sizeof(u32)=4  sizeof(size_t)=8

[A] integer overflow in kmalloc size:
    reg_list_format_size_bytes = 0x80000000
    reg_list_size_bytes         = 0x80000008
    kernel (u32+u32)->size_t    = 0x8  (kmalloc allocates this)
    correct (size_t add)        = 0x100000008
    copy loop writes (fmt>>2)*4 = 0x80000000 bytes (536870912 dwords)
    => buffer is 8 bytes, loop writes 2147483648 bytes -> OOB write of >= 0x7ffffff8 bytes

    realistic variant: 0xffffff00 + 0x00000208 -> wrapped 0x108 (264 bytes alloc)
    loop writes (0xffffff00>>2)*4 = 4294967040 bytes into a 264-byte buffer

[B] unvalidated array offset:
    fw->datasize           = 4096
    array_offset_bytes     = 0x40000000  (read from fw header, unchecked)
    read range [offset, offset+256) = [0x40000000, 0x40000100)
    datasize=4096 -> read begins 1073737728 bytes PAST the firmware blob -> heap OOB read

DF-1133: CONFIRMED (A) heap OOB write via kmalloc integer overflow, AND (B) heap OOB read via unvalidated firmware offset

--- WITH FIX ((size_t) add + validate offset+size<=datasize) ---
[A] fixed kmalloc size (size_t add) = 0x100000008 (no wrap; huge alloc fails ENOMEM, no OOB)
[B] fixed validation: fmt_off(0x40000000)+fmt_size(0x80000000) vs datasize(4096) -> REJECTED (EINVAL, no OOB read)
FIX result: integer-overflow OOB write blocked (size_t add)=YES ; offset OOB read blocked=YES
DF-1133 FIX: VALIDATED - size_t add prevents wrap, offset validation rejects OOB read
RUN=0