BUILD_EXIT=0
=== DF-1753 radeon_vce cs_parse OOB IB field read harness ===
chunk_ib->length_dw = 4

p->idx=2 (within length_dw=4)
Encode case reads up to p->idx+12 = 14 (vs length_dw=4)
OOB field reads:
  radeon_get_ib_value(p, p->idx+0) = ib[2] = 0xdead0002
  radeon_get_ib_value(p, p->idx+1) = ib[3] = 0xdead0003
  radeon_get_ib_value(p, p->idx+2) = ib[4] = 0xdead0004   <-- OOB
  radeon_get_ib_value(p, p->idx+3) = ib[5] = 0xdead0005   <-- OOB
  radeon_get_ib_value(p, p->idx+4) = ib[6] = 0xdead0006   <-- OOB
  radeon_get_ib_value(p, p->idx+5) = ib[7] = 0xdead0007   <-- OOB
  radeon_get_ib_value(p, p->idx+6) = ib[8] = 0x00000000   <-- OOB
  radeon_get_ib_value(p, p->idx+7) = ib[9] = 0x00000000   <-- OOB
  radeon_get_ib_value(p, p->idx+8) = ib[10] = 0x00000000   <-- OOB
  radeon_get_ib_value(p, p->idx+9) = ib[11] = 0x00000000   <-- OOB
  radeon_get_ib_value(p, p->idx+10) = ib[12] = 0x00000000   <-- OOB
  radeon_get_ib_value(p, p->idx+11) = ib[13] = 0x00000000   <-- OOB
  radeon_get_ib_value(p, p->idx+12) = ib[14] = 0x00000000   <-- OOB

VERDICT: BUG CONFIRMED. cs_parse reads IB dwords past
        chunk_ib->length_dw (no idx+len/4 <= length_dw check).
        Same path writes p->ib.ptr[lo]/[hi] in cs_reloc;
        combined, OOB read + OOB write of IB on render node.
RUN_EXIT=0