# DF-3999 — Record channels mis-mapped to play hw numbers: OOB rbuf reads before/after the buffer on every record pass

**File:** `sys/dev/sound/pci/envy24ht.c` (pass 2)
**Class:** kernel info leak (unprivileged, deterministic) + broken record routing.

## Reproduce

```
scp -F dfbsd-qemu/config emldmaht_harness.c dfbsd-maxx:/tmp/
vm.sh run_user 'cc -O2 -Wall -o /tmp/emldmaht_harness /tmp/emldmaht_harness.c && /tmp/emldmaht_harness'
```

## Expected (baseline) — cases [A]/[B]

```
[A] 1st rec ch (num=1, slot=-8, offset=0), r32sl:
  [A] user stream received 8 samples from BEFORE rbuf, 0 from PAST rbuf end
         first leaked: data[0] = 0xabadbe08 (kernel-heap marker)
[B] 5th rec ch (num=10, slot=+10, offset=0), r32sl:
  [B] user stream received 0 samples from BEFORE rbuf, 10 from PAST rbuf end
         first leaked: data[8182] = 0xdeadfe00 (kernel-heap marker)
```

Fixed variant (`emldmaht_harness_fixed.c`, slot clamp applied): both cases 0.

## Files

Same harness as DF-3998 (cases [A]/[B] are this finding); `fix.diff` is the
slot clamp. Live /dev/dsp trigger hardware-gated (env.txt: envy24-pci-devs=0).