bhyve/riscv: Fix buffer overflow and data layout in PCIe FDT interrupt map

[doonbsd_gmail.com]

Summary

The Device Tree interrupt-map for the PCIe controller requires exactly 9
cells per entry to correctly describe the routing to the APLIC. The loop
generating this map was mistakenly using a stride of 10 instead of 9. This
mismatch caused uninitialized gaps in the Device Tree blob (breaking PCI
interrupts in the guest) and lead to an out-of-bounds memory write at the
end of the loop since the buffer was only allocated for 9 cells per entry.
This commit corrects the multiplier to properly pack the mapping array.

Fixes: 7ab1a32cd43c (bhyve/riscv: Initial import)
Signed-off-by: Doongar Singh <[e-mail]>

[jrtc27]

Buffer overflow isn't the interesting part. What matters more is it's just wrong. There's no real security concern here. So I don't think it's helpful to highlight that as the first thing in the subject line (if at all; it can be mentioned as an aside in the body), as that's just going to make people think security issue.

The context is also worth adding: arm64 uses 10 cells per entry because its GIC node has #interrupt-cells = 3, but riscv uses 9 cells per entry because its APLIC node has #interrupt-cells = 2, and when the code was copied the fdt_property_placeholder call was updated accordingly along with removing the SET_PROP_U32 for that cell, but the stride was not updated.