The bounds check `pos->offset + pos->size > chip_size` can silently
wrap around when both offset and size are large uint32_t values,
bypassing the validation entirely.
Use `pos->size > chip_size - pos->offset` instead, which is safe
because pos->offset <= chip_size is already verified by the first
condition in the same expression.
Found via https://github.com/Eun0us/esp-fuzzer
