===== BASELINE (vulnerable, verbatim smu7_smumgr.c:461-500) =====
== DF-4774 verbatim harness: smu7_smumgr.c:461-500 / amdgpu_cgs.c:437-472 ==

[1] legit header (off=0x400, size=0x800, blob=0x1000): baseline sanity
  upload result          : 0
  dwords streamed        : 512
  OOB-window SMC writes  : 0
  canary hits in sink    : 0 (expect 0)
  child exit             : 0

[2] adjacent-leak: off = end of blob (into canary page), size=0x1000
  upload result            : 0 (0 == success, firmware 'uploaded')
  dwords streamed to SMC   : 1024
  canary bytes in SMC sink : 1024
  sink sample (first 8 dwords): cc000000 cc000001 cc000002 cc000003 cc000004 cc000005 cc000006 cc000007
  ADJACENT-OOB-READ CONFIRMED (canary bytes reached SMC SRAM sink)

[3] far-wild base: off = 0x40000000 (1 GB past blob), size = 0x20000 (max the limit gate allows)
  child killed by SIGSEGV -> kernel panic equivalent (wild kernel read)

[4] u32 near-wrap base: off = 0xFFFFF000, size = 0x1000
  child killed by SIGSEGV -> wild read ~4 GB past the firmware blob

[5] the ONLY gate: size just above SMU7_SMC_SIZE is rejected, size below is not
SMC address is beyond the SMC RAM area.
  upload result for size>0x20000 with wild base: -22 (rejected by length gate only)
  child exit             : 0

== summary ==
craft SMC fw file (root-placed) with size_bytes==filesize, ucode_array_offset_bytes
pointing past the allocation, ucode_size_bytes<=0x20000 -> kernel reads OOB.
baseline exit: 0

===== PATCHED TWIN (fix.diff bound check in amdgpu_cgs.c construction) =====
== DF-4774 verbatim harness: smu7_smumgr.c:461-500 / amdgpu_cgs.c:437-472 ==

[1] legit header (off=0x400, size=0x800, blob=0x1000): baseline sanity
  upload result          : 0
  dwords streamed        : 512
  OOB-window SMC writes  : 0
  canary hits in sink    : 0 (expect 0)
  child exit             : 0

[2] adjacent-leak: off = end of blob (into canary page), size=0x1000
[cgs] FIX: SMU firmware header offset/size out of blob bounds -> -EINVAL
  upload result            : 0 (0 == success, firmware 'uploaded')
  dwords streamed to SMC   : 0
  canary bytes in SMC sink : 0
  sink sample (first 8 dwords):
  FIX VALIDATED: upload rejected / no canary bytes reached the sink

[3] far-wild base: off = 0x40000000 (1 GB past blob), size = 0x20000 (max the limit gate allows)
[cgs] FIX: SMU firmware header offset/size out of blob bounds -> -EINVAL
  FIX VALIDATED: wild-base upload rejected before any read (no fault)

[4] u32 near-wrap base: off = 0xFFFFF000, size = 0x1000
[cgs] FIX: SMU firmware header offset/size out of blob bounds -> -EINVAL
  FIX VALIDATED: near-wrap base rejected before any read

[5] the ONLY gate: size just above SMU7_SMC_SIZE is rejected, size below is not
[cgs] FIX: SMU firmware header offset/size out of blob bounds -> -EINVAL
  upload result for size>0x20000 with wild base: 0 (rejected by length gate only)
  child exit             : 0

== summary ==
craft SMC fw file (root-placed) with size_bytes==filesize, ucode_array_offset_bytes
pointing past the allocation, ucode_size_bytes<=0x20000 -> kernel reads OOB.
patched exit: 0