sceNetAdhocMatching: Don't copy from a missing SendData or SelectTarget buffer

Since 74178a8106 a data or opt buffer that runs past the end of memory
is passed on as NULL, and SendData and SelectTarget then copied dataLen
or optLen bytes from it, crashing the emulator. Return INVALID_ARG, as
CancelTargetWithOpt already does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Core/HLE/sceNetAdhocMatching.cpp

@@ -1854,6 +1854,10 @@ static int sceNetAdhocMatchingSelectTarget(MIPSState *mips, int matchingId, cons
 
 	void * opt = NULL;
 	if (Memory::IsValidRange(optDataPtr, std::max(optLen, 1))) opt = Memory::GetPointerWriteUnchecked(optDataPtr);
+	// The messages copy optLen bytes from it.
+	if (optLen > 0 && opt == NULL) {
+		return hleLogError(Log::sceNet, SCE_NET_ADHOC_MATCHING_ERROR_INVALID_ARG, "adhocmatching bad opt buffer");
+	}
 	// Host Mode
 	if (context->mode == PSP_ADHOC_MATCHING_MODE_PARENT) {
 		// Already Connected. Right after accepting, it's still in progress (pspautotests net/adhoc/pair/matching).
@@ -2389,6 +2393,10 @@ int sceNetAdhocMatchingSendData(MIPSState *mips, int matchingId, const char *mac
 
 	void* data = NULL;
 	if (Memory::IsValidRange(dataAddr, dataLen)) data = Memory::GetPointerWriteUnchecked(dataAddr);
+	// The bulk packet copies all dataLen bytes from it.
+	if (data == NULL) {
+		return hleLogError(Log::sceNet, SCE_NET_ADHOC_MATCHING_ERROR_INVALID_ARG, "bad data buffer");
+	}
 
 	// Lock the peer
 	std::lock_guard<std::recursive_mutex> peer_guard(peerlock);