Claude review: gpu: nova-core: vbios: fix various cases of reading past `BIOS_MAX_SCAN_LEN`

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This patch fixes three issues:

1. **`read_more_at_offset` bounds check**: The old code checked `offset > BIOS_MAX_SCAN_LEN` but didn't account for `len`, so `offset + len` could exceed the limit. The fix computes `end = offset.checked_add(len)` and checks `end > BIOS_MAX_SCAN_LEN`.

2. **`read_more_at_offset` over-read**: The old logic computed `gap_bytes + len` which would read `len` additional bytes even when some were already cached. The new `end.saturating_sub(self.data.len())` correctly reads only the uncached portion. This is a genuine bug fix.

3. **`read_bios_image_at_offset` overflow**: Similarly replaces `offset + len` with `checked_add`.

4. **Iterator boundary**: Changes `>` to `>=` for `current_offset >= BIOS_MAX_SCAN_LEN`.

All four changes are correct. One observation:

```rust
+        let end = offset.checked_add(len).ok_or(EINVAL)?;
+
+        if end > BIOS_MAX_SCAN_LEN {
```

The `read_more` function requires `len` to be a multiple of 4. After the fix, `read_more_at_offset` calls `self.read_more(end.saturating_sub(self.data.len()))` — if `end` and `self.data.len()` don't have matching alignment, this could pass a non-multiple-of-4 to `read_more`, which would then return `EINVAL`. This was also possible with the old code (it depended on the caller), so it's not a regression — just worth noting that callers must ensure alignment-compatible `offset` and `len` values.

**Reviewed-by assessment: Good.**

---

---
Generated by Claude Code Patch Reviewer