|WARNING| [2/2] net/bnxt: fix hot-upgrade app instance ID limit

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170568

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-05

# Review of DPDK Patch Series: net/bnxt Message Layer Fixes

## PATCH 1/2: net/bnxt: fix message-layer bounds and pointer checks

### Errors

None identified.

### Warnings

None identified.

### Info

**Code organization observation:**
The patch adds four identical NULL checks at the start of four different functions. Consider whether these checks should be wrapped in a validation macro or helper to reduce duplication and ensure consistent error messages across the codebase.

---

## PATCH 2/2: net/bnxt: fix hot-upgrade app instance ID limit

### Errors

None identified.

### Warnings

None identified.

### Info

None.

---

## Summary

Both patches address correctness issues and follow DPDK coding standards. The changes are well-scoped bug fixes appropriate for backporting to stable releases.

**Patch 1/2** fixes four real correctness bugs:
1. **Buffer overflow risk** in `tfc_msg_idx_tbl_get()`: firmware-reported `resp.data_size` was used in `memcpy()` without validation against the caller's buffer size. The fix decodes the size and rejects calls where `resp_data_size > *data_size`, preventing overrun.
2. **NULL pointer dereference** in `tfc_msg_idx_tbl_get()`: `dev_data` and `data_size` pointers were dereferenced without NULL checks. The fix adds early return with `-EINVAL` if either is NULL.
3. **Error path logic bug** in `tfc_msg_if_tbl_get()`: the function set `rc = -EINVAL` on size mismatch but fell through to `*data_size = resp.data_size` and `memcpy()`, copying the wrong number of bytes. The fix returns immediately on error and decodes `resp.data_size` before assignment.
4. **NULL pointer dereference** in `tfc_msg_idx_tbl_alloc_set()` and `tfc_msg_idx_tbl_set()`: `dev_data` was dereferenced without NULL check. The fix adds early return with `-EINVAL` if `dev_data` is NULL.

All four fixes are appropriate and necessary. The use of explicit `!dev_data` and `!data_size` comparisons conforms to DPDK style for pointer checks.

**Patch 2/2** fixes an off-by-one error in a bounds check, extending the valid instance ID range from 1-4 to the correct 1-8 as documented in the devargs validation logic.

No style violations, forbidden tokens, or guideline issues were identified in either patch. The patches are suitable for merge.