# DF-3697 — RLC v2_1 save-restore-list offset/size fields are never validated → wild-pointer memcpy (OOB kernel heap read)

## Where
* Parse: `sys/dev/drm/amd/amdgpu/gfx_v9_0.c:516-535` (`gfx_v9_0_init_rlc_ext_microcode`)
* Enable: `sys/dev/drm/amd/amdgpu/gfx_v9_0.c:670-673` (`is_rlc_v2_1` from header version 2.1) and caller `gfx_v9_0.c:715-716`
* Size accounting (PSP): `gfx_v9_0.c:776-797`
* Sink: `sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:381-394` (`amdgpu_ucode_init_single_fw`, `memcpy` from `adev->gfx.rlc.save_restore_list_*`), reached via `amdgpu_psp.c:428` (`amdgpu_ucode_init_bo`) on PSP-load devices (Vega10/VEGA12/Raven default).

## Reproduce
```
build.sh   # cc -O2 -o fwgen_rlc fwgen_craft_rlc.c   (ran on DragonFly 6.5-DEVELOPMENT guest, cc 8.3)
run.sh     # ./fwgen_rlc  -> amdgpufw_raven_rlc.evil (256 bytes)
```
Deploying the blob on real hardware: place as the RLC firmware file loaded by
the amdgpu driver (`amdgpufw_<asic>_rlc`, root-owned firmware path) and load
the driver with PSP firmware loading. This guest has **no AMD GPU**
(virtio-vga only), so the driver probe path cannot run here.

## Expected (on hardware)
* `gfx_v9_0_init_rlc_ext_microcode` stores `save_restore_list_cntl = fw->data + 0x10000`
  (fw buffer is 256 bytes → pointer ~64 KiB out of bounds).
* On PSP load, `memcpy(kaddr, save_restore_list_cntl, 0x1000)` copies 4 KiB of
  unrelated kernel heap into a GPU-mapped firmware BO; depending on what is
  mapped at `fw->data + 0x10000` this is a silent kernel-heap info leak into
  GPU-visible memory or an immediate page-fault panic.
* The destination BO is sized from the same attacker fields, so the *write*
  side is in-bounds — the primitive is an OOB read (plus DoS).

## Threat model
Attacker must control the RLC firmware image: root replacing the file in the
firmware directory, a compromised firmware distribution, or a MITM on an
unverified firmware channel. Same threat class as pass-1 findings DF-1176 /
DF-1177 / DF-1178 (all firmware-parsing, filed Medium).

## Fix
`fix.diff` — validate every v2_1 save-restore-list `offset + size` against
`fw->datasize` and fail `init_microcode` otherwise (function made fallible).