Claude review: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**DPCD read fix (line 883):**
```c
-	if (idx > raw->curlen)
+	if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen)
```
Correct. The old check only validated that `idx` (the position after reading `num_bytes` from the header) was within bounds. It did not account for the subsequent `memcpy` of `num_bytes` bytes starting at `idx`. Since `idx` is `int` (value ~3 at this point) and `num_bytes` is `u8` (max 255), the addition cannot overflow and the comparison against `u8 curlen` is safe.

**I2C read fix (lines 919-920):**
```c
-	/* TODO check */
+	if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen)
+		goto fail_len;
```
Correct. This resolves a longstanding TODO — the I2C read path had **no** bounds check at all before the `memcpy`. The fix mirrors the DPCD read fix and uses the same `fail_len` label pattern already present in the function.

**Boundary condition correctness:** The check `idx + num_bytes > curlen` is the right comparison. Valid message data occupies indices `0` through `curlen - 1`, so a copy of `num_bytes` starting at `idx` requires `idx + num_bytes <= curlen`. The `>` test correctly rejects violations.

**Minor observation:** The commit message's v2 changelog says "Drop separate `idx > curlen` check" — this accurately describes the DPCD read case where the old check was replaced (since `idx + num_bytes > curlen` with `u8 num_bytes >= 0` subsumes `idx > curlen`). For the I2C case there was nothing to drop (only the TODO comment), but the changelog is adequate.

**No issues found.** The patch is correct, minimal, and appropriate for `Cc: stable`.

---
Generated by Claude Code Patch Reviewer