[Copilot]

This PR addresses unsafe code paths flagged during security review, focusing on memory-safety and trust-boundary handling in runtime C code. Workflow @latest usage was intentionally left unchanged per scope.

• String formatting hardening

  • Replaced unbounded formatting with bounded APIs:
    • vsprintf → vsnprintf in UI text formatting
    • sprintf → snprintf for NVRAM backup path and model/color string writes
  • Prevents stack/heap overwrite risk from oversized formatted output.

• RPC boundary and buffer safety

  • Added request validation in IOP RPC handler (MechaScmdHeader) for:
    • null/undersized RPC payloads
    • oversized inputlength values
  • Updated EE-side RPC call path (MechaScmd) to validate both input and output lengths and copy only caller-requested output size.

• Allocation failure handling in rendering paths

  • Added null checks for malloc/memalign in texture creation code.
  • Added early cleanup/return on allocation failure to avoid dereference of invalid memory.

• Pointer lifecycle cleanup fixes

  • Initialized texture pointers that may be conditionally assigned.
  • Removed/guarded risky free paths in unsupported-version UI flow to avoid invalid/double-free scenarios.

• ROMVER read safety

  • Switched to bounded, zero-initialized ROMVER buffers and guarded usage on short reads before index-based access.

int MechaScmd(u8 cmd, void *input, u8 inputlength, void *output, u8 outputlength)
{
    struct MechaScmdParams *params = (struct MechaScmdParams *)RpcBuffer;
    if (inputlength > sizeof(params->input) || outputlength > sizeof(params->output) ||
        (inputlength > 0 && input == NULL))
        return 0;

    /* ... RPC call ... */

    if (output && outputlength > 0)
        memcpy(output, params->output, outputlength);
    return params->result;
}