RUN_START
alignment gate (amdgpu_vm.c:2504): PASS
offset = 0xfffffffffffff000
size   = 0x0000000000002000
offset + size (uint64) = 0x0000000000001000   (wrapped!)
bo_size = 0x0000000000002000
bounds check (amdgpu_vm.c:2511) result: ACCEPT (bug)
stored mapping->offset = 0xfffffffffffff000
pfn = mapping->offset >> 12 = 0x000fffffffffffff
pages_addr[pfn] would read at index 0x000fffffffffffff -> MASSIVE OOB read

PRIMITIVE CONFIRMED: wrapped offset+size passes the bounds check; stored offset
yields pfn ~ 2^52 -> OOB read in pages_addr[]. Bug is REAL.
EXIT=0