# DF-3598 — gfx_v8_0_init_microcode ignores amdgpu_ucode_validate() result for the RLC firmware

## What

gfx_v8_0.c:1082 assigns `err = amdgpu_ucode_validate(adev->gfx.rlc_fw);` and
**never checks it** — unlike every other firmware in the same function:

| fw  | validate        | checked at |
|-----|-----------------|------------|
| pfp | gfx_v8_0.c:1019 | :1020 `if (err) goto out;` |
| me  | gfx_v8_0.c:1039 | :1040 |
| ce  | gfx_v8_0.c:1060 | :1061 |
| rlc | gfx_v8_0.c:1082 | **(none)** |
| mec | gfx_v8_0.c:1140 | :1141 |
| mec2| gfx_v8_0.c:1161 | :1162 |

With a wrong-sized RLC image the function falls through and immediately
parses `rlc_firmware_header_v2_0` fields at :1083-1104 (`ucode_version`,
`save_and_restore_offset`, `reg_list_format_size_bytes`,
`reg_list_format_array_offset_bytes`, …) and then performs the
`kmalloc`+copy loops at :1106-1125 on completely unvalidated data.

Two consequences:

1. A firmware file smaller than `sizeof(struct rlc_firmware_header_v2_0)`
   (0x50 bytes, amdgpu_ucode.h:79-99) makes the header field reads themselves
   out-of-bounds reads of the firmware buffer.
2. The (weak but only) consistency gate — `fw->datasize ==
   hdr->size_bytes` — being skipped means garbage sizes/offsets flow
   straight into the DF-1133 register-list copy loops and into
   `amdgpu_ucode_init_bo`'s `fw_size` accounting (:1197-1209).

This mirrors the DF-3573/DF-3591 "size-gate-symmetry" lesson from the
si_dpm/cik passes: a size gate that is asymmetrically enforced lets a bogus
firmware through to bounded-wrong consumers.

## Reachability / threat model

Driver load on any VI asic with a corrupted/mismatched
`amdgpufw_<asic>_rlc` (root-replaceable firmware module) — no other
precondition. Composes with DF-1133 (High) and DF-1946/DF-1947
(amdgpu_ucode.c) — this missing check is the local gate those findings
assume.

## Reproduce (source assertion)

```
./run.sh     # prints the five validate sites and shows the rlc one has no guard
```
Kernel-side execution requires AMD hardware (audit guest is virtio-only) —
verdict `inconclusive` at runtime, `certain` at source level.

## Fix

`fix.diff`: add `if (err) goto out;` after gfx_v8_0.c:1082, symmetric with
the other five loaders.