On Thu, Sep 10, 2026 at 2:05 PM <[email protected]> wrote: > Since tx_buf was strictly allocated during drm_mipi_dbi_dev_init() to hold > exactly the panel size, copying based on this inflated width and height will > overflow tx_buf on the heap.
Confirmed. On a fractional plane SRC_X/SRC_Y the damage iterator rounds the merged rect out by up to a pixel per axis, so it can exceed the panel and overflow the mode-sized tx_buf. v2 will clamp the rect back to the panel in mipi_dbi_fb_dirty().
