Thanks for the review. I have prepared a four-patch v8 based on net-next commit 05b5019b01fb, with the following dispositions.
On Wed, 14 Oct 2026 08:06:24 +0000, [email protected] wrote: > [Severity: High] > Should there be a bounds check against r->size or hwc->num_inflight_msg > before msg_id is used here? > No additional bounds check is needed on the reported path. mana_hwc_handle_resp() is static and its sole caller is mana_hwc_rx_event_handler(). That caller reads hwc_msg_id once with READ_ONCE, rejects msg_id >= num_inflight_msg, and passes the already-bounded local value to the helper. The helper does not reread the shared DMA field for indexing. The existing out-of-range early return's missing RX repost is a separate baseline liveness issue, acknowledged here; it is not an out-of-bounds caller_ctx access. Regards, Wei
