DF-3838 — 32-bit wraparound family in the evergreen CS surface-size validator
(evergreen_cs_track_validate_{cb,stencil,depth,texture} + htile + streamout
tracking) -> validator bypass -> GPU out-of-bounds read/write past the BO
(cross-process GPU memory corruption).  High.

WHAT TO LOOK AT
  trigger.c   programs CB_COLOR0_SLICE = 0xffffffff with a valid colour
              format and a draw — on a vulnerable kernel the validator
              computes nby = ((0xffffffff+1)*64)/nbx == 0 in u32, derives
              layer_size 0, and accepts ANY (even 1-page) BO for the target,
              while the GPU honours SLICE_TILE_MAX = 0x3fff and renders
              16384 tiles past it.
  fix.diff    u64 math + HW-field masking for every wrap site.
  verdict.json  status inconclusive (no GPU on guest), source-level certain.

SITES (evergreen_cs.c)
  (slice+1) wrap, raw register stored at :1208/:1416/:1425:
    :404 cb  nby = ((slice + 1) * 64) / surf.nbx
    :571 stencil  (db_depth_slice raw)
    :668 depth    (db_depth_slice raw)
    -> nby=0 -> layer_size=0 -> offset check at :442/:616/:635/:714/:730
       trivially passes.
  u32 product wraps layer_size * mslice / * depth:
    :442, :616, :635, :714, :730, :846-848, :906-908
  `x << 8` computed in u32 (GPU address is 40-bit):
    :435 (cb_color_bo_offset), :610/:629 (stencil), :708/:724 (depth),
    :787-788 (texture toffset/moffset)
  htile `roundup(nbx * nby * 4, ...)` u32 product:
    :547
  streamout offsets wrapped BEFORE the u64 check at :948-950:
    :1278  vgt_strmout_bo_offset[tmp] = value << 8   (u32 shift)
    :1289  vgt_strmout_size[tmp]      = value * 4    (u32 mult)

BUILD   cc -O2 -o trigger trigger.c
RUN     ./trigger /dev/dri/card0
EXPECT  On real pre-SI radeon HW (evergreen/barts/turks/caicos/cayman), with
        the CB_COLOR0_BASE reloc pointing at a 1-page BO, the CS is ACCEPTED
        by the validator (no "cb[%d] bo too small" in dmesg) and the draw
        writes far past the BO.  On the audit QEMU guest: ENOENT.

FAMILY  DF-1340 (r600_cs.c, same class, High), DF-3765/DF-3766 (r100.c).
        Distinct from DF-1245 (pitch div-by-zero in the same expression).