### build
BUILD_RC=0
### run
=== DF-1128 harness: crafted si_ps with performance_level_count==0 ===

    sizeof(struct si_ps)         = 104
    sizeof(struct rv7xx_pl)      = 16 (one performance level)
    performance_levels[0] offset = 8 (inside si_ps)
    performance_levels[-1] reads 16 bytes BEFORE performance_levels[0]
    -> reads offset -16 inside struct si_ps (i.e. BEFORE the object)

[A] si_convert_power_state_to_smc:5665 OOB READ:
    threshold = performance_levels[count-1].sclk = 0xcccccccc
    >>> In kernel: 4-byte OOB read BEFORE allocated si_ps slab object <<<

[B] si_dpm_get_sclk:7876 / si_dpm_get_mclk:7888: same OOB pattern when
    `low` argument is false -- returns performance_levels[count-1].sclk/mclk.
    These are sysfs/debugfs readable via radeon_pm_info -> info leak of
    adjacent slab data (or panic if the read crosses a page boundary).

[C] Correctness check on the finding's `state_size underflow` claim:
    sizeof(SWSTATE) - sizeof(LEVEL) == 4 (NOT ~SIZE_MAX)
    -> memset(smc_state, 0, 4) is safe; the `memset heap overflow`
       claim in the finding summary is INCORRECT. The real primitive
       is the OOB read at line 5665 (and 7876/7888), which this harness confirms.
RUN_RC=0