Thanks for the review. On Tue, 20 Oct 2026 13:36:30 +0000, [email protected] wrote:
> This isn't a bug introduced by this patch, but can this memcpy() read > past the end of the RX slot? This is pre-existing in the baseline driver; we will address separately. As noted in the review, patch 4 already bounds the requested response size by the RX slot capacity before admission in the completed series. > This isn't a bug introduced by this patch, but can a late response for a > timed-out command be delivered to the next sender that reuses this > msg_id? This is pre-existing in the baseline driver; we will address separately. As noted in the review, patch 3 already keeps a timed-out slot reserved until its pending response is consumed or teardown retires it. That protection remains in v9. Regards, Wei
