Hello - This diff is more involved.
In est_acpi_pss_changed, a new table is allocated but n isn't updated, which keep tracks of the number allocated. Set it. In est_init, fake_table was being allocated with 3. Change that to allocate exactly what is need by setting n earlier. Regarding the isa/ section, in _isa_bus_dmamap_create, cookiesize is: cookiesize = sizeof(struct isa_dma_cookie); ... if ((avail_end > ISA_DMA_BOUNCE_THRESHOLD && (flags & ISABUS_DMA_32BIT) == 0) || ((map->_dm_size / NBPG) + 1) > map->_dm_segcnt) { cookieflags |= ID_MIGHT_NEED_BOUNCE; cookiesize += (sizeof(bus_dma_segment_t) * map->_dm_segcnt); } so I am assuming if ID_MIGHT_NEED_BOUNCE is set, that cookiesize gets they larger size. OK? Index: arch/amd64/amd64/est.c =================================================================== RCS file: /cvs/src/sys/arch/amd64/amd64/est.c,v retrieving revision 1.39 diff -u -p -r1.39 est.c --- arch/amd64/amd64/est.c 6 Mar 2016 22:41:24 -0000 1.39 +++ arch/amd64/amd64/est.c 31 Mar 2018 19:11:48 -0000 @@ -284,6 +284,7 @@ est_acpi_pss_changed(struct acpicpu_pss free(acpilist, M_DEVBUF, sizeof(struct fqlist)); return; } + acpilist->n = npss; for (i = 0; i < npss; i++) { acpilist->table[i].mhz = pss[i].pss_core_freq; @@ -377,10 +378,13 @@ est_init(struct cpu_info *ci) "list\n", cpu_device); return; } + if (cur == idhi || cur == idlo) + fake_fqlist->n = 2; + else + fake_fqlist->n = 3; - - if ((fake_table = mallocarray(3, sizeof(struct est_op), - M_DEVBUF, M_NOWAIT)) == NULL) { + if ((fake_table = mallocarray(fake_fqlist->n, + sizeof(struct est_op), M_DEVBUF, M_NOWAIT)) == NULL) { free(fake_fqlist, M_DEVBUF, sizeof(struct fqlist)); printf("%s: EST: cannot allocate memory for fake " "table\n", cpu_device); @@ -388,13 +392,12 @@ est_init(struct cpu_info *ci) } fake_table[0].ctrl = idhi; fake_table[0].mhz = MSR2MHZ(idhi, bus_clock); - if (cur == idhi || cur == idlo) { + if (fake_fqlist->n == 2) { printf("%s: using only highest and lowest power " "states\n", cpu_device); fake_table[1].ctrl = idlo; fake_table[1].mhz = MSR2MHZ(idlo, bus_clock); - fake_fqlist->n = 2; } else { printf("%s: using only highest, current and lowest " "power states\n", cpu_device); @@ -404,7 +407,6 @@ est_init(struct cpu_info *ci) fake_table[2].ctrl = idlo; fake_table[2].mhz = MSR2MHZ(idlo, bus_clock); - fake_fqlist->n = 3; } fake_fqlist->vendor = vendor; @@ -441,7 +443,7 @@ est_init(struct cpu_info *ci) return; nospeedstep: - free(est_fqlist->table, M_DEVBUF, 0); + free(est_fqlist->table, M_DEVBUF, est_fqlist->n * sizeof(struct est_op)); free(est_fqlist, M_DEVBUF, sizeof(*est_fqlist)); } Index: arch/amd64/isa/isa_machdep.c =================================================================== RCS file: /cvs/src/sys/arch/amd64/isa/isa_machdep.c,v retrieving revision 1.29 diff -u -p -r1.29 isa_machdep.c --- arch/amd64/isa/isa_machdep.c 14 Oct 2017 04:44:43 -0000 1.29 +++ arch/amd64/isa/isa_machdep.c 31 Mar 2018 19:11:48 -0000 @@ -455,6 +455,7 @@ void _isa_bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t map) { struct isa_dma_cookie *cookie = map->_dm_cookie; + size_t cookiesize = sizeof(struct isa_dma_cookie); /* * Free any bounce pages this map might hold. @@ -462,7 +463,10 @@ _isa_bus_dmamap_destroy(bus_dma_tag_t t, if (cookie->id_flags & ID_HAS_BOUNCE) _isa_dma_free_bouncebuf(t, map); - free(cookie, M_DEVBUF, 0); + if (cookie->id_flags & ID_MIGHT_NEED_BOUNCE) + cookiesize += (sizeof(bus_dma_segment_t) * map->_dm_segcnt); + + free(cookie, M_DEVBUF, cookiesize); _bus_dmamap_destroy(t, map); }