QEMU virtio-gpu fix stops guest leak from short control headers

QEMU has patched a flaw in its virtio-gpu device that could leak uninitialized data back to a guest. CVE-2026-18054 arises when a short or truncated control request leaves command structures only partly filled; guest-controlled flags in the common header could then cause stale fence metadata to be returned to the guest.

Previously, the helpers that copy guest commands into QEMU structures detected undersized requests but only logged the problem and returned, leaving the incomplete request without an error or completion. The fix clears any partially copied data and completes the request with an invalid-parameter error. The same rejection now applies in the vhost-user-gpu path, covering both the common header and type-specific command bodies.

Ankur Saini reported and fixed the issue, following a suggestion from Akihiko Odaki.