DF-1164 PoC verification — source-level trace of gfx_v7_0 CP/MEC/RLC firmware
loader OOB-read bug.

amdgpu is not in X86_64_GENERIC; it exists only as a kld module. Loading it
on the QEMU guest succeeds but attaches to no device (no AMD Sea Islands GPU),
so the firmware-loader code paths are never called. Verification is by
source-level trace + build-validation of the fix.

## Bug location
- Validator (insufficient): `sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251-260`
- Header with separate size/offset fields: `amdgpu_ucode.h:26-37`
- Loader loops that trust both fields:
  - `sys/dev/drm/amd/amdgpu/gfx_v7_0.c:2447-2453` (PFP)
  - `gfx_v7_0.c:2457-2463` (CE)
  - `gfx_v7_0.c:2467-2473` (ME)
  - `gfx_v7_0.c:2708-2715` (MEC1)
  - `gfx_v7_0.c:2731-2737` (MEC2)
  - `gfx_v7_0.c:3572-3577` (RLC)

## Mechanism
Validator only checks `fw->datasize == hdr->size_bytes`. Crafted header with
`ucode_size_bytes` extending past the blob passes the check; the loader loop
`le32_to_cpup(fw_data++)` for `i < ucode_size_bytes/4` reads past the blob
into adjacent kernel heap.

## Reproduce
1. Apply `fix.diff` to /usr/src.
2. `cd /usr/src/sys/dev/drm/amd/amdgpu && make KMOD=amdgpu`  →  amdgpu.ko builds clean.
3. Runtime test requires AMD Sea Islands GPU + crafted firmware (not present
   on this guest).

See `VERDICT.md` for the full analysis.