harness.c: In function 'vce_cs_reloc':
harness.c:30:58: warning: unused parameter 'nrelocs' [-Wunused-parameter]
                  struct radeon_bo_list *relocs, unsigned nrelocs)
                                                 ~~~~~~~~~^~~~~~~
BUILD_EXIT=0
=== DF-1754 radeon_vce_cs_reloc idx/4 OOB harness ===
chunk_relocs->length_dw = 5  (not multiple of 4)
p->nrelocs = 1

idx=0 -> relocs[0]   reloc->robj=0xcafe (wild deref at radeon_bo_size)
idx=1 -> relocs[0]   reloc->robj=0xcafe (wild deref at radeon_bo_size)
idx=2 -> relocs[0]   reloc->robj=0xcafe (wild deref at radeon_bo_size)
idx=3 -> relocs[0]   reloc->robj=0xcafe (wild deref at radeon_bo_size)
idx=4 -> relocs[1]  <-- OOB   reloc->robj=0x0 (wild deref at radeon_bo_size)

VERDICT: BUG CONFIRMED. Same root cause as DF-1725:
        chunk_relocs->length_dw=5 / 4 = nrelocs=1, but the
        (idx >= length_dw) check at line 482 admits idx=4,
        and relocs[1] is OOB. Wild deref of reloc->robj.
RUN_EXIT=0