Re: [PATCH] wifi: wfx: validate num_tx_confs against HIF message length

[Aamir Ahmed]

On Mon, Sep 07, 2026 at 09:52:03PM +0200, Jerome Pouiller wrote:
> body->num_tx_confs is already used in rx_helper(). So, the
> error detection happens to late.

Yes that makes sense. The check should live in rx_helper(), next to
the existing hif->len consistency check, so that the tx_buffers_used
accounting never sees an incorrect count either.

> Until now, I have considered the device semi-trusted, so skipping this
> test does not shock me.
>
> (I tend to prefer the readability of the code rather to clutter it with
> plenty of error paths impossible to reach and impossible to test)

Understood. If you would take a single check in rx_helper() I am happy
to send that as v2; otherwise I can drop it. Thanks.

Kind Regards

Aamir A.