Mailbox

QEMU CXL Type-3 Mailbox Guest-to-Host Escape

QEMU's CXL Type-3 mailbox command handling contains two related out-of-bounds issues: the GETLOG handler validates offset + length as a byte range but then uses offset as an array index into cci->cellog, and the SETFEATURE rank-sparing handler copies…