DF-1209 r100_packet3_load_vbpntr unsigned c-1 underflow harness
c (from IB)           = 0
(c > 16) guard        = PASS  (guard PASSES, c==0 allowed)
(unsigned)(c - 1)     = 4294967295   <-- loop bound at r100.c:1332
arrays[] real length  = 16  (r100_track.h:66)

Replicating r100.c:1332 loop, capping at 32 iters to prove the overflow:

  arrays[14] = {esize=0x11111111 robj=0xaaaa}  (in-bounds)
  arrays[15] = {esize=0x22222222 robj=0xbbbb}  (in-bounds, last legal slot)
  arrays[16] = {esize=0x11111111 robj=0xaaaa}  <-- FIRST OOB WRITE (past [16])
  arrays[17] = {esize=0x22222222 robj=0xbbbb}  <-- OOB
  canary     = 0xdeadbeefcafebabe  (expected 0xdeadbeefcafebabe)

first OOB write at arrays[16] (in-kernel: cb[]/zb[]/aa[]/textures[]/slab)
canary (simulating adjacent slab) intact

RESULT: heap OOB write CONFIRMED at r100.c:1343-1356 via c==0 underflow
In-kernel: track is kzalloc'd (radeon_cs.c); writes overflow cb/zb/aa/textures
           and adjacent slab. Reachable by DRM_AUTH user via RADEON_CS ioctl.
RUN_EXIT=0