open(/dev/dri/card0): No such file or directory — no radeon DRM device on this machine; trigger is hardware-gated.

--- arithmetic simulation (same guest) ---
SET_RESOURCE: 6 buffer slots, idx=2, body_last=44, min IB length (with 6 trailing 2-dw NOP relocs) = 57

 slot | reads at (i*7)      | writes at (i*8)      | write lands in
------+---------------------+----------------------+---------------------------
    0 |   3..  9            |   3,   5             | own/later slot body (validated as data)
    1 |  10.. 16            |  11,  13             | own/later slot body (validated as data)
    2 |  17.. 23            |  19,  21             | own/later slot body (validated as data)
    3 |  24.. 30            |  27,  29             | own/later slot body (validated as data)
    4 |  31.. 37            |  35,  37             | own/later slot body (validated as data)
    5 |  38.. 44            |  43,  45             | trailing reloc NOP region

max write index = 45 < min IB length 57 -> writes stay inside the
IB, but clobber resource words the validator ALREADY checked with
different values (validated/executed desync) and reloc-NOP words.

DF-4030: offset=0xffffff00 size=0x00000100 -> (size+offset) as u32 = 0x00000000 -> bound check `(sum > bo_size)' PASSES (wrap) for bo_size >= 0x1000