=== Bug 1: u32 overflow in kmalloc(size_a + size_b) at gfx_v9_0.c:696-697 ===
  reg_list_format_size_bytes = 0x80000010 (2147483664)
  reg_list_size_bytes        = 0x80000010 (2147483664)
  u32 sum                    = 0x00000020 (32)   <-- WRAPS
  (true 64-bit sum           = 0x0000000100000020)
  kmalloc(32) returns 0x8004aec00
  copy loop runs 536870916 iterations, writing 2147483664 bytes into 32-byte buffer
  -> 2147483632-byte heap overflow past kmalloc'd buffer
  (in the kernel: structured heap overflow into whatever follows the
   register_list_format allocation -- classic slab-corruption primitive)
  wrote 0xDEADBEEF into 16 slots past the nominal 32-byte allocation

=== Bug 2: unvalidated reg_list_format_array_offset_bytes at gfx_v9_0.c:703-706 ===
  fw->datasize                       = 4096
  reg_list_format_array_offset_bytes = 0x10000 (65536)  <-- > datasize
  loop reads from (fw + offset) with no check that offset+size <= datasize
  BUG: OOB read faulted (signal 11) -- kernel equivalent: page
       fault reading fw+65536 past the firmware buffer in
       gfx_v9_0_init_microcode -> panic

DF-1176 harness: both bugs demonstrated.
  Impact ceiling: heap overflow (slab corruption) + OOB read panic.
EXIT=0