|SUCCESS| net/iavf: fix crash in Tx drain on PF reset

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172351

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-02

# DPDK Patch Review

## Patch: net/iavf: fix crash in Tx drain on PF reset

### Summary
This patch fixes a crash in the iavf driver's Tx drain function that occurs during PF reset. The issue was that the cleanup helpers were being called on queues with fewer than `tx_rs_thresh` descriptors outstanding, leading to attempts to free NULL or already-freed mbufs.

---

## ERRORS

None.

---

## WARNINGS

None.

---

## INFO

**Correctness of the fix:**
The fix correctly addresses the root cause. The cleanup helpers assume a full RS block is outstanding before they should run. The new condition `(uint16_t)(txq->nb_tx_desc - 1 - txq->nb_tx_free) < txq->tx_rs_thresh` properly checks that at least `tx_rs_thresh` descriptors are in-flight before attempting cleanup, preventing the crash described in the commit message.

**Cast to uint16_t:**
The explicit cast to `uint16_t` in the comparison handles potential underflow correctly when computing the number of outstanding descriptors. This is appropriate given that `nb_tx_desc`, `nb_tx_free`, and `tx_rs_thresh` are all `uint16_t` types.

**Comment improvement:**
The new comment "Only clean up once a full RS block is outstanding." is clearer and more accurate than the previous comment about the ring being empty, which was misleading in this context.

**Logic verification:**
- `nb_tx_desc - 1 - nb_tx_free` = number of descriptors in use
- If this is less than `tx_rs_thresh`, no full RS block is pending
- Continue to next queue (skip cleanup) - correct behavior

The fix is sound and addresses the crash without introducing new issues.

---

Review-Result: CLEAN