git: cdc894780c50 - stable/14 - bhyve: tpm: allow the last dword of the CRB command buffer

The branch stable/14 has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=cdc894780c5014acf8278fa1f7ba02040096ce26

commit cdc894780c5014acf8278fa1f7ba02040096ce26
Author:     Quentin Thébault <quentin.thebault@defenso.fr>
AuthorDate: 2026-08-07 14:02:08 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-10-23 02:52:52 +0000

    bhyve: tpm: allow the last dword of the CRB command buffer
    
    The bounds check rejected any access ending exactly at the end of the
    register block, so a four byte write at offset 0xffc was refused,
    returning EINVAL and killing the VM.
    
    PR:             291063
    Fixes:          75909086a45d ("bhyve: allow read/write to full CRB buffer")
    Sponsored by:   Defenso
    
    Signed-off-by: Quentin Thébault <quentin.thebault@defenso.fr>
    Reviewed-by: aokblast, kevans, markj
    (cherry picked from commit 4505445ccdb9555efc23262a971a18ca03486969)
---
 usr.sbin/bhyve/tpm_intf_crb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr.sbin/bhyve/tpm_intf_crb.c b/usr.sbin/bhyve/tpm_intf_crb.c
index b1f5b72b6285..b499d17aaf01 100644
--- a/usr.sbin/bhyve/tpm_intf_crb.c
+++ b/usr.sbin/bhyve/tpm_intf_crb.c
@@ -322,7 +322,7 @@ tpm_crb_mem_handler(struct vcpu *vcpu __unused, const int dir,
 	crb = arg1;
 
 	off = addr - TPM_CRB_ADDRESS;
-	if (off > TPM_CRB_REGS_SIZE || off + size >= TPM_CRB_REGS_SIZE) {
+	if (off > TPM_CRB_REGS_SIZE || off + size > TPM_CRB_REGS_SIZE) {
 		return (EINVAL);
 	}