virglrenderer: out-of-bounds write in read_transfer_data() https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654