Describe the bug

VCIO tag RPI_FIRMWARE_GET_FIRMWARE_HASH (00x00000003) seems to mishandle return buffer size, reporting 8 bytes instead of 20. The Linux kernel ignores the size encoded in the response status/size word, so the error is unnoticed there.

Hexdump of the property request:

addr _0 _1 _2 _3 | _4 _5 _6 _7 | _8 _9 _A _B | _C _D _E _F
000_ 2C .. .. .. | .. .. .. .. | 03 .. .. .. | 14 .. .. ..
....
002_ .. .. .. .. | .. .. .. .. | .. .. .. ..

Hexdump of the property response:

addr _0 _1 _2 _3 | _4 _5 _6 _7 | _8 _9 _A _B | _C _D _E _F
000_ 2C .. .. .. | .. .. .. 80 | 03 .. .. .. | 14 .. .. ..
001_ 08 .. .. 80 | 5B 97 08 28 | BF 9B 14 80 | 65 44 68 E8
002_ 7D 5C E4 5F | 78 C0 6F E6 | .. .. .. ..

To reproduce

$ vcmailbox 0x00000003 0x14 0 0 0 0 0 0
0x0000002c 0x80000000 0x00000003 0x00000014 0x80000008 0x2808975b 0x80149bbf 0xe8684465 0x5fe45c7d 0xe66fc078 0x00000000 

Expected behaviour

The tag status/response word should IMO equal 0x8000_0014 as the firmware hash is five 32bit words long.

Actual behaviour

The tag status/response word is 0x8000_0008 which indicates that the response used 8 bytes of the value buffer.

System

https://paste.debian.net/hidden/69ae0d85/

Logs

N/A

Additional context

N/A