Save states restored video FIFO pointers from unchecked offsets. A
crafted offset could place a pointer outside its backing allocation and
turn the next gather-pipe copy into an out-of-bounds native write.

Require pointer offsets to stay within their backing array and reject a
state when either offset is invalid or the read pointer follows the write
pointer.

The save sync parser preserved an oversized banner length after limiting
the copy into the fixed header buffer. The NAND writer then used the
untrusted length and read beyond the stack object.

Reject invalid or oversized lengths before copying the banner.

A NetPlay host could send an arbitrary buffer size to a client. The
client then tried to allocate input states until it reached that value.

Limit buffer sizes to the existing user-interface maximum. Invalid peer
values are ignored.

DSPHLE/Zelda: Add bounds check for m_sync_voice_skip_flags in RenderAudio()

GCMemcardDirectory: Add bounds check for m_save_data

IOS/FS: Fix loading savestate while TASing