Claude review: drm/msm: Fix dma_free_attrs() buffer size

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Verdict: Correct fix, minor style suggestion.**

The bug is clear and verified by reading the full file:

**Allocation** at `a2xx_gpummu_new()` (line 102):
```c
gpummu->table = dma_alloc_attrs(dev, TABLE_SIZE + 32, &gpummu->pt_base,
    GFP_KERNEL | __GFP_ZERO, DMA_ATTR_FORCE_CONTIGUOUS);
```

**Free** (before fix) at `a2xx_gpummu_destroy()` (line 81):
```c
dma_free_attrs(mmu->dev, TABLE_SIZE, gpummu->table, gpummu->pt_base,
    DMA_ATTR_FORCE_CONTIGUOUS);
```

The extra 32 bytes exist to hold a "translation error" address, as shown in `a2xx_gpummu_params()` (line 121):
```c
*tran_error = base + TABLE_SIZE; /* 32-byte aligned */
```

The fix correctly changes the free to `TABLE_SIZE + 32` to match the allocation.

**Minor nit (not blocking):** The magic number `32` is repeated in three places (alloc, free, and implicitly in `a2xx_gpummu_params`). Defining something like `#define TRAN_ERROR_SIZE 32` and using `TABLE_SIZE + TRAN_ERROR_SIZE` would make the relationship clearer and prevent future mismatches. But that's a cleanup suggestion, not something that should hold up this bugfix.

**Reviewed-by worthy.** The Fixes tag and Cc: stable are appropriate.

---
Generated by Claude Code Patch Reviewer