cp_table = 16896 dwords (67584 bytes)

=== Case 1: large jt_size in CE firmware -> OOB write past cp_table ===
  CE jt_size = 25088 (cp_table = 16896 dwords) -> overflows by 8192 dwords
  BUG: OOB write faulted (signal 11) -- kernel equivalent: page fault past cp_table BO mapping

=== Case 2: me==4 dereferences adev->gfx.mec2_fw->data with mec2_fw==NULL ===
  (mimics Raven APU boot with missing optional mec2 firmware)
  BUG: NULL deref of mec2_fw (signal 11) -- kernel equivalent: panic in rv_init_cp_jump_table at gfx_v9_0.c:1113 when mec2 firmware is absent

DF-1177 harness: OOB write + NULL deref both demonstrated.
EXIT=0