Incoming IDE migration can write host heap

1332990194b5 (Denis V. Lunev, 2026-08-17). hw/ide. Reject an out-of-range PIO transfer window on load. Reported-by XlabAI Team of Tencent Xuanwu Lab. The load path trusted two signed offsets from the stream and did not check them against the buffer size. The public commit names a 16-bit host heap write, and a host heap leak on the read path. Resolves issues 4179 and 3738 (issues API 404, treat as non-public). No public CVE id.

Landed with 324bb5ef83ad Merge tag pull-ide-2026-08-26 (2026-08-26 11:26 PT). IDE on pc and q35.