Claude review: rust: dma: use pointer projection infra for `dma_{read,write}` macro

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is a significant API change that improves both soundness and ergonomics.

**Soundness fixes**: The commit message correctly identifies two soundness issues in the old macros: reliance on absence of `Deref` implementations, and lack of protection against `#[repr(packed)]` misaligned accesses. The new macros address both via the projection infrastructure.

**New `as_ptr` / `as_mut_ptr` methods**: These return `*const [T]` / `*mut [T]` fat pointers, which is the correct type to feed into the projection infrastructure. However, note that `as_mut_ptr` takes `&self` (not `&mut self`):

```rust
pub fn as_mut_ptr(&self) -> *mut [T] {
    core::ptr::slice_from_raw_parts_mut(self.cpu_addr.as_ptr(), self.count)
}
```

This is intentional since DMA coherent memory is shared with hardware and the `CoherentAllocation` type already provides interior mutability semantics through its `field_write` safety contract. But it might be worth a brief comment explaining why `&self` returns a `*mut` pointer.

**`dma_write!` macro parsing**: The recursive `@parse` rules to separate the projection tokens from the trailing value expression are necessary because the macro needs to split `[0]?.ptes.field, value` at the right comma. The approach is correct.

**Removal of `item_from_index`**: Good cleanup — this method's bounds-checking is now handled by the projection infrastructure.

**Sample code changes**: The refactoring to move DMA read checks from `PinnedDrop` into a separate `check_dma` method is cleaner:

```rust
fn check_dma(&self) -> Result {
    for (i, value) in TEST_VALUES.into_iter().enumerate() {
        let val0 = kernel::dma_read!(self.ca, [i]?.h);
        ...
    }
    Ok(())
}
```

Note that the `dma_read!` macro no longer returns `Result` — it returns the value directly (with `?` propagating index errors). The old code had `assert!(val0.is_ok())` followed by `if let Ok(val0) = val0 { ... }` which was redundant; the new code is much cleaner.

---
Generated by Claude Code Patch Reviewer