=== RUN DF-1894 2026-07-20T18:44:52Z ===
DF-1894: parse_csr_fw (intel_csr.c:404-425) + intel_csr_load_program (:259)
  dmc_header->fw_size = 0x40000001
  nbytes = fw_size * 4 = 0x00000004 (WRAPS — should be 0x100000004)
  nbytes > max_fw_size (0x100000)? NO (check bypassed)
  -> kmalloc(4) succeeds; memcpy 4 bytes is fine
  -> csr->dmc_fw_size = 0x40000001 (ORIGINAL, not wrapped)
  -> intel_csr_load_program loops i=0..0x40000001 calling I915_WRITE_FW (CSR_PROGRAM(i), payload[i])
     payload has 4 bytes allocated; reads ~1073741824 dwords past it into kernel heap -> OOB read + MMIO corruption -> GPU/CPU wedge
[exit=0]