drm: the same latched-flag bug a fourth time, in my own fix for the third

I built UinputRefreshGuard INSIDE the spawned closure, so it only covered
paths where the closure ran. thread::spawn panics on EAGAIN after the swap,
so no guard existed and the flag stayed set for the process lifetime, which
is the exact failure the guard was introduced to prevent. I then wrote
RefreshSlot correctly - constructed before the spawn, moved in - two hours
later and did not go back to fix its sibling. Both are right now, and the
spawn is fallible in both.

Also from the review:

- DRMTAP_PREBUILT_DIR returned before the EGL-stub assertion, so the check
  only guarded the source build. That is backwards: prebuilt-dir is the
  widest override (no fetch, no sha check, an object this script never sees),
  the likeliest to hand over a stub, and the path our aarch64 cross-build
  actually uses. Verified the assertion accepts a real .so and rejects one
  built with -Degl=disabled.
- convert() bounded only the frame libdrmtap returns, not the descriptor going
  in. offsets/pitches address plane ranges inside the dma-buf, so those are
  what a malformed pair would reach past. Bounded per populated plane, the
  same way the export side is. Defense in depth (the producer is
  root-authenticated and libdrmtap validates against the fd since 0.4.12),
  but the two halves should agree before the C sees the data, not after.
- the flutter patch step used '[[ test ]] && git apply' as its last command,
  so the step would FAIL rather than skip the first time FLUTTER_VERSION
  moves off 3.24.5. Explicit if/else, and the values now come from the
  environment instead of ${{ }} interpolation, which also clears zizmor's
  template-injection warning. Checked both branches.

Declined: the cursor id/cache-key convergence finding. Both accessors use one
selection over one map, so they can only disagree across a publish race, and
state.hcursor is already set to the id ACTUALLY served (drm_served_id), which
is the sync the finding asks for - added in an earlier round.

libs/scrap/src/common/drm_render.rs

@@ -116,6 +116,43 @@ impl RenderConverter {
         desc: &mut drmtap_dmabuf_desc,
         received_fd: RawFd,
     ) -> io::Result<(&[u8], u32, u32, Pixfmt)> {
+        // Bound the INCOMING descriptor, not just the frame libdrmtap hands back. Every field here
+        // was deserialized from the `_drm` wire, and while the producer is authenticated as root
+        // (`connect_drm` refuses a non-root peer) and libdrmtap has validated the fd against the
+        // descriptor since 0.4.12, this side already bounds the export descriptor symmetrically --
+        // the two halves of the split should agree about what they will touch before the C sees it,
+        // not after.
+        //
+        // offsets/pitches are the interesting ones: they address plane ranges inside the dma-buf, so
+        // a malformed pair is what would reach past the buffer. Bound each populated plane's extent
+        // the same way the frame path is bounded.
+        {
+            let (w, h) = (desc.width, desc.height);
+            if w == 0 || h == 0 || w > MAX_DIM || h > MAX_DIM {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("drm: refusing a dma-buf descriptor with geometry {w}x{h}"),
+                ));
+            }
+            let planes = desc.num_planes.clamp(1, 4) as usize;
+            for p in 0..planes {
+                let extent = (desc.pitches[p] as usize)
+                    .checked_mul(h as usize)
+                    .and_then(|rows| rows.checked_add(desc.offsets[p] as usize));
+                match extent {
+                    Some(end) if end <= MAX_FRAME_BYTES => {}
+                    other => {
+                        return Err(io::Error::new(
+                            io::ErrorKind::InvalidData,
+                            format!(
+                                "drm: refusing dma-buf plane {p} (offset {} pitch {} over {h} rows -> {other:?}, cap {MAX_FRAME_BYTES})",
+                                desc.offsets[p], desc.pitches[p]
+                            ),
+                        ));
+                    }
+                }
+            }
+        }
         // Always bound: a libdrmtap without the split convert symbols never loads.
         let convert_dmabuf = self.lib.convert_dmabuf;
         // Overwrite the descriptor's fd with the one THIS process received (split_capture.c