== DF-4405: amdgpu_uvd fw-header arithmetic replica ==

firmware blob datasize        = 0x8000
hdr->size_bytes               = 0x8000
amdgpu_ucode_validate()       = 0 (0 == ACCEPTED)

hdr->ucode_array_offset_bytes = 0x1000
hdr->ucode_size_bytes         = 0xfffffff8

[sw_init ] bo_size += AMDGPU_GPU_PAGE_ALIGN(ucode_size_bytes + 8)
          u32 add first: 0xFFFFFFF8 + 8 = 0x0  (wraps to 0)
          PAGE_ALIGN(0) = 0x0
          => bo_size = 0x72000 (200K+256K): allocated WITHOUT any firmware space

[resume  ] memcpy_toio(cpu_addr, fw->data + 0x1000, 0xfffffff8)
          kernel reads 0xfffffff8 (4.00 GiB) bytes starting 0x1000 into a 0x8000-byte blob
          OOB READ  = 0xfffffff8 - (0x8000 - 0x1000) = 4294938616 bytes past the firmware buffer

          then 'size -= ucode_size_bytes': 0x72000 - 0xfffffff8 -> 0x72008 (u32 underflow)
          memset_io(ptr, 0, 0x72008): 8 bytes past the 0x72000-byte bo end

Both lengths derive solely from unvalidated header fields; the only gate, amdgpu_ucode_validate(), checked a different field (size_bytes). Preconditions: attacker-controlled firmware file (root-installed, /boot/modules/amdgpufw_*_uvd) on AMD hardware -> Low severity, DF-1946 family instance in amdgpu_uvd.c.
EXIT=0