drm_radeon_cmd_buffer_t * cmdbuf, 
drm_radeon_kcmd_buffer_t * cmdbuf, 
static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t * dev_priv,					       drm_radeon_cmd_buffer_t * cmdbuf,					       u32 header){	int count, i, k;#define MAX_ARRAY_PACKET  64	u32 payload[MAX_ARRAY_PACKET];	u32 narrays;	RING_LOCALS;	count = (header >> 16) & 0x3fff;	if ((count + 1) > MAX_ARRAY_PACKET) {		DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",			  count);		return DRM_ERR(EINVAL);	}	memset(payload, 0, MAX_ARRAY_PACKET * 4);	memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4);	/* carefully check packet contents */	narrays = payload[0];	k = 0;	i = 1;	while ((k < narrays) && (i < (count + 1))) {		i++;		/* skip attribute field */		if (r300_check_offset(dev_priv, payload[i])) {			DRM_ERROR			    ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",			     k, i);			return DRM_ERR(EINVAL);		}		k++;		i++;		if (k == narrays)			break;		/* have one more to process, they come in pairs */		if (r300_check_offset(dev_priv, payload[i])) {			DRM_ERROR			    ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",			     k, i);			return DRM_ERR(EINVAL);		}		k++;		i++;	}	/* do the counts match what we expect ? */	if ((k != narrays) || (i != (count + 1))) {		DRM_ERROR		    ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n",		     k, i, narrays, count + 1);		return DRM_ERR(EINVAL);	}	/* all clear, output packet */	BEGIN_RING(count + 2);	OUT_RING(header);	OUT_RING_TABLE(payload, count + 1);	ADVANCE_RING();	cmdbuf->buf += (count + 2) * 4;	cmdbuf->bufsz -= (count + 2) * 4;	return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/b3a83639895a422b25f72eec0a5d1d88c3ac4e9e/r300_cmdbuf.c/buggy/drivers/char/drm/r300_cmdbuf.c