Firmware header fields used as array indices without bounds checks (heap OOB read/write via corrupted ucode)

Summary

Multiple CIK firmware-loading routines dereference internal offset/size fields (ucode_array_offset_bytes, ucode_size_bytes, io_debug_size_bytes, io_debug_array_offset_bytes, jt_offset, jt_size) from firmware headers without validating against fw->datasize. radeon_ucode_validate only checks hdr->size_bytes==fw->datasize, no inner offset bounds. cik_init_cp_pg_table (cik.c:6437-6519): for each ME, table_offset=jt_offset and table_size=jt_size from per-engine header, then loop for(i=0;i<table_size;i++) dst_ptr[bo_offset+i]=fw_data[table_offset+i] writes past cp_table BO (67584 bytes) and reads past firmware buffer if jt_size/jt_offset corrupted. Same pattern in ci_mc_load_microcode (1873/1876), cik_cp_gfx_load_microcode (3936), cik_cp_compute_load_microcode (4292), cik_rlc_resume (5974). Requires root to install corrupted firmware (privileged-only file), so defense-in-depth not escalation. Fix: bounds-check all firmware-derived offsets/sizes against fw->datasize in radeon_ucode_validate or inline at each loader.