# OOB read out of the 64-byte ISA-DMA bounce buffer (isa_dmadone, chan 1)

Silent variant (nbytes=0x800, guest survived). outbuf was kmalloc'd with
M_ZERO, so every non-zero byte below was copied by isa_dmadone's bcopy from
BEYOND the 64-byte contigmalloc'd bounce chunk (same page of the <16MB DMA
arena). Offsets 0x30-0x3f show the primed 0xE7 residue of the chunk-reuse
predecessor (in-bounds); offsets >= 0x40 are the out-of-bounds window:

```
df5520: leak+00030: e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7 e7
df5520: leak+00040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
df5520: leak+00050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
df5520: leak+00060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
df5520: leak+00070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
df5520: leak+00400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
...
```

On this boot the remainder of the bounce chunk's page was a fresh zero page;
the read EXECUTED for all 0x800 bytes (proven fatal at larger sizes — the
same bcopy faulted at the mapped-window edge 0xffffffff82604000 for
nbytes=0x11000 and 0x20000, see panic.txt / run.2.log). With any prior use
of that low-memory page (other drivers' DMA buffers, bus_dma low-address
pools), the identical call returns those contents into the driver buffer.