# DF-1246 — reproduction

Userspace harness replicating `evergreen_dma_cs_parse()`'s header-only
bounds check and the resulting `ib[idx+N]` OOB read+write.

The live kernel trigger requires an AMD/ATI radeon GPU (absent from the
QEMU guest); the harness proves the IB-body OOB primitive.

```sh
./build.sh && ./run.sh
```

Expected: `PRIMITIVE CONFIRMED: idx+8 (11) >= length_dw (4); OOB read+write past IB.`

Fix: `fix.diff` adds a per-packet body-size bounds check. Builds cleanly
into `radeon.ko` (`-Werror`). See `VERDICT.md`.