From b2bbbb64bd3433c33c8b1e7b00c5713f0eb19c02 Mon Sep 17 00:00:00 2001
From: Jordan Woyak <jordan.woyak@gmail.com>
Date: Sun, 8 Feb 2026 21:54:46 -0600
Subject: [PATCH] SI_DeviceAMBaseboard: Fix signed/unsigned comparison.

---
 .../Core/Core/HW/SI/SI_DeviceAMBaseboard.cpp  | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/Source/Core/Core/HW/SI/SI_DeviceAMBaseboard.cpp b/Source/Core/Core/HW/SI/SI_DeviceAMBaseboard.cpp
index 52d1dd883f..b2a65c10a3 100644
--- a/Source/Core/Core/HW/SI/SI_DeviceAMBaseboard.cpp
+++ b/Source/Core/Core/HW/SI/SI_DeviceAMBaseboard.cpp
@@ -608,21 +608,23 @@ int CSIDevice_AMBaseboard::RunBuffer(u8* buffer, int request_length)
 
                   const u16 page = m_ic_write_buffer[5];
                   const u16 count = m_ic_write_buffer[7];
+                  const u32 write_size = u32(count) * 8;
+                  const u32 write_offset = u32(page) * 8;
 
-                  if ((page * 8 + count * 8) > sizeof(m_ic_card_data) ||
-                      (10 + count * 8) > sizeof(m_ic_write_buffer))
+                  if ((write_size + write_offset) > sizeof(m_ic_card_data) ||
+                      (10 + write_size) > sizeof(m_ic_write_buffer))
                   {
                     ERROR_LOG_FMT(SERIALINTERFACE_CARD,
                                   "GC-AM: Command 25 (IC-CARD) Write Pages overflow:\n"
                                   " - m_ic_card_data(offset={}, size={})\n"
                                   " - m_ic_write_buffer(offset={}, size={})\n"
                                   " - size={}, page={}, count={}\n",
-                                  page * 8, sizeof(m_ic_card_data), 10, sizeof(m_ic_write_buffer),
-                                  count * 8, page, count);
+                                  write_offset, sizeof(m_ic_card_data), 10,
+                                  sizeof(m_ic_write_buffer), write_size, page, count);
                     data_in = data_in_end;
                     break;
                   }
-                  memcpy(m_ic_card_data + page * 8, m_ic_write_buffer + 10, count * 8);
+                  memcpy(m_ic_card_data + write_offset, m_ic_write_buffer + 10, write_size);
 
                   INFO_LOG_FMT(SERIALINTERFACE_CARD,
                                "GC-AM: Command 25 (IC-CARD) Write Pages:{} Count:{}({:x})", page,
@@ -808,6 +810,8 @@ int CSIDevice_AMBaseboard::RunBuffer(u8* buffer, int request_length)
                 const u16 size = Common::swap16(data_in + 2);
                 const u16 page = Common::swap16(data_in + 6) & 0xFF;  // 255 is max page
                 const u16 count = Common::swap16(data_in + 8);
+                const u32 write_size = u32(count) * 8;
+                const u32 write_offset = u32(page) * 8;
 
                 // We got a complete packet
                 if (pksize - 5 == size)
@@ -818,7 +822,7 @@ int CSIDevice_AMBaseboard::RunBuffer(u8* buffer, int request_length)
                   }
                   else
                   {
-                    if (page * 8 + count * 8 > sizeof(m_ic_card_data))
+                    if (write_size + write_offset > sizeof(m_ic_card_data))
                     {
                       ERROR_LOG_FMT(
                           SERIALINTERFACE_CARD,
@@ -827,9 +831,9 @@ int CSIDevice_AMBaseboard::RunBuffer(u8* buffer, int request_length)
                     }
                     else
                     {
-                      if (!validate_data_in_out(13 + count * 8, 0, "SerialA (IC-CARD)"))
+                      if (!validate_data_in_out(13 + write_size, 0, "SerialA (IC-CARD)"))
                         break;
-                      memcpy(m_ic_card_data + page * 8, data_in + 13, count * 8);
+                      memcpy(m_ic_card_data + write_offset, data_in + 13, write_size);
                     }
                   }