Commit c451ed0710 for qemu.org

commit c451ed071053639083c98215900899f89f9bd70e
Author: Helge Deller <deller@gmx.de>
Date:   Thu Nov 5 00:34:27 2026 +0100

    i82596: Fix source address inserting

    Insert the source address after the destination instead of overwriting
    bytes 6-11.

    Noticed-by: Keith Monahan <keith@techtravels.org>
    Signed-off-by: Helge Deller <deller@gmx.de>

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index 6bcae73815..19e1bf47db 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -631,8 +631,14 @@ static int i82596_tx_process_frame(I82596State *s)
         return 0;
     }

-    if (I596_NO_SRC_ADD_IN == 0 && total_len >= ETH_ALEN * 2) {
+    if (I596_NO_SRC_ADD_IN == 0 && total_len >= ETH_ALEN) {
+        if (total_len + ETH_ALEN > sizeof(s->tx_buffer)) {
+            return 0;
+        }
+        memmove(&s->tx_buffer[ETH_ALEN * 2], &s->tx_buffer[ETH_ALEN],
+                total_len - ETH_ALEN);
         memcpy(&s->tx_buffer[ETH_ALEN], s->conf.macaddr.a, ETH_ALEN);
+        total_len += ETH_ALEN;
     }

     if (I596_PADDING && total_len < I596_MIN_FRAME_LEN) {