vfio/listener: Fix translated_addr for non-identity-mapped RAM sections

In vfio_listener_region_del(), when dirty tracking is active and a writable RAM section is deleted, a synthetic IOMMUTLBEntry is built to flush dirty pages. Setting translated_addr to the IOVA (GPA) is only correct for identity-mapped regions where GPA == ram_addr_t. For RAM sections with GPA far above main RAM (e.g., nested VT-d interrupt remapping table at 58 TB), translated_addr is too large, causing a crash in physical_memory_set_dirty_lebitmap() when indexing beyond the allocated dirty memory blocks array : bitmap_set_atomic(map=NULL, start=1, nr=1) physical_memory_set_dirty_range(start=0x380004040000, length=4096) physical_memory_set_dirty_lebitmap(start=0x380004040000, pages=3) vfio_container_query_dirty_bitmap(translated_addr=0x380004040000) vfio_legacy_dma_unmap_one(iova=0x380004040000, size=12288) vfio_listener_region_del() Fix this by setting translated_addr to the ram_addr_t of the section, which is consistent with other vfio dirty tracking code: translated_addr = memory_region_get_ram_addr(section->mr) + section->offset_within_region; Cc: Zhenzhong Duan <zhenzhong.duan@intel.com> Fixes: 6e360c06176c ("vfio/listener: Add missing dirty tracking in region_del") Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Tested-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://lore.kernel.org/qemu-devel/20260625134352.3122572-1-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>