Your paging implementation maps only the first 4MiB of memory. 0x1028 is within this range and accessible, but the framebuffer address it points to (e.g., 0xE0000000) may lie outside it. You need to map the dereferenced framebuffer address to a virtual address and later use that for access.