Berry mapping minor fixes (#24807)

tasmota/tasmota_xdrv_driver/xdrv_52_3_berry_leds.ino

@@ -352,7 +352,7 @@ extern "C" {
       if (pixel_size > 4) { pixel_size = 4; }
       // arg5: bri:int (0..255)
       int32_t bri255 = 255;
-      if (top >= 3 && be_isint(vm, 5)) {
+      if (top >= 5 && be_isint(vm, 5)) {  // L-16: was `top >= 3` which never guards slot 5 correctly
         bri255 = be_toint(vm, 5);
       }
       if (bri255 < 0)  { bri255 = 0; }

tasmota/tasmota_xdrv_driver/xdrv_52_3_berry_mdns.ino

@@ -243,7 +243,7 @@ extern "C" {
   #else
         head->addr.u_addr.ip4.addr = (uint32_t) ip;
   #endif
-      } while (0);
+      }
 
       if (err == ESP_OK && head != nullptr) {
         err = mdns_delegate_hostname_add(hostname, head);

tasmota/tasmota_xdrv_driver/xdrv_52_3_berry_tcpserver.ino

@@ -150,10 +150,16 @@ void WiFiServerAsync::begin(uint16_t port, int enable){
   }
   memset(server.sin6_addr.s6_addr, 0x0, 16);
   server.sin6_port = htons(_port);
-  if(bind(sockfd, (struct sockaddr *)&server, sizeof(server)) < 0)
+  if(bind(sockfd, (struct sockaddr *)&server, sizeof(server)) < 0) {
+    lwip_close(sockfd);   // close fd to avoid leak on bind failure
+    sockfd = -1;
     return;
-  if(listen(sockfd , _max_clients) < 0)
+  }
+  if(listen(sockfd , _max_clients) < 0) {
+    lwip_close(sockfd);   // close fd to avoid leak on listen failure
+    sockfd = -1;
     return;
+  }
   fcntl(sockfd, F_SETFL, O_NONBLOCK);
   _listening = true;
   _noDelay = false;

tasmota/tasmota_xdrv_driver/xdrv_52_9_berry.ino

@@ -546,6 +546,7 @@ void BrREPLRun(char * cmd) {
   size_t cmd_len = strlen(cmd);
   size_t cmd2_len = cmd_len + 12;
   char * cmd2 = (char*) malloc(cmd2_len);
+  if (!cmd2) { return; }  // guard against malloc failure
   do {
     int32_t ret_code;