From: Jamin Lin <jamin_lin@aspeedtech.com>

mock_i3c_target_tx() did not update *num_sent before returning.

Although some callers may not directly use this value, i3c_send()
passes num_sent to trace_i3c_send(). If the target TX callback does
not initialize *num_sent, the trace output may report an incorrect
or uninitialized value, leading to confusing debugging information.

For example, the following trace was observed:

  mock_i3c_target_tx I3C mock target write 0x12
  i3c_send I3C send 0/1 bytes, ack=1    (expected 1/1 bytes)

This happens because *num_sent was never set by the TX callback.

Fix this by setting *num_sent in all return paths,
including the IBI magic handling case, to accurately reflect
the number of bytes consumed.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Jithu Joseph <jithu.joseph@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20260303013322.1297499-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/i3c/mock-i3c-target.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/i3c/mock-i3c-target.c b/hw/i3c/mock-i3c-target.c
index 875cd7c7d09c..b99709a08b52 100644
--- a/hw/i3c/mock-i3c-target.c
+++ b/hw/i3c/mock-i3c-target.c
@@ -70,6 +70,7 @@ static int mock_i3c_target_tx(I3CTarget *i3c, const uint8_t *data,
 
     if (s->cfg.ibi_magic && num_to_send == 1 && s->cfg.ibi_magic == *data) {
         mock_i3c_target_ibi_timer_start(s);
+        *num_sent = 1;
         return 0;
     }
 
@@ -86,6 +87,7 @@ static int mock_i3c_target_tx(I3CTarget *i3c, const uint8_t *data,
         s->buf[s->p_buf] = data[i];
         s->p_buf++;
     }
+    *num_sent = to_write;
     return ret;
 }
 
-- 
2.53.0