Claude review: gpu: nova-core: gsp: fix undefined behavior in command queue code

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness of logic transformation:**

The three branches in `driver_write_area` compute `(tail_end, wrap_end)` identically to the old split-based logic:

- `rx == 0` → `(MSGQ_NUM_PAGES - 1, 0)` — leaves sentinel at buffer end, no wrap. Matches old `(&mut after_tx[..last], &mut [])`.
- `rx <= tx` (and `rx != 0`) → `(MSGQ_NUM_PAGES, rx - 1)` — full tail, wrap up to sentinel before rx. Matches old `(after_tx, &mut before_tx[..(rx - 1)])`.
- `rx > tx` → `(rx - 1, 0)` — contiguous region `tx..rx-1`, no wrap. Matches old `(&mut after_tx[..(rx - tx - 1)], &mut [])`.

Similarly, `driver_read_area` is equivalent:
- `rx <= tx` → `(tx, 0)` — contiguous read region. Matches old `(&data[rx..tx], &[])`.
- `rx > tx` → `(MSGQ_NUM_PAGES, tx)` — discontiguous. Matches old `(&data[rx..], &data[..tx])`.

Both are correct.

**Raw pointer safety:**

The use of `&raw mut (*self.0.start_ptr_mut()).cpuq.msgq.data[0]` (line ~201 in the diff) is the right pattern — it obtains a raw pointer to the first element of the data array without ever creating an intermediate reference to the full `GspMem`. The `start_ptr_mut()` returns a `*mut GspMem`, and the field projection + indexing stays in raw-pointer land. Same for the `&raw const` variant in `driver_read_area`.

**Safety comments are adequate.** They reference the invariants of the pointer accessors and explain why the computed indices stay within bounds.

**Minor observation (non-blocking):**

In `driver_write_area`, the INVARIANTS comment states:
```
// - `wrap_end < MSGQ_NUM_PAGES`.
```

This is correct for the `rx == 0` case (wrap_end = 0) and the `rx > tx` case (wrap_end = 0), but for the `rx <= tx` case, `wrap_end = rx - 1`. Since `rx` ranges from 1 to `tx` (and `tx < MSGQ_NUM_PAGES` per `cpu_write_ptr` invariant), `wrap_end` can be at most `MSGQ_NUM_PAGES - 2`, so the bound holds. The reasoning is sound but could be slightly more explicit about *why* `rx - 1 < MSGQ_NUM_PAGES` — though arguably that's obvious given `rx < MSGQ_NUM_PAGES` from the pointer invariant.

**No bugs or correctness issues found.**

---
Generated by Claude Code Patch Reviewer