--- xnu/xnu-10002.1.13/iokit/Kernel/IOBufferMemoryDescriptor.cpp
+++ xnu/xnu-12377.41.6/iokit/Kernel/IOBufferMemoryDescriptor.cpp
@@ -38,6 +38,8 @@
 #include <libkern/OSDebug.h>
 #include <mach/mach_vm.h>
 
+#include <vm/vm_kern_xnu.h>
+
 #include "IOKitKernelInternal.h"
 
 #ifdef IOALLOCDEBUG
@@ -71,6 +73,12 @@
 	kInternalFlagInit          = 0x00000008,
 	kInternalFlagHasPointers   = 0x00000010,
 	kInternalFlagGuardPages    = 0x00000020,
+	/**
+	 * Should the IOBMD behave as if it has no kernel mapping for the
+	 * underlying buffer? Note that this does not necessarily imply the
+	 * existence (or non-existence) of a kernel mapping.
+	 */
+	kInternalFlagAsIfUnmapped  = 0x00000040,
 };
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
@@ -89,8 +97,8 @@
 	vm_address_t  vmaddr  = 0;
 	kma_flags_t kma_flags = KMA_ZERO;
 
-	if (kheap == KHEAP_DATA_BUFFERS) {
-		kma_flags = (kma_flags_t) (kma_flags | KMA_DATA);
+	if (kheap == KHEAP_DATA_SHARED) {
+		kma_flags = (kma_flags_t) (kma_flags | KMA_DATA_SHARED);
 	}
 	kr = kmem_alloc(kernel_map, &vmaddr, page_size,
 	    kma_flags, VM_KERN_MEMORY_IOKIT);
@@ -181,13 +189,14 @@
 	mach_vm_address_t physicalMask)
 {
 	task_t                mapTask = NULL;
-	kalloc_heap_t         kheap = KHEAP_DATA_BUFFERS;
+	kalloc_heap_t         kheap = KHEAP_DATA_SHARED;
 	mach_vm_address_t     highestMask = 0;
 	IOOptionBits          iomdOptions = kIOMemoryTypeVirtual64 | kIOMemoryAsReference;
 	IODMAMapSpecification mapSpec;
 	bool                  mapped = false;
 	bool                  withCopy = false;
 	bool                  mappedOrShared = false;
+	bool                  noSoftLimit = false;
 
 	if (!capacity) {
 		return false;
@@ -265,8 +274,19 @@
 		return false;
 	}
 
-	if ((inTask != kernel_task) && !(options & kIOMemoryPageable)) {
-		return false;
+	if (inTask) {
+		if ((inTask != kernel_task) && !(options & kIOMemoryPageable)) {
+			// Cannot create non-pageable memory in user tasks
+			return false;
+		}
+	} else {
+		// Not passing a task implies the memory should not be mapped (or, at
+		// least, should behave as if it were not mapped)
+		_internalFlags |= kInternalFlagAsIfUnmapped;
+
+		// Disable the soft-limit since the mapping, if any, will not escape the
+		// IOBMD.
+		noSoftLimit = true;
 	}
 
 	bzero(&mapSpec, sizeof(mapSpec));
@@ -324,7 +344,7 @@
 				}
 			}
 			_buffer = (void *) IOKernelAllocateWithPhysicalRestrict(kheap,
-			    capacity, highestMask, alignment, contig);
+			    capacity, highestMask, alignment, contig, noSoftLimit);
 		} else if (_internalFlags & kInternalFlagGuardPages) {
 			vm_offset_t address = 0;
 			kern_return_t kr;
@@ -335,8 +355,12 @@
 			if (((uint32_t) alignment) != alignment) {
 				return false;
 			}
-			if (kheap == KHEAP_DATA_BUFFERS) {
-				kma_flags = (kma_flags_t) (kma_flags | KMA_DATA);
+			if (kheap == KHEAP_DATA_SHARED) {
+				kma_flags = (kma_flags_t) (kma_flags | KMA_DATA_SHARED);
+			}
+
+			if (noSoftLimit) {
+				kma_flags = (kma_flags_t)(kma_flags | KMA_NOSOFTLIMIT);
 			}
 
 			alignMask = (1UL << log2up((uint32_t) alignment)) - 1;
@@ -365,13 +389,20 @@
 #endif
 			}
 #endif /* defined(__x86_64__) */
-		} else if (alignment > 1) {
+		} else {
+			zalloc_flags_t zflags = Z_ZERO_VM_TAG_BT_BIT;
+			if (noSoftLimit) {
+				zflags = (zalloc_flags_t)(zflags | Z_NOSOFTLIMIT);
+			}
+
 			/* BEGIN IGNORE CODESTYLE */
 			__typed_allocators_ignore_push
-			_buffer = IOMallocAligned_internal(kheap, capacity, alignment,
-			    Z_ZERO_VM_TAG_BT_BIT);
-		} else {
-			_buffer = IOMalloc_internal(kheap, capacity, Z_ZERO_VM_TAG_BT_BIT);
+			if (alignment > 1) {
+				_buffer = IOMallocAligned_internal(kheap, capacity, alignment,
+					zflags);
+			} else {
+				_buffer = IOMalloc_internal(kheap, capacity, zflags);
+			}
 			__typed_allocators_ignore_pop
 			/* END IGNORE CODESTYLE */
 		}
@@ -395,9 +426,6 @@
 			if (!withCopy) {
 				mapTask = inTask;
 			}
-			if (NULL == inTask) {
-				inTask = kernel_task;
-			}
 		} else if (options & kIOMapCacheMask) {
 			// Prefetch each page to put entries into the pmap
 			volatile UInt8 *    startAddr = (UInt8 *)_buffer;
@@ -411,11 +439,16 @@
 		}
 	}
 
-	_ranges.v64->address = (mach_vm_address_t) pgz_decode(_buffer, _capacity);
+	_ranges.v64->address = (mach_vm_address_t) _buffer;
 	_ranges.v64->length  = _capacity;
 
-	if (!super::initWithOptions(_ranges.v64, 1, 0,
-	    inTask, iomdOptions, /* System mapper */ NULL)) {
+	if (!super::initWithOptions(
+		    /* buffers */ _ranges.v64, /* count */ 1, /* offset */ 0,
+		    // Since we handle all "unmapped" behavior internally and our superclass
+		    // requires a task, default all unbound IOBMDs to the kernel task.
+		    /* task */ inTask ?: kernel_task,
+		    /* options */ iomdOptions,
+		    /* System mapper */ NULL)) {
 		return false;
 	}
 
@@ -681,7 +714,7 @@
 	IOMemoryMap *    map       = NULL;
 	IOAddressRange * range     = _ranges.v64;
 	vm_offset_t      alignment = _alignment;
-	kalloc_heap_t    kheap     = KHEAP_DATA_BUFFERS;
+	kalloc_heap_t    kheap     = KHEAP_DATA_SHARED;
 	vm_size_t        rsize;
 
 	if (alignment >= page_size) {
@@ -744,7 +777,8 @@
 #endif /* defined(__x86_64__) */
 		} else if (kInternalFlagGuardPages & internalFlags) {
 			vm_offset_t allocation = (vm_offset_t)buffer - page_size;
-			kmem_free(kernel_map, allocation, size + page_size * 2);
+			kmem_free(kernel_map, allocation, size + page_size * 2,
+			    (kmf_flags_t)(KMF_GUARD_FIRST | KMF_GUARD_LAST));
 #if IOALLOCDEBUG
 			OSAddAtomicLong(-size, &debug_iomalloc_size);
 #endif
@@ -850,6 +884,10 @@
 void *
 IOBufferMemoryDescriptor::getBytesNoCopy()
 {
+	if (__improbable(_internalFlags & kInternalFlagAsIfUnmapped)) {
+		return NULL;
+	}
+
 	if (kIOMemoryTypePhysical64 == (_flags & kIOMemoryTypeMask)) {
 		return _buffer;
 	} else {
@@ -867,6 +905,10 @@
 IOBufferMemoryDescriptor::getBytesNoCopy(vm_size_t start, vm_size_t withLength)
 {
 	IOVirtualAddress address;
+
+	if (__improbable(_internalFlags & kInternalFlagAsIfUnmapped)) {
+		return NULL;
+	}
 
 	if ((start + withLength) < start) {
 		return NULL;