BUILD_OK
-rwxr-xr-x  1 maxx  maxx  9232 Jul 21 02:24 validate_bypass
DF-1946 harness: amdgpu_ucode_validate missing size/bounds checks
Reference: sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251-260
sizeof(struct common_firmware_header) = 32

=== CASE 1: 4-byte fw, size_bytes=datasize=4 (no header at all) (datasize=4) ===
  vanilla amdgpu_ucode_validate: PASS (rc=0)  <- bug: caller will deref OOB
  fixed    amdgpu_ucode_validate: REJECT (rc=-22)
  CALLER deref of hdr->ucode_size_bytes (off 20):
    reads 4 bytes starting at data+20; datasize=4 => 20-byte OOB READ past fw->data
    header field read alone needs 24 bytes past end-of-buffer

=== CASE 2: 16-byte fw, size_bytes=datasize=16 (ucode_size_bytes field at off 20 is OOB) (datasize=16) ===
  vanilla amdgpu_ucode_validate: PASS (rc=0)  <- bug: caller will deref OOB
  fixed    amdgpu_ucode_validate: REJECT (rc=-22)
  CALLER deref of hdr->ucode_size_bytes (off 20):
    reads 4 bytes starting at data+20; datasize=16 => 8-byte OOB READ past fw->data
    header field read alone needs 12 bytes past end-of-buffer

=== CASE 3: 32-byte fw, claims 256-byte payload at offset 256 (passes validate, OOB read in every caller) (datasize=32) ===
  vanilla amdgpu_ucode_validate: PASS (rc=0)  <- bug: caller will deref OOB
  fixed    amdgpu_ucode_validate: REJECT (rc=-22)
  CALLER deref of hdr->ucode_size_bytes (off 20):
    in-bounds by luck
  CALLER memcpy(data+256, 256 bytes): end-of-copy=512, datasize=32 => OOB READ (crosses end of firmware)

=== CASE 4: well-formed 64-byte fw (baseline; both pass) (datasize=64) ===
  vanilla amdgpu_ucode_validate: PASS (rc=0)  <- bug: caller will deref OOB
  fixed    amdgpu_ucode_validate: pass (rc=0)
  CALLER deref of hdr->ucode_size_bytes (off 20):
    in-bounds by luck
  CALLER memcpy(data+32, 32 bytes): end-of-copy=64, datasize=64 => in-bounds

=== CASE 5: 32-byte fw with wrap-around offset+size (vanilla accepts, fixed rejects) (datasize=32) ===
  vanilla amdgpu_ucode_validate: PASS (rc=0)  <- bug: caller will deref OOB
  fixed    amdgpu_ucode_validate: REJECT (rc=-22)
  CALLER deref of hdr->ucode_size_bytes (off 20):
    in-bounds by luck
  CALLER memcpy(data+4294967040, 256 bytes): end-of-copy=4294967296, datasize=32 => OOB READ (crosses end of firmware)