rtl8192eu: cast pppoe_tag payload before byte offset in 7.1 patch

The three nat25_db_handle memcpy sites added byte offsets (MAGIC_CODE_LEN,
RTL_RELAY_TAG_LEN) directly to a `struct pppoe_tag *`, so the offsets were
scaled by sizeof(struct pppoe_tag) (4, packed) rather than bytes -- landing up
to 32 bytes past tag_data and corrupting the PPPoE relay-tag path. It compiles
clean (memcpy takes void *), so the build does not catch it.

Cast to `unsigned char *` before applying the offset, matching the existing
__nat25_add_pppoe_tag idiom in the same file.

Assisted-by: Claude:claude-opus-4-8

Author: iav

patch/misc/wireless-rtl8192eu-linux-7.1.patch

@@ -29,7 +29,7 @@ index a2c491e58b0a..5eaa74911801 100644
 
 -							memcpy(tag->tag_data + MAGIC_CODE_LEN + RTL_RELAY_TAG_LEN,
 -							       pOldTag->tag_data, old_tag_len);
-+							memcpy((tag + 1) + MAGIC_CODE_LEN + RTL_RELAY_TAG_LEN,
++							memcpy((unsigned char *)(tag + 1) + MAGIC_CODE_LEN + RTL_RELAY_TAG_LEN,
 +							       (pOldTag + 1), old_tag_len);
 
  							if (skb_pull_and_merge(skb, (unsigned char *)pOldTag, TAG_HDR_LEN + old_tag_len) < 0) {
@@ -42,7 +42,7 @@ index a2c491e58b0a..5eaa74911801 100644
 +						pMagic = (unsigned short *)(tag + 1);
  						*pMagic = htons(MAGIC_CODE);
 -						memcpy(tag->tag_data + MAGIC_CODE_LEN, skb->data + ETH_ALEN, ETH_ALEN);
-+						memcpy((tag + 1) + MAGIC_CODE_LEN, skb->data + ETH_ALEN, ETH_ALEN);
++						memcpy((unsigned char *)(tag + 1) + MAGIC_CODE_LEN, skb->data + ETH_ALEN, ETH_ALEN);
 
  						/* Add relay tag */
  						if (__nat25_add_pppoe_tag(skb, tag) < 0)
@@ -59,7 +59,7 @@ index a2c491e58b0a..5eaa74911801 100644
  					}
 
 -					memcpy(skb->data, tag->tag_data + MAGIC_CODE_LEN, ETH_ALEN);
-+					memcpy(skb->data, (tag + 1) + MAGIC_CODE_LEN, ETH_ALEN);
++					memcpy(skb->data, (unsigned char *)(tag + 1) + MAGIC_CODE_LEN, ETH_ALEN);
 
  					if (tagLen > MAGIC_CODE_LEN + RTL_RELAY_TAG_LEN)
  						offset = TAG_HDR_LEN;