# DF-4863: this finding's trigger is scenario [4] of the DF-4862 harness run
# (same binary; baseline section then patched-twin section)
================ BASELINE (unmodified verbatim functions) ================
DF-4862 harness: amdgpu_cgs.c:234-235 CP_MEC image_size = jt_offset<<2 (unvalidated)

[1] MEC header: jt_offset=0x300 dwords, jt_size=0x100 dwords
  amdgpu_ucode_validate(mec.bin): PASS (datasize==size_bytes only)
  staging: kernel-side OOB reads during init_bo/patch_jt: 0 bytes (fully in-bounds)
  TOC entry[0]: id=7 data_size_byte=0xc00 (3072) image_addr=0x100003000
  SMU DMA: src=0x100003000 size=0xc00 (3072 bytes)  staged MEC window=[0x100003000,0x100005000)
  SMU DMA: 3072 bytes in-bounds, 0 bytes BEYOND the staged window
  RESULT: legit header -> fully in-bounds (no false positive)

[2] MEC header: jt_offset=0x4000 dwords, jt_size=0x100 dwords
  amdgpu_ucode_validate(mec.bin): PASS (datasize==size_bytes only)
  staging: kernel-side OOB reads during init_bo/patch_jt: 0 bytes (fully in-bounds)
  TOC entry[0]: id=7 data_size_byte=0x10000 (65536) image_addr=0x100003000
  SMU DMA: src=0x100003000 size=0x10000 (65536 bytes)  staged MEC window=[0x100003000,0x100005000)
  SMU DMA: 8192 bytes in-bounds, 57344 bytes BEYOND the staged window (hit UNMAPPED GPU page at +0x13000 -> GPU page fault / SMU hang)
  RESULT: SMU-SIDE OOB DMA READ CONFIRMED: 57344 bytes beyond the staged fw_buf window + unmapped-page fault class

[3] jt_offset=0x3F000000 (image_size wraps to ~4GB)
[3] child killed by SIGSEGV (11) — kernel panic class via patch_jt wild source (DF-1947 overlap); cgs image_size=0xfc000000

[4] fw_type_convert default -> AMDGPU_UCODE_ID_MAXIMUM one-past-end
  &firmware.ucode[MAXIMUM].fw = 0x403758  == &firmware.fw_buf = 0x403758  : ALIAS CONFIRMED
DRM_ERROR: Firmware type not supported
  cgs_get_firmware_info(CGS_UCODE_ID_GMCON_RENG) = 0
  type-confused header=bo+8 -> image_size=0x5a5a5a5a version=0x5a5a propagated to caller (wild deref on real hw: ttm_buffer_object internals as firmware*)

DONE
baseline exit: 0

================ PATCHED TWIN (fix.diff applied at construction) =========
DF-4862 harness: amdgpu_cgs.c:234-235 CP_MEC image_size = jt_offset<<2 (unvalidated)

[1] MEC header: jt_offset=0x300 dwords, jt_size=0x100 dwords
  amdgpu_ucode_validate(mec.bin): PASS (datasize==size_bytes only)
  staging: kernel-side OOB reads during init_bo/patch_jt: 0 bytes (fully in-bounds)
  TOC entry[0]: id=7 data_size_byte=0xc00 (3072) image_addr=0x100003000
  SMU DMA: src=0x100003000 size=0xc00 (3072 bytes)  staged MEC window=[0x100003000,0x100005000)
  SMU DMA: 3072 bytes in-bounds, 0 bytes BEYOND the staged window
  RESULT: legit header -> fully in-bounds (no false positive)

[2] MEC header: jt_offset=0x4000 dwords, jt_size=0x100 dwords
  amdgpu_ucode_validate(mec.bin): PASS (datasize==size_bytes only)
  staging: kernel-side OOB reads during init_bo/patch_jt: 0 bytes (fully in-bounds)
DRM_ERROR: MEC jt payload window beyond ucode image
  populate CP_MEC entry: -22 (rejected at the cgs construction — FIX VALIDATED)

[3] jt_offset=0x3F000000 (image_size wraps to ~4GB)
[3] child killed by SIGSEGV (11) — kernel panic class via patch_jt wild source (DF-1947 overlap); cgs image_size=0xfc000000

[4] fw_type_convert default -> AMDGPU_UCODE_ID_MAXIMUM one-past-end
  &firmware.ucode[MAXIMUM].fw = 0x403758  == &firmware.fw_buf = 0x403758  : ALIAS CONFIRMED
DRM_ERROR: Firmware type not supported
  cgs_get_firmware_info(CGS_UCODE_ID_GMCON_RENG) = -22 (one-past-end index rejected — FIX VALIDATED)

DONE
patched exit: 0