Commit 4571c79c57 for qemu.org

commit 4571c79c57cabd5975fb9d51f78c87675989180b
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Mon Jul 13 12:34:17 2026 +0100

    hw/net/vmxnet3: Correct bounds check on tx queue index

    In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
    provided by the guest against the total number of queues.  However,
    we have an off-by-one error: the valid indexes are from 0 to
    txq_num-1, so we need a "<" comparison, not "<=".

    Cc: qemu-stable@nongnu.org
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-id: 20260706175408.905362-1-peter.maydell@linaro.org

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 97156dd33b..8569484b2f 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
         int tx_queue_idx =
             VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD,
                                      VMXNET3_REG_ALIGN);
-        if (tx_queue_idx <= s->txq_num) {
+        if (tx_queue_idx < s->txq_num) {
             vmxnet3_process_tx_queue(s, tx_queue_idx);
         } else {
             qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n",