From e0a14f35648c2d21861f3cc227a6e6f73d6ec752 Mon Sep 17 00:00:00 2001
From: tsutsui <tsutsui@NetBSD.org>
Date: Sat, 20 Nov 2010 18:03:49 +0000
Subject: [PATCH] Fix botches in rev 1.185 (kent-audio1 merge) which cause
 buffer overrun and "tlb_exception: no copyin/out fault hander" panic in
 audio_fill_silence() after audio playback on dreamcast.

The problem is tracked and fix is provieded by Ryo SHIMIZU,
who is the auther of aica(4) audio driver for dreamcast.
---
 sys/dev/audio.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sys/dev/audio.c b/sys/dev/audio.c
index 4422ae144cf4..30bcd130a285 100644
--- a/sys/dev/audio.c
+++ b/sys/dev/audio.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: audio.c,v 1.251 2010/02/24 22:37:56 dyoung Exp $	*/
+/*	$NetBSD: audio.c,v 1.252 2010/11/20 18:03:49 tsutsui Exp $	*/
 
 /*
  * Copyright (c) 1991-1993 Regents of the University of California.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.251 2010/02/24 22:37:56 dyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.252 2010/11/20 18:03:49 tsutsui Exp $");
 
 #include "audio.h"
 #if NAUDIO > 0
@@ -2778,8 +2778,8 @@ audio_pint(void *v)
 
 			/* Clear next block so we keep ahead of the DMA. */
 			used = audio_stream_get_used(&cb->s);
-			if (used + cc < cb->s.end - cb->s.start)
-				audio_pint_silence(sc, cb, inp, blksize);
+			if (used + blksize < cb->s.end - cb->s.start)
+				audio_pint_silence(sc, cb, cb->s.inp, blksize);
 		}
 	}