|SUCCESS| [v2] net/bnxt: fix memory corruption in tunnel entry list

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171201

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-13

# DPDK Patch Review

## Analysis

This patch fixes a critical correctness bug in the bnxt driver's tunnel entry management. I have verified the patch content against the AGENTS.md guidelines.

### Correctness Issues

**None.** The patch corrects a serious array indexing bug:
- **Fixed**: Out-of-bounds write when `free_entry == -1` and a match is found. The original code wrote to `tun_ent_list[-1]`, which is before the start of the array.
- **Fixed**: Wrong reference count increment when `free_entry >= 0`. The original code incremented the count of an unused slot instead of the matched entry at index `i`.

The fix is minimal and correct: it uses the matching index `i` instead of `free_entry`.

### Code Style and Guidelines Compliance

Reviewing against AGENTS.md requirements:

- **Code style**: The change is a single-line fix using the correct index variable. Style is consistent with surrounding code.
- **Commit message**: Clear description of the bug and the fix. Includes the consequence of the original error (negative index writes before the array, positive index increments the wrong slot).
- **Fixes tag**: Present and correct.
- **Cc: stable**: Present and appropriate for a correctness bug.
- **Signoffs**: All required signoffs are present.

### Documentation and Testing

- **No documentation changes needed**: This is an internal driver bug fix with no API changes.
- **No test changes needed**: This fixes existing functionality; no new features are added.
- **No release notes needed**: Internal bug fix in driver code (per AGENTS.md, test-only and internal changes don't require release notes).

### Verification

I traced the code path:
1. The loop searches for a matching tunnel entry starting at `i = 0`.
2. `free_entry` tracks the first unused slot (`ref_cnt == 0`) or remains `-1` if none found.
3. When a match is found at index `i`, the code previously incremented `tun_ent_list[free_entry].ref_cnt`.
   - If `free_entry == -1` (no free slot before the match), this accessed `tun_ent_list[-1]`, writing before the array (memory corruption).
   - If `free_entry >= 0`, this incremented an unused slot's count instead of the matched entry's count (logic error).
4. The fix correctly increments `tun_ent_list[i].ref_cnt`, the matched entry.

This is a correctness bug of the highest priority. The patch fixes it correctly.

## Summary

The patch correctly fixes a critical out-of-bounds array access and reference count management bug. No issues found.

Review-Result: CLEAN