CVE-2026-68330: net: airoha: Fix DMA direction for NPU mailbox buffer

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix DMA direction for NPU mailbox buffer

airohanpusendmsg() always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer:

- airohanpuwlanmsgget() (NPUOPGET): NPU writes response into the buffer, then the caller reads it via memcpy() - airohanpuppestatssetup() (NPUOPSET): NPU writes back npustatsaddr field in the response

On non-cache-coherent architectures like EN7581 (Cortex-A53 without hardware cache coherency for NPU DMA), DMATODEVICE unmap is a no-op — it does not invalidate the CPU cache. If the NPU-written cache line is still present in the CPU cache when the caller reads the buffer, the CPU observes stale data instead of the NPU response.

This is a timing-sensitive bug: small mailbox buffers (~24 bytes) typically fit in a single cache line and may survive in the cache until the caller reads them, producing silent data corruption rather than a crash. The bug is more likely to trigger when the caller reads the response immediately after dmaunmapsingle() without intervening cache-evicting operations.

Fix by using DMABIDIRECTIONAL for both map and unmap, which ensures dmaunmapsingle() invalidates the CPU cache on non-coherent systems. The mailbox buffers are small so there is no performance concern.