DF-4927 radeon_sa fence-borrow UAF - FIXED (upstream 0381ac3ca2e7 guard applied) mode
scenario: X[0,1024)GFX/F-pending  A[1024,2048)DMA/sig  B[2048,3072)DMA/sig  Z[3072,4096)DMA/pending; request 3500B
sa_bo_new(3500, 256):
    [fence F2 refcount 0 -> kfree]
    [fence F3 refcount 0 -> kfree]
    [fence F1 refcount 0 -> kfree]
radeon_sa_bo_new -> -513 (would block/fail)

===== RESULT =====
UAF fence_ref     (sa.c:352-353): 0
UAF fence_wait    (sa.c:356)    : 0
double fence_free (sa.c:357-358): 0
VERDICT: clean - no dangling fence dereference
fixed exit=0