fix(pru): memcpyToPRU's block loop was dead and overran short destinations

memcpy_ldnp() opened with

    int sz = sztotal - sztotal & 64;

which parses as (sztotal - sztotal) & 64, i.e. always zero.  Two consequences.
Every copy fell through to the byte loop, so the ldnp/stnp path the function
exists for - the optimized memcpy faults on the uncacheable PRU mappings - has
never actually run.  And the asm block is a do-while, so it always executed one
iteration and stored 64 bytes at the destination regardless of the length
asked for, writing past the end of anything shorter.

Mask the low bits instead, skip the block loop when there is nothing for it,
and only take it when both operands are 16 byte aligned, since an unaligned
vector access to an uncacheable mapping faults.  Head and tail go through the
byte loop as before.  Exactly sztotal bytes are written and no more.

Callers are unaffected.  Every existing call is either a whole number of 64
byte units or at least 64 bytes long, and for any length of 64 or more the old
and new code write the same bytes over the same range - the stray store just
repeated the first block.  Only shorter copies change, and there the bytes that
are no longer written were uninitialized stack.

The BBShiftPanel comments describing the copy as spilling into the next 64 byte
unit no longer hold; the padding they explain is kept, and now writes that slot
outright rather than relying on the overrun to do it.

Verified two ways.  A/B harness over 66816 combinations of length 0-260 and
source/destination alignment: the old code wrote past the end in 16368 of them,
the new code in none, and neither ever got the copied bytes wrong.  Removing
the new byte loop and re-running the aligned, block sized cases still copies
correctly, which is what shows the ldnp path is now the one doing the work
rather than the test passing on the fallback.  On hardware, the BBShiftString
command table lands in PRU data RAM byte identical to before.

BBShiftPanel and BBB48String are compile and equivalence checked only, not run
on panels or a 48 string cape.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dkulp

src/non-gpl/BBShiftPanel/BBShiftPanel.cpp

@@ -440,7 +440,7 @@ void BBShiftPanelManager::sendPanelInitPackets() {
         return;
     }
     // the PRU data RAM cannot take a plain memcpy (uncacheable segment,
-    // SIGBUS on aarch64) - memcpyToPRU handles it, in 64 byte chunks
+    // SIGBUS on aarch64) - memcpyToPRU handles it
     uint32_t buf[16] = { 0 };
     buf[0] = (uint32_t)regs.size() | (((uint32_t)rowLen) << 16);
     for (size_t i = 0; i < regs.size(); i++) {
@@ -2064,10 +2064,11 @@ void BBShiftPanelManager::writeFM6373SeqWord(int idx) {
     uint8_t buf[192 * 2];
     int len = outputRegData(0, buf, rw, gw, bw, m_numOutputSlots);
     if (slotSize & 63) {
-        // memcpyToPRU copies in 64 byte chunks, so the write spills into the
-        // slot after the rotating one and has to rewrite it with its own
-        // (constant) value: the commit word for a five slot chip, the extra
-        // pre-commit word for a six slot one.
+        // A slot that is not a whole number of 64 byte units shares a unit
+        // with the one after it, so extend the write to cover that slot with
+        // its own (constant) value rather than leave a partial unit: the
+        // commit word for a five slot chip, the extra pre-commit word for a
+        // six slot one.
         uint16_t next = seq->slots == 6 ? seq->extraWord : 0x0055;
         len = outputRegData(len, buf, next, next, next, m_numOutputSlots);
     }
@@ -2096,9 +2097,10 @@ void BBShiftPanelManager::writeDP3364SeqWord(int idx) {
     uint8_t buf[192 * 2];
     int len = outputRegData(0, buf, rw, gw, bw, m_numOutputSlots);
     if (slotSize & 63) {
-        // memcpyToPRU copies in 64 byte chunks; pad with a second copy of the
-        // word so the write length is a multiple of 64.  Nothing reads the
-        // padding - DP3364S only sends one word per frame.
+        // A slot that is not a whole number of 64 byte units shares a unit
+        // with the one after it, so pad with a second copy of the word to keep
+        // the write on a unit boundary.  Nothing reads the padding - DP3364S
+        // only sends one word per frame.
         len = outputRegData(len, buf, rw, gw, bw, m_numOutputSlots);
     }
     pru->memcpyToPRU((uint8_t*)&pruData->registers[0], buf, len);

src/util/BBBPruUtils.cpp

@@ -446,12 +446,27 @@ void BBBPru::memcpyToPRU(uint8_t* dst, uint8_t* src, size_t sz) {
 // The optimized memset and memcpy on Arm64 will segfault
 // when doing certain sized operations to un-cacheable
 // ram segments.  Need to use ldnp/stnp instructions
+//
+// The block loop moves whole 64 byte units and needs 16 byte aligned operands
+// (the PRU memories map uncached, where an unaligned vector access faults), so
+// the head/tail and anything that does not qualify go through the byte loop
+// instead - slower, but correct for every size and alignment.  Exactly sztotal
+// bytes are written and no more.
 void memcpy_ldnp(volatile unsigned char* dst, volatile unsigned char* src, int sztotal) {
-    int sz = sztotal - sztotal & 64;
-
+    // NB: "sztotal - sztotal & 64" parses as "(sztotal - sztotal) & 64", i.e.
+    // always zero, which left the block loop below writing one fixed 64 byte
+    // store - past the end for anything shorter - and everything else crawling
+    // through the byte loop.  Mask off the low bits instead.
+    int sz = 0;
+    if (sztotal >= 64 && ((((uintptr_t)dst | (uintptr_t)src) & 15) == 0)) {
+        sz = sztotal & ~63;
+    }
     for (int x = sz; x < sztotal; x++) {
         dst[x] = src[x];
     }
+    if (sz == 0) {
+        return;
+    }
     asm volatile(
         "NEONCopyPLD: \n"
         "sub %[dst], %[dst], #64 \n"