Created attachment 210977 [details]
I'm developing a frame buffer driver for hardware using 3 bytes per pixel but the hardware requires the stride to be a multiple of 256 bytes. Because the stride is not a multiple of 3 bytes, the way vt_fb_blank() is coded, it writes past the end of each stride and, on the last line, writes past the end of the frame buffer. This is caught by a KASSERT in vt_fb_mem_wr1().
I think the loops in vt_fb_blank() could just stop at the end of the line (fb_width) instead of clearing memory all the way to the end of a stride. The other way would be to limit the loops with fb_stride - 1, fb_stride - 2, fb_stride - 3 for the cases of 2,3,4 bytes per pixel.
Created attachment 210991 [details]
Comment on attachment 210991 [details]
My previous patch was wrong. fb_width is the width in pixels, not bytes. This was my other suggested fix.