cp_table_size = 67584 bytes (16896 dwords capacity for dst_ptr[])

ME[CE] jt_offset=0x10 jt_size=4000  fw_dwords=1024  -> bo_offset now 4000
ME[PFP] jt_offset=0x10000 jt_size=200   fw_dwords=1024  -> bo_offset now 4200
ME[ME] jt_offset=0x20 jt_size=16896 fw_dwords=2048  -> bo_offset now 21096
ME[MEC] jt_offset=0x30 jt_size=100   fw_dwords=512   -> bo_offset now 21196

cumulative bo_offset after all MEs = 21196 (capacity 16896 dwords)
modeled OOB WRITE iterations (dst past cp_table) = 4300
modeled OOB READ  iterations (src past fw blob)  = 18072

DF-1134: CONFIRMED OOB write past cp_table VRAM BO AND/OR OOB read past firmware blob

--- WITH FIX (validate jt bounds vs fw blob and cp_table; skip if invalid) ---
ME[CE] jt_off=0x10     jt_size=4000  fw_dw=1024  -> REJECTED (skip, safe)
ME[PFP] jt_off=0x10000  jt_size=200   fw_dw=1024  -> REJECTED (skip, safe)
ME[ME] jt_off=0x20     jt_size=16896 fw_dw=2048  -> REJECTED (skip, safe)
ME[MEC] jt_off=0x30     jt_size=100   fw_dw=512   -> accepted
FIX result: OOB write iters remaining=0 ; OOB read iters remaining=0 (expect 0)
DF-1134 FIX: VALIDATED - bounds validation rejects all OOB jt_offset/jt_size
RUN=0