Improve mqueue memory safety

This commit fixes potential crash in mo_mq_items by adding NULL pointer
validation. In addition, it adds unlikely() branch prediction hints for
error conditions.

Author: jserv

include/sys/mqueue.h

@@ -22,5 +22,8 @@ message_t *mo_mq_peek(mq_t *mq);
 
 static inline int32_t mo_mq_items(mq_t *mq)
 {
+    /* Add NULL safety to prevent crashes */
+    if (unlikely(!mq || !mq->q))
+        return 0;
     return queue_count(mq->q);
 }

kernel/mqueue.c

@@ -7,15 +7,16 @@
 #include <sys/task.h>
 
 #include "private/error.h"
+#include "private/utils.h"
 
 mq_t *mo_mq_create(uint16_t max_items)
 {
     mq_t *mq = malloc(sizeof *mq);
-    if (!mq)
+    if (unlikely(!mq))
         return NULL;
 
     mq->q = queue_create(max_items);
-    if (!mq->q) {
+    if (unlikely(!mq->q)) {
         free(mq);
         return NULL;
     }
@@ -24,22 +25,33 @@ mq_t *mo_mq_create(uint16_t max_items)
 
 int32_t mo_mq_destroy(mq_t *mq)
 {
+    if (unlikely(!mq))
+        return ERR_OK; /* Destroying NULL is no-op */
+
+    if (unlikely(!mq->q))
+        return ERR_FAIL; /* Invalid mqueue state */
+
     CRITICAL_ENTER();
 
-    if (queue_count(mq->q) != 0) { /* refuse to destroy non-empty q */
+    if (unlikely(queue_count(mq->q) != 0)) { /* refuse to destroy non-empty q */
         CRITICAL_LEAVE();
         return ERR_MQ_NOTEMPTY;
     }
 
+    /* Safe to destroy now - no need to hold critical section */
+    CRITICAL_LEAVE();
+
     queue_destroy(mq->q);
     free(mq);
 
-    CRITICAL_LEAVE();
     return ERR_OK;
 }
 
 int32_t mo_mq_enqueue(mq_t *mq, message_t *msg)
 {
+    if (unlikely(!mq || !mq->q || !msg))
+        return ERR_FAIL;
+
     int32_t rc;
 
     CRITICAL_ENTER();
@@ -52,6 +64,9 @@ int32_t mo_mq_enqueue(mq_t *mq, message_t *msg)
 /* remove oldest message (FIFO) */
 message_t *mo_mq_dequeue(mq_t *mq)
 {
+    if (unlikely(!mq || !mq->q))
+        return NULL;
+
     message_t *msg;
 
     CRITICAL_ENTER();
@@ -64,6 +79,9 @@ message_t *mo_mq_dequeue(mq_t *mq)
 /* inspect head without removing */
 message_t *mo_mq_peek(mq_t *mq)
 {
+    if (unlikely(!mq || !mq->q))
+        return NULL;
+
     message_t *msg;
 
     CRITICAL_ENTER();