The Buffalo shooter bought his rifle legally in New York. Same goes for the most recent shooter in Texas. The San Bernardino shooters bought their firearms legally in California, then modified magazines to accept more than 10 rounds. The Orlando night club shooter bought his guns legally. He even had a valid security guard license.
The only example I know of is Gilroy Garlic Festival shooter. He lived in Nevada and bought a WASR-10 (an AK variant) there, then drove to California to massacre people. While the WASR-10 is illegal in California, very similar rifles are legal in the state. Had he lived in California, he could have purchased a Palmetto State Armory GF3 (or any other CA-legal AK clone), then removed the grip fin and modified the magazine to accept 30 rounds.