DF-1483 amdgpu_cs_user_fence_chunk 32-bit offset overflow harness

  data->offset | kernel-check | fixed-check  | note
  --------------|--------------|--------------|------------------------
  0x00000000    | PASS         | PASS         | in-bounds baseline (rejected is fine)
  0x00001000    | REJECT       | REJECT       | exactly PAGE_SIZE (in-bounds boundary, accepted)
  0x00001001    | REJECT       | REJECT       | one past PAGE_SIZE-8 (rejected is correct)
  0xfffffff8    | PASS         | REJECT       | 0xFFFFFFF8: +8 wraps to 0 -> check PASSES (BUG)
  0xfffffff9    | PASS         | REJECT       | 0xFFFFFFF9: +8 wraps to 1 -> check PASSES (BUG)
  0xffffffff    | PASS         | REJECT       | 0xFFFFFFFF: +8 wraps to 7 -> check PASSES (BUG)

--- What the GPU writes when the buggy check passes ---
  data->offset         = 0xfffffff8
  job->uf_addr (init)  = 0x00000000fffffff8
  + amdgpu_bo_gpu_off  = 0x0000000080000000
  final uf_addr        = 0x000000017ffffff8  <- GPU writes 8 bytes HERE
  bytes past BO base   = 4294967288 (== 0xFFFFFFF8, ~4 GB past PAGE_SIZE BO)

RESULT: integer-overflow bypass CONFIRMED at amdgpu_cs.c:59
(data->offset + 8) is 32-bit: 0xFFFFFFF8+8 wraps to 0, passes the
check. uf_addr=0xFFFFFFF8 is then emitted as a GPU write ~4GB past
the PAGE_SIZE fence BO -> cross-process GPU buffer corruption.
Fix: cast data->offset to u64 BEFORE the add (matches upstream Linux).
RUN_EXIT=0