hdac.c pass-2 clamp-chain live evidence (hw.snd.verbose=4, maxautovchans=0)
===========================================================================
Captured during the DF-4115 verify run (2026-09-18, QEMU ICH6 intel-hda).
Every "chn_resizebuf ... b[size/blksz/blkcnt]" line below is the HARDWARE
sndbuf (the one whose blkcnt reaches hdac_stream_start() via ch->blkcnt
and bounds the BDL walk at hdac.c:1989-1995 against the 256-entry BDL
allocated at hdac.c:1306-1307).

Unprivileged hostile SETFRAGMENT battery (frag_start.c) + double-fragment
hblkcnt>256 driver (hblkcnt_max.c):

  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=51 b[2048/1024/2] bs[4096/128/32] limit=256
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=34 b[4096/2048/2] bs[65536/2048/32] limit=4096
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=51 b[2048/1024/2] bs[8192/256/32] limit=512
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=51 b[2048/1024/2] bs[16384/512/32] limit=1024
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=68 b[65536/32768/2] bs[131072/65536/2] limit=65536
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=68 b[256/128/2] bs[131072/16/8192] limit=256
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=1 b[256/128/2] bs[256/16/16] limit=256
  pcm0: chn_resizebuf(): PCMDIR_PLAY (hardware) timeout=2 b[256/128/2] bs[4096/16/256] limit=256
  sndbuf_resize(): b=0xfffff8004f24f5c0 0xfffff8011869e000 -> 0xfffff80118301000 [65536 -> 4096 : 256]

Observations:
  * across all ~85 hardware-channel resizes under hostile fragments the
    hard blkcnt never exceeded 2 (chan_blkcnt default on this pcm);
  * the SOFT buffer (bs[...]) freely reaches blkcnt 8192 (16B blocks),
    but the hard request is separately computed and clamped:
      channel.c:1832  hblkcnt = round_pow2(sndbuf_getblkcnt(bs))   <= 8192
      channel.c:1843  while ((hblksz * hblkcnt) > maxsize) halve
      -> hdaa.c:2096  if (blkcnt > HDA_BDL_MAX) blkcnt = HDA_BDL_MAX;
      -> hdaa.c:2117  ch->blkcnt = sndbuf_getblkcnt(ch->b)          <= 256
      -> hdac.c:1989  for (i = 0; i < blkcnt; i++, bdle++)          BDL walk
         BDL allocation = 256 entries (hdac.c:1306-1307, HDA_BDL_MAX)
  * streams were STARTED (write()) under every hostile config; guest
    never panicked in any hdac path;
  * polling mode (dev.hdac.0.polling=1) ran frag_start to completion
    (hdac_mdata_rate / hdac_poll_reinit exercised; no div0, no spin).

Controller caps at runtime (bootverbose):
  hdac0: Caps: OSS 4, ISS 4, BSS 0, NSDO 1, 64bit, CORB 256, RIRB 256
  -> BSS 0: the DF-4115 (BSS stream numbering) trigger is structurally
     unreachable on the only available HDA hardware (QEMU ICH6).