From 3c8d8161cc8ccc6e87b781d629d08b17a789e329 Mon Sep 17 00:00:00 2001
From: Michael Scire <SciresM@gmail.com>
Date: Sat, 11 Jul 2020 02:06:44 -0700
Subject: [PATCH] kern: fix bug in ToMessageBuffer pointer transfer selection

---
 libraries/libmesosphere/source/kern_k_server_session.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/libmesosphere/source/kern_k_server_session.cpp b/libraries/libmesosphere/source/kern_k_server_session.cpp
index f6ab0787c..306ce5979 100644
--- a/libraries/libmesosphere/source/kern_k_server_session.cpp
+++ b/libraries/libmesosphere/source/kern_k_server_session.cpp
@@ -88,7 +88,7 @@ namespace ams::kern {
                             break;
                         case ipc::MessageBuffer::MessageHeader::ReceiveListCountType_ToMessageBuffer:
                             {
-                                const uintptr_t buf = util::AlignUp(this->msg_buffer_end, PointerTransferBufferAlignment);
+                                const uintptr_t buf = util::AlignUp(this->msg_buffer_end + key, PointerTransferBufferAlignment);
 
                                 if ((buf < buf + size) && (buf + size <= this->msg_buffer_space_end)) {
                                     out = buf;