My guess is you end up with 2 copies of each page on the guest: the copy in the guest's page cache, and the copy in the buffer you allocated. From the perspective of the host this all looks like anonymous memory, so ksm merges the pages.