DF-4611 — nm_init() programs ring/coeff buffers from unvalidated
card-provided buftop: cbuf/rbuf/pbuf/acbuf wrap to ~0xffffxxxx and later
nm_wrbuf()/sndbuf_setup() write at wild offsets.

BUILD (guest, portable userland)
    cc -O -Wall -o /tmp/buftop_prover /tmp/buftop_prover.c

RUN (guest, any user)
    /tmp/buftop_prover

EXPECTED
    Table of hostile buftop values → wrapped offsets, e.g.
        buftop=0xffffed00  pbuf=0xffff1d00  "WRAPS -> ~4G OOB bus_space offset"
    plus the derived minimum sane buftop 0x1b960.  Full output: run.log.
    Kernel-side trigger needs real NM256 hardware (absent: env.txt).

FIX VALIDATION (build-only, on guest /usr/src copy)
    cd /usr/src && patch -p1 < fix.diff
    cd sys/dev/sound/driver/neomagic && make       # -Werror, clean
    (see build.log)