,
            NormalPagePriority);

    }
    __except(EXCEPTION_EXECUTE_HANDLER) {
        NTSTATUS code;
        code = GetExceptionCode();
        DbgPrint("Call to MmMapLocked failed due to exception 0x%0x\n",
            code);