== DF-3592 scenario A: WRITE_DATA pkt->count=0 -> (count - 2) underflow spin ==
  WRITE_DATA register walk: count=0 -> loop bound (pkt->count - 2) = 4294967294
FIXED: unsigned-safe walk bound -> 0 iterations (no spin)
Packet0 not allowed!
	0xc0003700
	0x00000000
	0x0000a000 <---
	0x00000000
  scenario A parse ret=-1

== DF-3592 scenario B: trailing TYPE3 COND_WRITE header, length_dw=1 ==
  ib->length_dw=1, header=0xc0004500 (type3, count=0, COND_WRITE)
  gfx_check entry reads ib[1]; COND_WRITE reads ib[6] (si.c:4595) — both past the 4-byte allocation
FIXED: packet (idx 0, count 0) exceeds ib length 1 — rejected
	0xc0004500 <---
FIXED build: scenario B parse ret=-1 (rejected before any handler read)
fixed_exit=0