One Byte Every Four Kilobytes

size_t len = 1UL << 30;                  /* 1 GiB */
char *p = mmap(NULL, len, PROT_READ | PROT_WRITE,
               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

for (size_t i = 0; i < len; i += 4096)
    p[i] = 1;                            /* one byte per page */

The mmap returns instantly and RSS barely moves. A teammate points out the loop stores only a quarter of a megabyte of data and concludes that any RSS growth beyond that is an allocator bug.

With 4 KiB pages, how many page faults does the loop take and how far does RSS grow?