From 31aea500937604447fe20cbb039bf7142279158c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20Ondra=C4=8Dka?= <pavel.ondracka@gmail.com>
Date: Wed, 3 Dec 2025 19:07:59 +0100
Subject: [PATCH] r300: fix overflow in r300_draw_elements_immediate

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/36447>
---
 src/gallium/drivers/r300/r300_render.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/gallium/drivers/r300/r300_render.c b/src/gallium/drivers/r300/r300_render.c
index f835ca01a1a..c9c243c1853 100644
--- a/src/gallium/drivers/r300/r300_render.c
+++ b/src/gallium/drivers/r300/r300_render.c
@@ -544,7 +544,14 @@ static void r300_draw_elements_immediate(struct r300_context *r300,
             if (draw->count & 1)
                 OUT_CS(ptr2[i] + draw->index_bias);
         } else {
-            OUT_CS_TABLE(ptr2, count_dwords);
+            /* OUT_CS_TABLE expects full dwords so pack the odd tail manually. */
+            if (draw->count & 1) {
+                if (count_dwords > 1)
+                    OUT_CS_TABLE(ptr2, count_dwords - 1);
+                OUT_CS(ptr2[draw->count - 1]);
+            } else {
+                OUT_CS_TABLE(ptr2, count_dwords);
+            }
         }
         break;