|SUCCESS| vhost: fix checksum offset check in Rx path

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171667

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-19

I'll review this DPDK vhost patch against the guidelines.

## Analysis

The patch fixes a boundary check in the vhost Rx path where a checksum is being written into a packet buffer.

### Code Review

**Current code:**
```c
if (rte_pktmbuf_data_len(m) >= off + 1)
    *rte_pktmbuf_mtod_offset(m, uint16_t *, off) = csum;
```

**Proposed fix:**
```c
if (rte_pktmbuf_data_len(m) >= off + sizeof(uint16_t))
    *rte_pktmbuf_mtod_offset(m, uint16_t *, off) = csum;
```

### Findings

**ERRORS:**

1. **Off-by-one bounds check - potential buffer overflow (Error)**

   Line: `if (rte_pktmbuf_data_len(m) >= off + 1)`
   
   The guard checks for 1 byte of space but the subsequent write stores a `uint16_t` (2 bytes).
   If `rte_pktmbuf_data_len(m) == off + 1`, the condition passes but the write at offset `off`
   would overflow the buffer by 1 byte.
   
   The fix correctly uses `sizeof(uint16_t)` to ensure 2 bytes are available before the write.
   This is a real buffer overflow that could corrupt adjacent memory or crash when writing
   to an out-of-bounds address.

**Style verification:**

- Boolean logic: The comparison `>=` is explicit (comparing integers), which is correct per guidelines
- `sizeof(uint16_t)` is preferred over magic number `2` - this is good style
- No forbidden tokens introduced
- No other style issues

**Process verification:**

- Has `Fixes:` tag pointing to original commit
- Has `Cc: stable at dpdk.org` for backporting
- Single focused fix
- No documentation changes needed (internal implementation fix)
- No API changes
- No test changes needed (fixes existing code path)

### Summary

The patch correctly fixes a critical buffer overflow vulnerability. The original code's boundary check was insufficient - it verified only 1 byte of space before writing 2 bytes (a `uint16_t` checksum value). The fix properly checks for `sizeof(uint16_t)` bytes of available space, preventing the potential overflow.

This is a valid correctness bug fix with no style or process violations.

Review-Result: CLEAN