### build
BUILD_RC=0
### run
=== DF-1130 harness: crafted SI firmware (datasize=1024) ===

    header.ucode_array_offset_bytes = 0xff0
    header.ucode_size_bytes        = 0x4000
    => end of payload = 0x4ff0 (vs datasize=0x400) -> OOB by 19440 bytes

[A] radeon_ucode_validate (radeon_ucode.c:156-165):
    rc=0  (PASSES -- only checks size_bytes==datasize)

[B] si_mc_load_microcode buggy (si.c:1574-1584):
    would loop reading u32 from fw+0xff0 for 4096 iters
    >>> In kernel: reads 19440 bytes past firmware buffer into adjacent heap <<<

[C] si_mc_load_microcode fixed (fix.diff):
    rc=-1  (rejected: ucode_array_offset_bytes + ucode_size_bytes > datasize)
RUN_RC=0