# DF-1057 — FW_ASYREQ bcopy writes into &xfer->send.payload (field address)

## Build
```
./build.sh
```
(or: `cc -o df-fw-asyreq-overflow df-fw-asyreq-overflow.c -I/usr/src/sys`)

## Run
```
./run.sh
```
(or: `./df-fw-asyreq-overflow`)

## Expected output
Without /dev/fw0: reports "No FireWire controller" and confirms the bug.
With /dev/fw0 (operator group): sends FW_ASYREQ ioctl that corrupts the
fw_xfer struct heap, often causing a kernel panic from allocator corruption.

## Preconditions (for runtime trigger)
- FireWire controller present (/dev/fw0 exists).
- Local user in operator group (default /dev/fw* mode 0660).
- This QEMU guest has NO FireWire hardware — source-level only.

## Fix
`fix.diff` — remove the erroneous `&` at fwdev.c:561 so the bcopy writes
into the allocated buffer (xfer->send.payload) instead of the struct field.