32-bit integer overflow in DMA copy size (num_gpu_pages << 12) silently truncates copy

Summary

rv770_copy_dma computes copy length as (num_gpu_pages << RADEON_GPU_PAGE_SHIFT) where num_gpu_pages is 32-bit unsigned and shift performed in 32-bit arithmetic. For num_gpu_pages >= 2^20 (>=4 GiB buffer) shift wraps mod 2^32 producing small size_in_dw. DMA engine copies only tiny fraction of requested data while emitted fence signals success. TTM buffer-move layer (radeon_move_blit) completes move believing full copy happened leaving destination populated with stale/uninitialized GPU memory. Byte-for-byte same defect as evergreen_dma.c:121 (DF-2167) and same class as si_dma.c:246 (DF-2091). Hardware-constrained trigger: r7xx-class GPUs (Radeon HD 4000) ship with small VRAM (256MB-1GB) and GTT aperture usually well under 4GB so single BO >=4GB hard to construct on real rv770 hardware. Attacker: unprivileged local user with radeon DRM render/primary node. Impact: silent GPU-memory data corruption integrity. No kernel host-memory corruption no info leak. Ring buffer safe: radeon_ring_alloc rejects oversized radeon_ring_write wraps wptr &= ptr_mask. Lock protocol balanced.