# DF-2398 - agp bind aperture check integer wrap

## Rig (agp_shim.c: VERBATIM agp.c compiled into ACHARNESS with
`device agp` removed; fabricated 64MB-aperture chipset implementing the
real agp_if methods; VM page accessors interposed)
- control: agp_generic_bind_memory(dev, mem, 0x8000000)  -> EINVAL, 0 calls
- wrap:    agp_generic_bind_memory(dev, mem, 0xfffffffffffff000)
           -> PASSES the check (offset+size wraps to 0), chipset
              bind_page invoked at 0xfffffffffffff000

## Baseline (run.log)
```
control bind offset=2x aperture -> error=22 bind_calls=0
WRAP bind offset=0xfffffffffffff000 am_size=0x1000 -> error=0 bind_calls=1
   bind range=[0xfffffffffffff000..0xfffffffffffff000] aperture=0x4000000
VERDICT: BUG REPRODUCED
```

## Fixed kernel (fix.diff: subtractive bounds form)
```
WRAP bind offset=0xfffffffffffff000 -> error=22 bind_calls=0
```