Claude review: gpu: nova-core: gsp: fix undefined behavior in command queue code

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness of the UB fix:**

The core issue is on lines like the old:
```rust
let gsp_mem = &mut unsafe { self.0.as_slice_mut(0, 1) }.unwrap()[0];
```
This creates `&mut GspMem`, a mutable reference to the *entire* shared memory structure. Even though the code only subsequently accesses the driver-owned region via `split_at_mut`, the reference itself covers GSP-owned memory that may be concurrently modified, violating Rust's aliasing rules.

The fix correctly uses:
```rust
let data = unsafe { &raw mut (*self.0.start_ptr_mut()).cpuq.msgq.data[0] };
```
This obtains a raw pointer via place projection (`&raw mut` on a field path through a raw pointer dereference), which does *not* create an intermediate reference to `GspMem`. Slices are then constructed only over driver-owned regions via `core::slice::from_raw_parts_mut`.

**Ring buffer logic verification:**

All three branches of `driver_write_area` are correct:

- `rx == 0`: Returns `[tx, MSGQ_NUM_PAGES - 1)` — correctly leaves one empty sentinel slot at the end. `after_tx_len - 1` cannot underflow because `tx < MSGQ_NUM_PAGES` guarantees `after_tx_len >= 1`.

- `rx <= tx` (rx ≠ 0): Returns `[tx, MSGQ_NUM_PAGES)` and `[0, rx-1)` — correctly leaves one slot before `rx`. `rx - 1` is safe because `rx != 0`.

- `rx > tx`: Returns `[tx, rx-1)` — correctly leaves one slot before `rx`. `rx - tx - 1` is non-negative because `rx > tx`.

The `driver_read_area` branches are also correct:

- `rx <= tx`: Returns `[rx, tx)` — contiguous read area. When `rx == tx` this produces a zero-length slice, correctly indicating an empty queue.

- `rx > tx`: Returns `[rx, MSGQ_NUM_PAGES)` and `[0, tx)` — discontiguous read area wrapping around.

**Minor observations (non-blocking):**

1. The `driver_read_area` code still uses `as usize` casts on line 277-278 of the new code:
   ```rust
   let tx = self.gsp_write_ptr() as usize;
   let rx = self.cpu_read_ptr() as usize;
   ```
   while `driver_write_area` was updated to use `num::u32_as_usize()`. This inconsistency is cosmetic but could be cleaned up for consistency.

2. The SAFETY comment style using numbered references (`SAFETY[1]`, `PANIC[1]`) is a nice pattern for avoiding repetition. The comments are thorough and accurate.

3. The commit message has a minor typo: "read of write access" should be "read **or** write access."

**No functional issues found.** The patch correctly eliminates the UB while preserving the exact same externally-observable behavior.

---
Generated by Claude Code Patch Reviewer