fix(vd960DBN): BLE 响应缓冲越界防御 — 根因: MAX_BLE_DAT_BUF_LEN 宏不一致(ODR)

根因链 (14:46 日志 + .map 铁证):
- .map: g_buf_ble_response = 107B (7 + dat[100]) -> 编译时 MAX_BLE_DAT_BUF_LEN=100
- 但 QUERY 响应 130B 写入 dat[0..129] -> 越界 30B
- 越界踩中相邻 g_notify_buftemp.flag/len (0x20007BDC)
- 第二分包填充后被物理抹除 (无 CLR_NTF = 非 clear_ble_notify_buf 干的)

修复 (兼容新旧宏, 永不越界):
- QUERY: _req_count 按 MAX_BLE_TMP_BUF_LEN 动态限制 (100->3条/132->4条)
- set_response_buf: dat_len 截断到 MAX_BLE_DAT_BUF_LEN
- 验证: 旧宏100 下 3条=98B 分包[93,17] 全合规

vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c

@@ -284,6 +284,7 @@ uint8_t set_response_buf(Buf_DBN_BLE *response_dst, uint8_t magic, uint8_t cmd,
 {
     uint8_t ret = 0;
     uint8_t i = 0;
+    if(dat_len > MAX_BLE_DAT_BUF_LEN) dat_len = MAX_BLE_DAT_BUF_LEN;  /* overflow guard */
     clear_buf_dbn_ble(response_dst);
     response_dst->magic = magic;
     response_dst->cmd = cmd;
@@ -979,6 +980,12 @@ void manage_dbn_ble_default(uint8_t *pkg, uint8_t len)
             _req_count = pkg[8];
             if (_req_count > OFFLOG_MAX_QUERY_RECORDS) _req_count = OFFLOG_MAX_QUERY_RECORDS;
             if (_req_count == 0) _req_count = OFFLOG_MAX_QUERY_RECORDS;
+            /* overflow guard: resp dat = 2 + N*32 must fit tmp buf.
+               history: MAX_BLE_TMP_BUF_LEN was 100, 130B write overflowed
+               into g_notify_buftemp and erased pending chunk 2 */
+            { uint16_t _max_rec = (MAX_BLE_TMP_BUF_LEN >= 2) ?
+                ((MAX_BLE_TMP_BUF_LEN - 2) / (uint16_t)sizeof(OfflogEvt)) : 0;
+              if (_req_count > _max_rec) _req_count = _max_rec; }
 
             tmp_ble_buf[_i++] = 0x00;    /* status ok */
             tmp_ble_buf[_i++] = 0;       /* count placeholder */