1 files changed, 33 insertions, 2 deletions

diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index e03af8b..a947c53 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -354,14 +354,29 @@ pub unsafe fn refresh_and_exit(bs: &BootServices, image_handle: Handle) -> Resul
 
 fn init_heap() {
     unsafe {
+        // Region the firmware maps for the GOP framebuffer, if known —
+        // exclude it even when the memory map lists it as conventional
+        // (some real firmware does exactly that, which would let heap
+        // allocations overwrite the display).
+        let fb = crate::gop::framebuffer_region();
         let mut best_start = 0usize;
         let mut best_size = 0usize;
         for i in 0..MAP_ENTRIES {
             let d = &MEMORY_MAP[i];
             if d.kind == MEMORY_TYPE_CONVENTIONAL {
-                let sz = d.number_of_pages as usize * 4096;
+                let s = d.physical_start as usize;
+                let e = s + d.number_of_pages as usize * 4096;
+                // Subtract any overlap with the framebuffer region.
+                let (cs, ce) = match fb {
+                    Some((b, sz)) if e > b && s < b + sz => (s.max(b), e.min(b + sz)),
+                    _ => (e, s), // no overlap → empty range
+                };
+                let mut sz = e - s;
+                if ce > cs {
+                    sz -= ce - cs;
+                }
                 if sz > best_size {
-                    best_start = d.physical_start as usize;
+                    best_start = s;
                     best_size = sz;
                 }
             }
@@ -634,6 +649,22 @@ pub fn init_page_allocator() -> bool {
             }
         }
 
+        // Reserve the GOP framebuffer region even if the map lists it as
+        // conventional — kernel allocations (stacks, DMA buffers) must
+        // never land on the display.
+        if let Some((fbase, fsize)) = crate::gop::framebuffer_region()
+            && fsize > 0
+        {
+            let s = fbase / PAGE_SIZE;
+            let e = (fbase + fsize).div_ceil(PAGE_SIZE);
+            for p in s..e {
+                let idx = p - base_page;
+                if idx < span_pages {
+                    *bm.add(idx / 8) |= 1 << (idx % 8);
+                }
+            }
+        }
+
         // Never hand out page 0 (the null-pointer trap page).
         if base_page == 0 {
             *bm |= 0x01;