Summary

amdgpu_amdkfd_device_init L127 int last_valid_bit uninitialized. L156-158 last_valid_bit=1*num_pipe_per_mec*num_queue_per_pipe both u32 RHS u32 assigned signed int; if bit 31 set last_valid_bit negative. L159-160 for(i=last_valid_bit;i<KGD_MAX_QUEUES;++i) clear_bit(i,gpu_resources.queue_bitmap). DragonFly clear_bit bitops.h:308-309 ((volatile long*)(a))[(i)/NBLONG] negative array index on stack bitmap -> OOB write into kernel stack. Trigger: GPU MEC reports bogus num_pipe/num_queue product with bit 31 set (malicious PCIe device/firmware regression). Realistic values tiny (4*8=32). LATENT: CONFIG_HSA_AMD not defined adev->kfd NULL body at L129 never runs. Fix: clamp last_valid_bit to [0,KGD_MAX_QUEUES) unsigned int.