Sound through ALSA, a 2D game, and a stack walk that cannot panic

SDL 3 has no OSS backend and SchOS has no ALSA kernel side, so sound now
goes SDL -> alsa-lib -> alsa-plugins' OSS plugin -> /dev/dsp. That path
found two bugs underneath it:

- ac97: resetting the PCM-out box also clears the descriptor list address,
  and nothing set it again. Every stream after the first stop played a
  "list" at physical address 0 -- silence -- and ALSA resets before each
  stream. If the engine halts at the end of the queue, the run bit is set
  again.
- /dev/dsp: SETFRAGMENT, GETFMTS, GETCAPS, SETTRIGGER, GETOPTR and GETODELAY
  for the plugin's ring-and-pointer model, and poll(), writable once a whole
  fragment fits (ALSA spun at 76% CPU otherwise). speaker-test now plays in
  real time at 0% CPU, verified in a recording of QEMU's AC'97.
- /etc/asound.conf: the default device is a plug to the OSS device at 16-bit
  stereo 48 kHz, what every SchOS audio driver plays.

Also:

- getstackpcs: each frame link must go up the same stack by less than
  KSTACKSIZE. The chain ends at the syscall entry with the user's rbp,
  which lbreakouthd uses as a register (-1024); the walk dereferenced it
  under the syscall tracer and the kernel panicked inside acquire().
- fb: FBIOGET_VSCREENINFO reports nominal timings, as Linux's efifb does,
  instead of zeros, which Xorg's fbdev turned into a 0 Hz RandR mode.
- procdump (Ctrl-P) shows where runnable threads are in user space.
- World: lbreakouthd instead of lbreakout2 (its stk.c passes vsnprintf a
  size of 511 plus the prefix length, and Alpine's fortified headers trap on
  that), plus curl, alsa-lib and alsa-plugins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

kernel/core/spinlock.c

@@ -90,7 +90,19 @@ getstackpcs(addr_t *rbp, addr_t pcs[])
     if(((addr_t)rbp & 7) != 0)
       break;
     pcs[i] = rbp[1];
-    rbp = (addr_t*)rbp[0];
+    // The next frame is the caller's, further up the same stack: higher, and
+    // by less than a whole kernel stack. The chain ends at the system call or
+    // interrupt entry, and the rbp saved there is the user's -- which an
+    // optimised program uses as an ordinary register. lbreakouthd left -1024
+    // in it, 0xfffffffffffffc00, which passed every test above and faulted
+    // here under the syscall tracer, taking the kernel down from inside the
+    // lock it was recording.
+    addr_t *next = (addr_t*)rbp[0];
+    if(next <= rbp || (addr_t)next - (addr_t)rbp >= KSTACKSIZE){
+      i++;                      // keep the return address just read
+      break;
+    }
+    rbp = next;
   }
   for(; i < 10; i++)
     pcs[i] = 0;