# DF-4832 — radeon UVD v1.0 VCPU cache windows overrun vcpu_bo by 128 bytes

**File:** `sys/dev/drm/radeon/uvd_v1_0.c:121-135` (vs bo sizing in `sys/dev/drm/radeon/radeon_uvd.c:184-186`)
**Severity:** Low (GPU-scope VRAM overhang only) · **Bucket:** memcorrupt (radeon twin of DF-4524 / DF-4742)

## What to run

```
python3 check_arith.py        # -> arith.log (same content)
```

No kernel build or hardware needed for the arithmetic; the runtime effect needs
an R600-class or RV770 ASIC with UVD + its firmware, which this guest does not
have (see `env.txt`).

## Expected output (decisive lines)

```
exhaustive ds in [1,4095] (one full mod-4096 cycle):
  overrun bytes: min=128 max=128 ; vulnerable residues: 4088/4096 (99.8%)
  vulnerable residues are exactly ds % 4096 in [1,4088]: True
  safe residues (ds % 4096 == 0 or in [4089,4095]): True
control (uvd_v2_2 non-RV770): span<=bo for ALL residues: True
```

i.e. for every legacy UVD firmware whose `datasize % 4096` lands in
[1,4088] (99.8% of possible sizes, including all realistic blob sizes), the
STACK/SESSION window programmed into the UVD VCPU ends exactly **128 bytes past
the end of `rdev->uvd.vcpu_bo`** — inside the next VRAM object.

## Reproduce on hardware (not possible here)

1. Bare metal (or GPU-passthrough VM) with an R600/RV610/RV630/RV670/RV620/
   RV635/RS780/RS880 or RV770 GPU (radeonkms driver, `radeonkmsfw_R600_uvd` /
   `RS780` / `RV770` firmware loaded).
2. Trigger UVD use (any VDPAU/video decode via CS on the UVD ring).
3. Observe the last 128 bytes of the session/stack region (VRAM addresses
   `gpu_addr + 128 + ALIGN(ds) + HEAP + STACK + SESSION*N - 128 .. +0`) landing
   in the VRAM object allocated after `vcpu_bo` — GPU-side read/write of that
   neighbor object's head.