r100_cs_parse_packet0() off-by-one: '> n' boundary check permits auth[n] read one u32 past the const reg_safe_bm arrays

Summary

The safe-register bitmap guards use '(x >> 7) > n' but auth[] has exactly n entries (102 words each for r100/r200), so a PACKET0 whose register range ends on a 128-byte map boundary (end>>7 == n) lets the loop read auth[n] - one u32 past the const array. 4-byte OOB read of adjacent kernel rodata used only for an internal allow/deny decision; out-of-map registers hitting a set garbage bit still fall to the default -EINVAL, so no direct impact - hardening only. Identical upstream. Verification skipped per contract (Info).