feed_eq_feed FXROUND/FXDIV align-overshoot at the SND_FXDIV_MAX boundary: reads/writes up to align-1 bytes past the caller's byte window and returns count+align-1 (sndbuf_acquire ring overflow; tmpbuf OOB write when the 64KB-exact allocation geometry holds)

Summary

The generated FXDIV reciprocals misround UP at x=SND_FXDIV_MAX and a ~12-value window below it for every non-power-of-2 divisor, so FXROUND grows count past the caller's window by up to align-1 (4-14 bytes for multichannel S16/S8), pulls that many bytes from the source, biquad-reads AND writes all of them, and returns count+align-1 - which sndbuf_acquire copies into a ring with only count free, breaking ready/free invariants. When the dest tmpbuf is an exactly-65536-byte kmalloc (driver-default 64KB hard buffers), a 4-14 byte heap OOB write with biquad-filtered audio content. GUEST-SOAKED: 32.4M checks against the PRISTINE file show 106,400 exactly-'feed <= count (65548 vs 65536)' failures at 7ch S16 (align 14); patched copy 0. The identical FXROUND idiom lives in feeder_volume/format/matrix/mixer (default-config exposure without EQ) - noted for follow-up. Clamp-the-count fix (A/B-validated).