|WARNING| [RFT] net/mlx5: fix out-of-bounds stride index in vector Rx

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/171098

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-13

# DPDK Patch Review

## Errors

None identified.

## Warnings

### 1. Statistics update uses direct write (`=`) instead of accumulate (`+=`)

**File:** `drivers/net/mlx5/mlx5_rxtx_vec.c`  
**Lines:** Added lines in the error path

```c
#ifdef MLX5_PMD_SOFT_COUNTERS
			rxq->stats.ipackets -= 1;
			rxq->stats.ibytes -= elts[i]->pkt_len;
#endif
			++rxq->stats.idropped;
```

The patch decrements `ipackets` and `ibytes` when a packet is dropped after having been counted earlier in the Rx path. While this maintains correctness in this specific case (reversing an earlier increment), the pattern is fragile: if the upstream counting changes or the drop happens before stats are incremented, this becomes a silent underflow. Consider whether the stats should be adjusted at all here, or if the drop counter alone is sufficient. The `idropped` increment is correct.

### 2. Missing error propagation or return value handling

**File:** `drivers/net/mlx5/mlx5_rxtx_vec.c`  
**Lines:** After `rte_pktmbuf_free_seg(elts[i])`

The patch handles the out-of-bounds condition by dropping the packet and continuing the loop with `continue`. However, `elts[i]` is freed but the corresponding entry in the `elts[]` array is not cleared or otherwise marked invalid. Depending on how the caller uses the `elts[]` array after `rxq_copy_mprq_mbuf_v()` returns, this could lead to a use-after-free if the caller attempts to access `elts[i]` later. Verify that the caller does not rely on all `elts[i]` being valid after this function returns, or set `elts[i] = NULL` after freeing.

## Info

### Comment style suggestion

The multi-line comment uses C++ style delimiters (`//`) in the explanation, but the actual patch comment is C89 style, which is correct. No action needed.

### Stride count calculation

The stride count calculation uses:
```c
strd_cnt = (elts[i]->pkt_len / strd_sz) +
           ((elts[i]->pkt_len % strd_sz) ? 1 : 0);
```

This is equivalent to a ceiling division. The calculation is correct but could be written more clearly as:
```c
strd_cnt = (elts[i]->pkt_len + strd_sz - 1) / strd_sz;
```
This is a style preference, not a bug. The existing form is acceptable.

---

Review-Result: WARNING