|WARNING| [v2] net/bnxt: fix memory corruption in tunnel entry list

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/171201

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-13

# DPDK Patch Review

## Summary

This patch fixes a critical out-of-bounds write bug in the tunnel entry search function. The fix is correct and the commit message accurately describes the defect.

---

## ERRORS

### 1. Missing release notes update

**File:** (none - missing update)

**Issue:** This patch fixes a memory corruption bug (buffer underflow) that has existed since the tunnel offload feature was added. Such correctness fixes require a release notes entry in the Fixes section.

**Required action:** Add an entry to `doc/guides/rel_notes/release_26_11.rst` (or the appropriate current release file) under "**Fixed Issues**" describing the memory corruption fix.

Example entry:
```rst
* **net/bnxt: Fixed memory corruption in tunnel entry search.**

  Fixed an out-of-bounds write in ``ulp_app_tun_search_entry()`` that
  could corrupt memory when searching for matching tunnel entries.
```

---

## WARNINGS

None.

---

## INFO

### Code correctness verification

The fix is correct. The original code had:

```c
tun_ent_list[free_entry].ref_cnt++;
```

Where `free_entry` is:
- `-1` when no unused slot was found before the match (typical when the table is full or the match is early in the list)
- The index of the first unused slot encountered before index `i`

Writing to `tun_ent_list[-1]` is an out-of-bounds write that corrupts whatever memory precedes the array. When `free_entry` is a valid index, the code increments the wrong entry's refcount, leaving the matched entry's count unchanged (resource leak) and potentially causing the unused slot to appear in use.

The fix correctly increments `tun_ent_list[i].ref_cnt`, where `i` is the index of the matched entry.

### Commit message quality

The commit message clearly explains the bug, the conditions under which the out-of-bounds write occurs, and the consequences of both the underflow and the wrong-slot increment. The v2 clarification (that `free_entry == -1` whenever no unused slot precedes the match, not only when full) improves accuracy.

---

## FINAL CHECK

**Pass 1 (Correctness bugs):** The patch fixes an out-of-bounds write. No new correctness issues introduced.

**Pass 2 (Style/process false positives):** The missing release notes entry is a genuine process requirement for a Cc: stable fix.

**Pass 3 (Evidence):**
- Release notes requirement: patch has `Cc: stable at dpdk.org` and fixes a correctness bug - requires release notes per "Documentation" section of AGENTS.md.
- Code fix: correct per inspection of the function logic and the loop variable semantics.

---

Review-Result: ERROR