agp_mmap off-by-one allows mapping one physical page past the AGP aperture BAR

Summary

mmap bounds check at :860 uses > instead of >= allowing ap->a_offset exactly equal to aperture size to pass. Maps physical page immediately following AGP aperture BAR into caller address space potentially exposing adjacent PCI device MMIO registers or system RAM. When a_offset==AGP_GET_APERTURE(dev) check size>size is false execution continues. Line 862 computes aperture_base+aperture_size first byte past BAR. At securelevel>=1 where /dev/mem restricted provides narrow one-page physical memory read/write primitive.