CVE-2026-98298: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg()

In mmppdmaprepslavesg(), foreachsg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry):

foreachsg(sgl, sg, sglen, i) { addr = sgdmaaddress(sg); avail = sgdmalen(sgl); / should be 'sg' /

Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.