Secure boot bypass via underflowed range checks

Integer underflow in Renesas R-Car Gen3 arm-trusted-firmware allows local users to write outside permitted memory while loading images. The check_load_area function in drivers/renesas/common/io/io_rcar.c subtracts an attacker-controlled image length from range endpoints without first ensuring the length does not exceed them, so unsigned wraparound can validate a prohibited destination. Exploitation requires the ability to write the bootloader's flash area and can bypass secure boot by loading image data at an arbitrary memory address.