yes.. the buffer is inside the disk itself ,DMA keeps count of words inside buffer..i would suggest that you go through number of questions on gate overflow itself about DMA access you will have a clear view .. what i concluded that generally in burst mode buffer is not filled before and this is the reason why transfer happens at device rate in burst mode. whereas in cycle stealing mode first the buffer is loaded with 1 byte or 2 or any specified in question(generally 1 byte if not specified) and then DMA access the bus that is why in cycle stealing mode that one byte is transferred at bus rate.
now i have come through some questions where it explicitly says that buffer is filled before giving bus access to CPU , (in burst mode) then this time of filling buffer comes under preparation time.
example https://gateoverflow.in/31720/dma