DF-1020: fw_bus_explore_callback OOB csrrom write
  CSRROMOFF:  0x400
  CSRROMSIZE: 0x400
  csrrom[]:   256 entries (u_int32_t)
  ongoaddr:   16-bit bitfield (firewirereg.h:109)

  Normal exploration (first 4 entries):
    csrrom[0] at ongoaddr=0x400 — OK
    csrrom[1] at ongoaddr=0x404 — OK
    csrrom[2] at ongoaddr=0x408 — OK
    csrrom[3] at ongoaddr=0x40C — OK

  Malicious device sends key=0x81 (CROM_UDIR), val=0x3FFF:
    csrreg->val = 0x3FFF (24-bit, device-controlled)
    ongoaddr += val*4 = 0x410 + 0xFFFC = 0x1040C
    After 16-bit truncation: ongoaddr = 0x40C

  Bounds check at :1558 is AFTER the write at :1500 — too late.
  No authentication needed: malicious FireWire device on the bus.