|SUCCESS| [v2] net/bnxt: fix memory corruption in tunnel entry list

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171201

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-13

# DPDK Patch Review

## ERRORS

None identified.

## WARNINGS

None identified.

## INFO

### Pre-existing: Missing input validation

The function `ulp_app_tun_search_entry()` does not validate `tun_entry` before dereferencing it at line 35:
```c
*tun_entry =  &tun_ent_list[i];
```
If `tun_entry` is `NULL`, this will cause a NULL pointer dereference. This is pre-existing code not introduced by this patch, but adding a NULL check would harden the function against misuse.

### Correctness of the fix

The patch correctly addresses an out-of-bounds write. The original code:
```c
tun_ent_list[free_entry].ref_cnt++;
```
When `free_entry` is `-1`, this writes to `tun_ent_list[-1]`, which is before the start of the array and causes undefined behavior (memory corruption). The fix uses the correct index `i` which points to the matched entry. This is the proper correction.

Review-Result: CLEAN