Kernel crash via unchecked Rocket buffer counts

Integer overflow in Linux 6.18 allows local users to trigger out-of-bounds kernel accesses through crafted Rocket job submissions. rocket_job_push() adds two user-controlled 32-bit buffer-object counts before allocation and then copies using the original counts; it also dereferences an unchecked allocation result. Access to the Rocket accelerator submission ioctl is required, and the documented consequences are a kernel NULL-pointer crash or out-of-bounds access rather than a demonstrated privilege gain.