The ISP83xx reset template is read from the adapter flash and executed
without checking its sizes against the buffer it is read into, and the
array cursor used by read-modify-write entries never advances. This
series bounds the template to its buffer and makes the cursor fill the
array as the template format intends.

Patch 1 is the memory-safety fix and is marked for stable; patch 2 is a
reset-path correctness fix.

v3:
  - 1/2: also read the remaining little-endian entry fields (register
    addresses, values, masks and delays) through le32_to_cpu(), and
    allocate the template buffer with vzalloc() so the checksum does not
    sum uninitialised tail bytes.
  - 2/2: reworked per review. The cursor starts at one so the first
    polled value lands in array[1] instead of the array[0] sentinel, is
    written back after every read, and is reset in
    qla4_83xx_process_stop_seq() so each reset refills the array from the
    start.
  - The qla4_83xx_reset_seq_checksum_test() "if (~sum)" test is always
    true, but that is pre-existing logic this series does not modify;
    correcting it needs the template's intended checksum value, which is
    not in the source, so it is left out of scope.

v2: https://lore.kernel.org/r/20261011040257.2017421-1-yhlee@isslab.korea.ac.kr
v1: https://lore.kernel.org/r/20261010181139.1911817-1-yhlee@isslab.korea.ac.kr

Yehyeong Lee (2):
  scsi: qla4xxx: bound the ISP83xx reset template to its buffer
  scsi: qla4xxx: advance the reset-sequence array cursor in
    poll_read_list

 drivers/scsi/qla4xxx/ql4_83xx.c | 207 +++++++++++++++++++++++---------
 1 file changed, 148 insertions(+), 59 deletions(-)

-- 
2.43.0