FIFO logs control each memory update address and data size. Playback
masked only the start address into RAM or EXRAM, then copied the
complete update contiguously. An update reaching the end of a mapped
region could therefore write beyond host-mapped emulated memory.

Resolve the target through MemoryManager and reject updates larger than
the remaining valid span before copying them.

Legacy savestate headers controlled both the compressed input length
and the decompression buffer size. The input was read into a fixed-size
buffer without validation, and the unsafe LZO API could write past its
output buffer.

Use the legacy block size as the output capacity, reject oversized
compressed blocks, and use the bounds-checking LZO decompressor.

LLM generated explaination for the LLM generated commit:

A queued QTimerEvent can be dispatched after the timer was already killed (Qt recycles timer ids), e.g. when a slider is dragged and enter/leave events fire in rapid succession. In that case m_timer_id is empty and dereferencing it in timerEvent() asserts on 'this->_M_is_engaged()' in debug builds, while in release builds it passes a garbage timer id to killTimer().

Only process the event if it matches the timer we are tracking, which also prevents showing a balloon for a stale event.

Some Qualcomm Android drivers from version 700 onward miscompile
specialized TEV pixel shaders when color input A or B is TevColorArg::Zero.
Use konstLookup[8].rgb, which PixelShaderManager initializes to zero,
to keep these inputs dependent on a uniform value.

Use the existing driver bug gate for OpenGL and Vulkan. Other inputs and
unaffected drivers retain their original shader expressions.

For use with DriverDetails.

This reverts commit 86da6c98fbd229d87de7cf8b9c7eb94c16923829.

Save states restored video FIFO pointers from unchecked offsets. A
crafted offset could place a pointer outside its backing allocation and
turn the next gather-pipe copy into an out-of-bounds native write.

Require pointer offsets to stay within their backing array and reject a
state when either offset is invalid or the read pointer follows the write
pointer.

The save sync parser preserved an oversized banner length after limiting
the copy into the fixed header buffer. The NAND writer then used the
untrusted length and read beyond the stack object.

Reject invalid or oversized lengths before copying the banner.