harness.c: In function 'next_reloc':
harness.c:27:56: warning: unused parameter 'nrelocs' [-Wunused-parameter]
                struct radeon_bo_list *relocs, unsigned nrelocs)
                                               ~~~~~~~~~^~~~~~~
BUILD_EXIT=0
=== DF-1725 / DF-1754 radeon relocs idx/4 OOB harness ===
chunk_relocs->length_dw = 5 (not multiple of 4)
p->nrelocs = length_dw/4 = 1 (allocated array size)

idx=0 passes check, indexes relocs[0]  (robj=0xdeadbeef)
idx=1 passes check, indexes relocs[0]  (robj=0xdeadbeef)
idx=2 passes check, indexes relocs[0]  (robj=0xdeadbeef)
idx=3 passes check, indexes relocs[0]  (robj=0xdeadbeef)
idx=4 passes check, indexes relocs[1]  <-- OOB  (robj=0x0)

VERDICT: BUG CONFIRMED. length_dw=5 yields nrelocs=1 but
        idx=4 (valid per the >= length_dw check) maps to
        relocs[1] which is one-past-end OOB. Wild deref of
        reloc->robj/gpu_offset follows. Same root cause as
        DF-1754 in radeon_vce.c.
RUN_EXIT=0