A new LSB/MSB counter write must replace the previous programmed
value.

The first byte is currently OR'ed into ilatch, leaving bits from
the previous divisor set and potentially programming the wrong
count.
---
 usr.sbin/vmd/i8253.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr.sbin/vmd/i8253.c b/usr.sbin/vmd/i8253.c
index 917def18b75..3723bcde639 100644
--- a/usr.sbin/vmd/i8253.c
+++ b/usr.sbin/vmd/i8253.c
@@ -287,7 +287,7 @@ vcpu_exit_i8253(struct vm_run_params *vrp)
 
 		if (vei->vei.vei_dir == VEI_DIR_OUT) { /* OUT instruction */
 			if (i8253_channel[sel].last_w == 0) {
-				i8253_channel[sel].ilatch |= (out_data & 0xff);
+				i8253_channel[sel].ilatch = out_data & 0xff;
 				i8253_channel[sel].last_w = 1;
 			} else {
 				i8253_channel[sel].ilatch |=
-- 
2.51.0