Claude review: accel/ethosu: fix IFM region index out-of-bounds in command stream parser

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The bug:**  
At `ethosu_gem.c:467` (pre-patch), the IFM region was masked with `0x7f`:
```c
case NPU_SET_IFM_REGION:
    st.ifm.region = param & 0x7f;
```

This permits values up to 127, but `region_size[]` and `output_region[]` in `struct ethosu_validated_cmdstream_info` (`ethosu_gem.h:12-13`) are both `NPU_BASEP_REGION_MAX` (8) elements:
```c
u64 region_size[NPU_BASEP_REGION_MAX];   // 8 entries
bool output_region[NPU_BASEP_REGION_MAX]; // 8 entries
```

The region index is later used as a direct array subscript in `calc_sizes()` at `ethosu_gem.c:229`:
```c
info->region_size[fm->region] = max(info->region_size[fm->region], addr + 1);
```

A userspace-controlled `param > 7` causes a heap buffer overflow.

**The fix is correct:**  
All other region assignments use `& 0x7`:
- `ethosu_gem.c:507`: `st.ofm.region = param & 0x7`
- `ethosu_gem.c:541`: `st.ifm2.region = param & 0x7`
- `ethosu_gem.c:569`: `st.weight[0].region = param & 0x7`
- `ethosu_gem.c:572`: `st.scale[0].region = param & 0x7`
- `ethosu_gem.c:615`: `st.dma.src.region = param & 0x7`
- `ethosu_gem.c:622`: `st.dma.dst.region = param & 0x7`

The mask `0x7` limits the value to 0–7, exactly matching the array size of 8.

**Tags:** The `Fixes:` tag and `Cc: stable` are appropriate for a security-relevant bug fix.

**Commit message quality:** Excellent — clearly explains the inconsistency, the data flow from mask to array subscript, and the impact (heap corruption). This is a well-written single-line fix with a thorough justification.

**No issues found.** Reviewed-by worthy.

---
Generated by Claude Code Patch Reviewer