--- sys/dev/sound/pcm/feeder_eq.c	2026-06-29 12:51:19.000000000 +0000
+++ sys/dev/sound/pcm/feeder_eq.c
@@ -461,8 +461,22 @@ feed_eq_feed(struct pcm_feeder *f, struct pcm_channel *c, uint8_t *b,
 	if (info->state == FEEDEQ_BYPASS)
 		return (FEEDER_FEED(f->source, c, b, count, source));

 	dst = b;
+	/*
+	 * XXX fix (pass-2 audit): the generated SND_FXDIV reciprocals are
+	 * only exact for x < SND_FXDIV_MAX -- they misround *up* at 65536
+	 * and in a small window just below it for non-power-of-2 divisors
+	 * (e.g. FXROUND(65536, 14) == 65548).  FXROUND can therefore grow
+	 * 'count' past the caller-provided byte window by (align - 1) bytes,
+	 * which makes this feeder read and write past the requested window
+	 * and return more bytes than it was given.  Clamp defensively.
+	 */
+	if (count > SND_FXDIV_MAX)
+		count = SND_FXDIV_MAX;
 	count = SND_FXROUND(count, info->align);
+	if (count > SND_FXDIV_MAX)
+		count -= info->align;

 	do {
 		if (count < info->align)