pci_handler: fix length clamp overflow in read and write

[rootvector2]

PciDataHandler::read clamps the copy length with offset + length < regionSize, but both operands are uint32_t, so once offset + length passes 2^32 it wraps, the guard is bypassed, and finalLength stays equal to the oversized length that the following byte loop then reads past the mapped region. write has the sibling defect, storing the clamped count in a uint16_t (with a uint16_t loop counter) so any length above 65535 is truncated. Both now compare length against the remaining regionSize - offset and keep the count in uint32_t; spotted while fuzzing the MMIO read/write path.

[rootvector2]

any update?