1 files changed, 7 insertions, 1 deletions

diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c
index d5a05d11990bf..55147e3f525d1 100644
--- a/sys/dev/sound/pcm/dsp.c
+++ b/sys/dev/sound/pcm/dsp.c
@@ -1022,10 +1022,16 @@ dsp_mmap(dev_t i_dev, vm_offset_t offset, int nprot)
 		return -1;
 	}
 
+	if (offset >= sndbuf_getsize(c->bufsoft)) {
+		relchns(i_dev, rdch, wrch, SD_F_PRIO_RD | SD_F_PRIO_WR);
+		splx(s);
+		return -1;
+	}
+
 	if (!(c->flags & CHN_F_MAPPED))
 		c->flags |= CHN_F_MAPPED;
 
-	ret = atop(vtophys(((char *)sndbuf_getbuf(c->bufsoft)) + offset));
+	ret = atop(vtophys(sndbuf_getbufofs(c->bufsoft, offset)));
 	relchns(i_dev, rdch, wrch, SD_F_PRIO_RD | SD_F_PRIO_WR);
 
 	splx(s);