A text cursor in the tty; LDLS sets net_device.priv_len

The virtual terminals never drew a cursor. Each now paints a steady
block (the cell with its colours swapped), erased before and redrawn
after every output byte, redrawn by a repaint, and hidden by
ESC [ ? 25 l as curses programs ask.

r8169 under LDLS on the TUF A15 got through probe and died in ndo_open
on __fortify_panic. netdev_priv() is `dev->priv` now, a flexible array
counted by net_device.priv_len, and rtl_open's memset of its ring
bookkeeping is bounds-checked against it. The allocator left priv_len
zero, so the driver saw an area of no bytes. It is set from BTF when the
kernel has the member. __fortify_panic also says which check, how many
bytes it had and wanted, and where from.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015f73FesGZGYPkmDvUcj6QX

ldls/kpi/net.c

@@ -79,6 +79,15 @@ kpi_alloc_etherdev_mqs(int priv, unsigned int txqs, unsigned int rxqs)
     kpi_log("kpi: no net_device.dev_addr offset -- the driver will fault\n");
   }
 
+  // How big the private area is, which a driver's own bounds checks read:
+  // netdev_priv() is `dev->priv`, a flexible array counted by `priv_len`, so
+  // fortify sees the area as exactly that long. Zero, as left by mmap, made
+  // r8169's memset of its descriptor-ring bookkeeping -- tp->tx_skb, 4K at
+  // offset 0xa48 -- look like writing past the end of nothing, and it called
+  // __fortify_panic in rtl_open.
+  if (kpi_l.nd_priv_len)
+    *(unsigned int *)((unsigned char *)p + kpi_l.nd_priv_len) = (unsigned int)priv;
+
   // The address lists have to be *empty*, not zeroed.
   //
   // A Linux list_head is empty when it points at itself; zeroed means a null