Claude review: gpu: nova-core: vbios: limit `BitToken` entry reads

Claude Code Review Bot
2026-04-12T00:18:46Z

Patch Review

This patch adds a check that `header.token_size >= size_of::<BitToken>()` and replaces direct array indexing with `.get()` + `.ok_or(EINVAL)?`.

```rust
+ if entry_size < size_of::<BitToken>() {
+ return Err(EINVAL);
```

This is a correct and important check. If the firmware reports a `token_size` smaller than the `BitToken` struct (6 bytes), the old code would index out of bounds within each entry.

The refactored loop body:

```rust
+ let entry = image
+ .base
+ .data
+ .get(entry_offset..)
+ .and_then(|data| data.get(..entry_size))
+ .ok_or(EINVAL)?;
```

This is cleaner than the old bounds check + direct indexing. The subsequent access to `entry[0]` through `entry[5]` is safe because `entry_size >= size_of::<BitToken>()` (which is 6) was verified up front.

Minor: No error message or `dev_err!` is emitted when `entry_size < size_of::<BitToken>()`. The existing code also didn't emit a message for out-of-bounds, so this is consistent. A `dev_err!` might be helpful for debugging bad firmware in the field, but it's not mandatory.

**Reviewed-by assessment: Good.**

---

---
Generated by Claude Code Patch Reviewer