# DF-1257 — reproduction

Userspace harness replicating the `amdgpu_vm_bo_map` `offset + size`
integer-overflow bounds check and the resulting `pfn = mapping->offset >> 12`
OOB read.

The live kernel trigger requires an AMD GPU with amdgpu (absent from the
QEMU guest, no `/dev/dri/renderD128`); the harness proves the overflow →
OOB math.

```sh
./build.sh && ./run.sh
```

Expected: `PRIMITIVE CONFIRMED: wrapped offset+size passes the bounds check; stored offset yields pfn ~ 2^52 -> OOB read in pages_addr[]. Bug is REAL.`

Fix: `fix.diff` makes the bounds check overflow-safe in both `bo_map` and
`bo_replace_map`. Builds cleanly into `amdgpu.ko` (`-Werror`). See `VERDICT.md`.