Claude review: accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Verdict: Correct, obvious typo/copy-paste fix.**

The change at line 601 (pre-patch):
```c
case NPU_SET_SCALE1_LENGTH: // NPU_SET_WEIGHT2_LENGTH (U85)
    if (ethosu_is_u65(edev))
        st.scale[1].length = cmds[1];
    else
        st.weight[1].length = cmds[1];  // BUG: should be weight[2]
```

Fixed to:
```c
    else
        st.weight[2].length = cmds[1];
```

This is unambiguously correct. The opcode `0x4093` is `NPU_SET_WEIGHT2_LENGTH` on non-U65 hardware (confirmed in `ethosu_device.h:148`). The BASE handler for the same opcode at line 591-596 correctly writes to `st.weight[2].base`, so the LENGTH handler must match with `st.weight[2].length`. The original code wrote to `weight[1]`, which is handled by the separate `NPU_SET_WEIGHT1_LENGTH` case at line 588-589 — so the bug both corrupted `weight[1].length` and left `weight[2].length` at its sentinel value of `0xffffffff`, breaking bounds checks for two weight buffers simultaneously.

The Fixes tag and Cc: stable are appropriate for both patches.

---
Generated by Claude Code Patch Reviewer