Claude review: selftests: dma-buf: add DERIVE ioctl tests

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Good coverage for the happy path.** `test_ro_derive` verifies:
- Allocation, derivation as `O_RDONLY`
- RW mmap on the original fd
- RO mmap on the derived fd
- Data visibility (write through RW, read through RO)

**Good negative tests.** `test_ro_derive_escalation` verifies:
- `O_RDWR` derivation from read-only fd is rejected with `EACCES`
- `PROT_WRITE | MAP_SHARED` mmap on read-only fd is rejected with `EACCES`

**Missing test: O_WRONLY escalation**

Given the bug in patch 1, there should be a test deriving `O_WRONLY` from a read-only fd and confirming it's rejected. Currently this would pass (incorrectly), which would help catch the bug.

**Missing test: derived fd outlives primary fd**

An important lifecycle scenario — close the original RW fd first, then verify the derived RO fd still works (mmap, read data). This exercises the refcount path where `dma_buf_file_release` on the derived file triggers `dma_buf_put`.

**Test plan count is correct.** `setup_ro_derive` emits 2 results; `test_ro_derive` adds 3; `test_ro_derive_escalation` adds 2. Total: 2+3 + 2+2 = 9 new, giving 11+9 = 20 per heap.

---
Generated by Claude Code Patch Reviewer