virtio-devices: iommu: Use checked add for reply length

The reply length was `hdr_len + size_of::<tail>()`, computed twice.
Make it explicit via checked_add and reuse the result.

Signed-off-by: Rob Bradford <rbradford@meta.com>
Assisted-by: Claude:claude-opus-4-7

virtio-devices/src/iommu.rs

@@ -642,7 +642,10 @@ impl Request {
             return Err(Error::UnexpectedReadOnlyDescriptor);
         }
 
-        if status_desc.len() < hdr_len + size_of::<VirtioIommuReqTail>() as u32 {
+        let reply_len = (hdr_len as usize)
+            .checked_add(size_of::<VirtioIommuReqTail>())
+            .ok_or(Error::BufferLengthTooSmall)?;
+        if (status_desc.len() as usize) < reply_len {
             return Err(Error::BufferLengthTooSmall);
         }
 
@@ -662,7 +665,7 @@ impl Request {
         // Return the error if the result was not Ok().
         result?;
 
-        Ok((hdr_len as usize) + size_of::<VirtioIommuReqTail>())
+        Ok(reply_len)
     }
 }