datasize ds%%4096 | bo_size      v1_span       overrun | v2_2 (ctrl)
exhaustive ds in [1,4095] (one full mod-4096 cycle):
  overrun bytes: min=128 max=128 ; vulnerable residues: 4088/4096 (99.8%)
  vulnerable residues are exactly ds % 4096 in [1,4088]: True
  safe residues (ds % 4096 == 0 or in [4089,4095]): True

representative datasizes (real legacy R600/RV770 UVD blobs are
arbitrary-sized; linux-firmware R600_uvd.bin-class sizes shown):
  ds=0x7dc9   (%4096=3529): bo=1011712 span=1011840 -> +128 B OVERRUN
  ds=0x9a44   (%4096=2628): bo=1019904 span=1020032 -> +128 B OVERRUN
  ds=0xc000   (%4096=   0): bo=1032192 span=1028224 -> -3968 B fits
  ds=0xc080   (%4096= 128): bo=1032192 span=1032320 -> +128 B OVERRUN
  ds=0x1b040  (%4096=  64): bo=1093632 span=1093760 -> +128 B OVERRUN

control (uvd_v2_2 non-RV770): span<=bo for ALL residues: True
cross-note (uvd_v4_2 w/ header, out of this file's scope): overrun residues exist: True

worked example ds=0x9A44 (ds%4096=2628 in [1,4088]):
  vcpu_bo            = [gpu,             gpu+1019904)
  VCPU CACHE windows = [gpu+128,         gpu+1020032)
  -> last 128 bytes of the STACK/SESSION window lie past the end of
     vcpu_bo, i.e. inside the next VRAM object allocated after it.
post-fix check: fixed span == bo_size for every ds in [0,0x2FFFF]: True (0 mismatches)