diff
<     drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 + ...);
---
>     if (!check_size_overflow(sizeof(*bsg_reply_buf) - 1, ...)) {
>         // Handle error due to buffer size overflow
>         return -EINVAL;
>     }
>     drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 + ...);
