拉取/合并请求描述：(PR description)

Legacy virtio-input read/write check pos + size before indexing the event array. Mixing a signed offset with an unsigned length allows a negative offset or an overflowing length to pass that check.

Reject negative and out-of-range offsets first, then compare the length with the remaining queue range using subtraction. Keep the existing strict range convention and return values; this change does not redefine the API's event-index/byte-count units.

Fixes #10379.
Fixes #10380.

Validation

GCC 16.1 tests compile the complete read/write bodies against repository virtio headers. Negative offsets, overflowing lengths, null buffers and boundary cases pass. Exhaustive small nonnegative inputs confirm that request acceptance is unchanged. A copy adapter detects invalid copies without executing them; the original code fails the regression cases.

Changed-line clang-format and git diff --check pass. No target BSP, QEMU or actual ISR/mutex scheduling test was run.

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

• 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
• 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

• 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
• 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
• 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
• 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
• 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
• 代码是高质量的 Code in this PR is of high quality
• 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
• 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查