src/core/gpu.cc (1)

697-701: Harden transfer accounting against FIFO/request mismatch.

At Line 699, transferSize is reduced by the full pre-read FIFO size, not by the actual requested read length. If FIFO words ever exceed the request, transferSize can become negative before Line 701. Consider clamping consumed words and looping while transferSize > 0.

Suggested hardening patch

 void PCSX::GPU::directDMARead(uint32_t *dest, int transferSize, uint32_t hwAddr) {
     auto size = m_readFifo->size();
-    m_readFifo->read(dest, transferSize * 4);
-    transferSize -= size / 4;
-    dest += size / 4;
-    while (transferSize != 0) {
+    int wordsRead = static_cast<int>(size / 4);
+    if (wordsRead > transferSize) wordsRead = transferSize;
+    m_readFifo->read(dest, wordsRead * 4);
+    transferSize -= wordsRead;
+    dest += wordsRead;
+    while (transferSize > 0) {
         *dest++ = m_dataRet;
         transferSize--;
     }
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/core/gpu.cc` around lines 697 - 701, The current loop subtracts the
entire pre-read FIFO word count (size/4) from transferSize which can make
transferSize negative if the FIFO contains more words than requested; update the
logic around m_readFifo->read(dest, ...) in function(s) using m_readFifo,
transferSize and dest to clamp the consumed word count to the actual requested
amount: compute consumed = std::min(static_cast<size_t>(transferSize), size /
4), call m_readFifo->read(dest, consumed * 4), decrement transferSize by
consumed, advance dest by consumed, and iterate while (transferSize > 0) so you
never subtract more than requested and never produce a negative transferSize.