AdhocMatching: Don't write past the GetMembers buffer

The sibling/child loop didn't check requestedpeers, so a game passing a
buffer smaller than the member count got it overflowed. Also validate the
guest range before writing.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Core/HLE/sceNetAdhocMatching.cpp

@@ -2329,6 +2329,10 @@ static int sceNetAdhocMatchingGetMembers(int matchingId, u32 sizeAddr, u32 buf)
 		// Fix Oversize Request
 		if ((*buflen) > available) *buflen = available;
 
+		if (!Memory::IsValidRange(buf, *buflen)) {
+			return hleLogError(Log::sceNet, SCE_NET_ADHOC_MATCHING_ERROR_INVALID_ARG, "adhocmatching invalid arg");
+		}
+
 		// Clear Memory
 		memset(buf2, 0, *buflen);
 
@@ -2410,6 +2414,10 @@ static int sceNetAdhocMatchingGetMembers(int matchingId, u32 sizeAddr, u32 buf)
 
 					// Iterate rearranged peers
 					for (const auto& peer : sortedPeers) {
+						if (filledpeers >= requestedpeers) {
+							break;
+						}
+
 						// Parent Mode
 						if (context->mode == PSP_ADHOC_MATCHING_MODE_PARENT) {
 							// Interested in Children