fix(dronecan): address Copilot review comments on PR iNavFlight#11560

Author: daijoubu

src/main/drivers/dronecan/libcanard/canard_stm32f7xx_driver.c

@@ -23,7 +23,7 @@
 /* --- Internal types and state --- */
 
 #define RX_BUFFER_SIZE 32
-#define TX_QUEUE_SIZE  32
+#define TX_QUEUE_SIZE  32  // usable capacity is TX_QUEUE_SIZE - 1 (31) due to one-slot-empty scheme
 
 struct Timings {
         uint16_t prescaler;
@@ -545,14 +545,20 @@ int16_t canardSTM32Transmit(const CanardCANFrame* const tx_frame) {
         return -CANARD_ERROR_INVALID_ARGUMENT;
     }
 
+    // Classic CAN only, max payload is 8 bytes
+    if (tx_frame->data_len > 8) {
+        return -CANARD_ERROR_INVALID_ARGUMENT;
+    }
+
     if (!canTxQueuePush(tx_frame)) {
         return 0; // SW queue full - caller retries next cycle
     }
 
     // If all mailboxes are idle, RQCP will never fire to start the ISR chain.
-    // Seed the HW via canTxDrainQueue while blocking only the CAN TX ISR (not
-    // higher-priority IRQs like the gyro timer) to preserve the SPSC contract —
-    // ISR is the sole consumer; we become the consumer only during this window.
+    // Seed the HW via canTxDrainQueue while masking all interrupts at priority
+    // >= NVIC_PRIO_CAN via BASEPRI (higher-priority IRQs like gyro timer are
+    // unaffected) to preserve the SPSC contract — ISR is the sole consumer;
+    // we become the consumer only during this window.
     ATOMIC_BLOCK(NVIC_PRIO_CAN) {
         if (HAL_CAN_GetTxMailboxesFreeLevel(&hcan1) > 0) {
             canTxDrainQueue(&hcan1);

src/main/drivers/dronecan/libcanard/canard_stm32h7xx_driver.c

@@ -310,8 +310,8 @@ int16_t canardSTM32Receive(CanardCANFrame *const rx_frame) {
 			rx_frame->id |= CANARD_CAN_FRAME_RTR;
 		}
 
-		rx_frame->data_len = RxHeader.DataLength;
-		memcpy(rx_frame->data, RxData, RxHeader.DataLength);
+		rx_frame->data_len = RxHeader.DataLength > 8 ? 8 : RxHeader.DataLength;
+		memcpy(rx_frame->data, RxData, rx_frame->data_len);
 
 		// assume a single interface
 		rx_frame->iface_id = 0;
@@ -340,6 +340,10 @@ int16_t canardSTM32Transmit(const CanardCANFrame* const tx_frame) {
 		return -CANARD_ERROR_INVALID_ARGUMENT; // unsupported frame format
 	}
 
+	if (tx_frame->data_len > 8) {
+		return -CANARD_ERROR_INVALID_ARGUMENT; // classic CAN only, max 8 bytes
+	}
+
 	FDCAN_TxHeaderTypeDef TxHeader;
 	uint8_t TxData[8];