harness.c: In function 'main':
harness.c:37:14: warning: unused variable 'page_mask' [-Wunused-variable]
     uint64_t page_mask = 0xFFF;       /* AMDGPU_GPU_PAGE_MASK */
              ^~~~~~~~~
BUILD_EXIT=0
=== DF-1719 amdgpu GEM_VA offset+size wraparound harness ===
Attacker: va_address=0x10000 map_size=0x1000 offset_in_bo=0xfffffffffffffff0
Target BO size = 0x1000 bytes

offset_in_bo + map_size = 0xff0 (wrapped)
Sink accepted attacker input (check at amdgpu_vm.c:2510-2511 PASSED).
Stored: mapping->offset = 0xfffffffffffffff0 (OOB vs BO size 0x1000)
VERDICT: BUG CONFIRMED. The missing (offset+size < offset)
         wraparound guard lets unprivileged render-node callers
         smuggle in a mapping whose offset is far past the BO,
         yielding OOB reads of adjacent kernel memory as PTE
         source bytes in amdgpu_vm_bo_split_mapping.
RUN_EXIT=0