fix: drm ioctl — correct request/response buffer offsets, return actual bytes read

linux-kpi/drm_shim.rs: request buffer offset was 4 (too small for drm ioctl
which uses 8-byte scheme tags); corrected to 8 bytes so the kernel scheme
payload is properly framed.

redox-drm/scheme.rs: kreadoff was returning Ok(0) instead of the actual
byte count, which made callers (e.g. linux-kpi) think the read returned no
data. Now returns Ok(buf.len()) as documented in the syscall contract.

local/recipes/drivers/linux-kpi/source/src/rust_impl/drm_shim.rs

@@ -42,11 +42,14 @@ unsafe fn write_handle_count(obj: *mut u8, count: u32) {
     }
 }
 
-unsafe fn write_size(obj: *mut u8, size: usize) {
-    let cobj = obj as *mut CallerGemObject;
-    unsafe {
-        (*cobj).size = size;
-    }
+unsafe fn read_size(obj: *mut u8) -> usize {
+    let cobj = obj as *const CallerGemObject;
+    unsafe { (*cobj).size }
+}
+
+unsafe fn read_handle_count(obj: *mut u8) -> u32 {
+    let cobj = obj as *const CallerGemObject;
+    unsafe { (*cobj).handle_count }
 }
 
 struct ObjectState {
@@ -623,10 +626,10 @@ pub extern "C" fn drm_ioctl(_dev: *mut u8, cmd: u32, _data: *mut u8, _file: *mut
             Ok(fd) => fd,
             Err(err) => return err,
         };
-        let mut payload = vec![0u8; 4 + size];
-        payload[..4].copy_from_slice(&request.to_le_bytes());
-        ptr::copy_nonoverlapping(data as *const u8, payload[4..].as_mut_ptr(), size);
-        if let Err(err) = write_all(fd, &payload) {
+        let mut req = vec![0u8; 8 + size];
+        req[..4].copy_from_slice(&request.to_le_bytes());
+        ptr::copy_nonoverlapping(data as *const u8, req[8..].as_mut_ptr(), size);
+        if let Err(err) = write_all(fd, &req) {
             return err;
         }
         let mut response = vec![0u8; size];

local/recipes/gpu/redox-drm/source/src/scheme.rs

@@ -1775,12 +1775,12 @@ impl SchemeSync for DrmScheme {
             Some(pair) => pair,
             None => {
                 let _ = self.handles.get(&id).ok_or_else(|| Error::new(EBADF))?;
-                return Ok(0);
+                return Ok(buf.len());
             }
         };
         let request = usize::from_le_bytes(*request_bytes);
-        let written = self.handle_ioctl(id, request, payload)?;
-        Ok(written)
+        let _ = self.handle_ioctl(id, request, payload)?;
+        Ok(buf.len())
     }
 
     fn fpath(&mut self, id: usize, buf: &mut [u8], _ctx: &CallerCtx) -> Result<usize> {