QEMU fixes DoS via zero-length packed virtio descriptors

QEMU now rejects zero-length indirect descriptors on packed virtqueues, closing CVE-2026-63324, a denial-of-service flaw that could crash the hypervisor from guest userspace.

The packed-ring path accepted an indirect descriptor whose length was zero. That value later hit an assertion that length must be positive, aborting QEMU. The same check already existed for split rings; the packed path simply lacked it.

Michael S. Tsirkin’s fix treats a zero length the same as any other invalid table size and reports a virtio error instead of continuing. The bug is otherwise harmless when the driver runs in the guest kernel. It becomes a DoS only when untrusted guest userspace can supply virtio descriptors directly to the device.

The change aligns packed and split handling and stops the abort for malformed input.