--- xnu/xnu-1699.22.81/iokit/Kernel/IOBufferMemoryDescriptor.cpp
+++ xnu/xnu-2050.9.2/iokit/Kernel/IOBufferMemoryDescriptor.cpp
@@ -99,6 +99,8 @@
 	return (false);
     _ranges.v64->address = 0;
     _ranges.v64->length  = 0;
+	//  make sure super::free doesn't dealloc _ranges before super::init
+	_flags = kIOMemoryAsReference;
 
     // Grab IOMD bits from the Buffer MD options
     iomdOptions  |= (options & kIOBufferDescriptorMemoryFlags);
@@ -146,6 +148,10 @@
 
 	case kIOMapCopybackCache:
 	    SET_MAP_MEM(MAP_MEM_COPYBACK, memEntryCacheMode);
+	    break;
+
+	case kIOMapCopybackInnerCache:
+	    SET_MAP_MEM(MAP_MEM_INNERWBACK, memEntryCacheMode);
 	    break;
 
 	case kIOMapDefaultCache: