Summary

Adds a new security query cpp/mmio-unsanitized-memcpy targeting unsanitized memory copy operations (memcpy, memmove, strncpy) where size parameters derive directly from hardware registers (MMIO/DMA) without relational bounds checks.

Motivation & Domain Context

Standard buffer overflow queries (UnboundedWrite.ql, OverrunWrite.ql) model user-space strings and generic memory ops, but do not model volatile register macro reads (READ_REG, GET_MMIO) commonly found in microcontroller drivers, RTOS kernels, and embedded hardware stacks. This query fills a gap for embedded C/C++ static analysis.

Query Design & Architecture

• Taint Engine: Modern DataFlow::ConfigSig with TaintTracking::Global.
• Sources: Volatile variables, volatile struct fields, volatile pointer dereferences, and MMIO macros (READ_REG, GET_MMIO, REG_READ, DMA_READ).
• Sinks: Parameter index 2 (size/count) of memcpy, memmove, strncpy, wmemcpy, wmemmove.
• Barriers: Public IRGuards via DataFlow::BarrierGuard<lessThanOrEqual/3> to recognize if (len <= MAX) conditions and prevent false positives. lessThanOrEqual uses the public Operand + getConvertedResultExpression() pattern.
• Public API Compliance: Uses only public APIs (cpp, TaintTracking, IRGuards). Zero internal. / DataFlowImplCommon dependencies.

Verification & Test Results

• Test Command: codeql test run cpp/ql/test/query-tests/Security/CWE/CWE-120/MmioUnsanitizedMemcpy/
• Result: All 1 tests passed (3 positive alerts, 3 false-positive barrier test cases clean).
• Documentation: codeql generate query-help passed DTD verification and rendered clean markdown.
• Suite Integration: Explicit include of cpp/mmio-unsanitized-memcpy in cpp-security-extended.qls.

Checklist

• Query metadata follows upstream style guidelines (@kind path-problem, @precision medium, @security-severity 8.6).
• .qhelp file provided with valid DTD structure and Bad/Good examples.
• Test directory contains .qlref, test.c, and verified .expected output.
• Query added to appropriate .qls suite.
• No internal. module imports used.