fw_image_size=4096, IOC ImageSize=1073741824, IOC NextImageHeaderOffset=0xfffff000
UNFIXED KERNEL: walks 1073741824 bytes from a 4096-byte buffer -> OOB read
reading ext header at fw_image+0xfffff000 ...
Bus error (core dumped)
trigger rc=138 (139==SIGSEGV wild-read demonstrated)