|SUCCESS| [v2] net/bnxt/tf_core: fix TCAM alloc-set key copy

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171724

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-20

# DPDK Patch Review

## Summary

This patch fixes a critical correctness bug in `tfc_msg_tcam_alloc_set()` where `memcpy()` was copying from the addresses of local pointer variables instead of the data they point to, and using incorrect lengths.

## ERRORS

**Error 1: Incorrect memcpy source addresses**

Lines being fixed:
```c
memcpy(&data[0], &key, key_size * sizeof(uint32_t));
memcpy(&data[key_size], &mask, key_size * sizeof(uint32_t));
memcpy(&data[key_size * 2], &remap, remap_size * sizeof(uint32_t));
```

The original code copies from `&key`, `&mask`, and `&remap` (addresses of the local pointer variables) instead of from `key`, `mask`, and `remap` (the buffers they point to). This copies pointer values rather than the actual key/mask/remap data, producing wrong TCAM configuration.

**Error 2: Incorrect memcpy lengths**

The original code multiplies sizes that are already in bytes by `sizeof(uint32_t)`, making each copy four times too long. This buffer overrun can corrupt adjacent memory in the request structure.

>From the commit message: the request reserves `2 * key_size + remap_size` bytes, but the original code attempts to copy `2 * key_size * 4 + remap_size * 4` bytes.

**Patch correctness:** The fix correctly copies from the buffers themselves and uses the byte sizes directly:
```c
memcpy(&data[0], key, key_size);
memcpy(&data[key_size], mask, key_size);
memcpy(&data[key_size * 2], remap, remap_size);
```

This is the correct pattern for copying data from pointer arguments into a pre-allocated buffer.

---

## VERIFICATION

### Commit Message
-  Describes the bug clearly
-  Explains both issues (wrong source, wrong length)
-  Single `Fixes:` tag
-  `Cc: stable at dpdk.org` present

### Code Changes
-  Changes match commit message description
-  Fix is minimal and focused
-  No style violations introduced
-  No forbidden tokens

### Process
-  Driver code in `drivers/net/bnxt/` (driver-specific fix is appropriate)
-  v2 addresses review feedback (split from multi-fix patch)
- Note: This is a bug fix; no release notes required per guidelines

Review-Result: CLEAN