Fix an off-by-2 error in periphdriver_register(). The read side of the

bcopy would go off the end of the array by two elements, which sometimes
causes a panic if it happens to cross into a page that isn't mapped.

Submitted by:	gibbs
Reviewed by:	peter

1 files changed, 1 insertions, 1 deletions

diff --git a/sys/cam/cam_periph.c b/sys/cam/cam_periph.c
index de42075..bc00017 100644
--- a/sys/cam/cam_periph.c
+++ b/sys/cam/cam_periph.c
@@ -92,7 +92,7 @@ periphdriver_register(void *data)
 	newdrivers = malloc(sizeof(*newdrivers) * ndrivers, M_TEMP, M_WAITOK);
 	if (periph_drivers)
 		bcopy(periph_drivers, newdrivers,
-		      sizeof(*newdrivers) * ndrivers);
+		      sizeof(*newdrivers) * nperiph_drivers);
 	newdrivers[nperiph_drivers] = (struct periph_driver *)data;
 	newdrivers[nperiph_drivers + 1] = NULL;
 	old = periph_drivers;