# DF-1058 — fw_write trusts user-supplied stream packet header len

## Build
```
./build.sh
```
(or: `cc -o df-fw-write-overflow df-fw-write-overflow.c -I/usr/src/sys`)

## Run
```
./run.sh
```
(or: `./df-fw-write-overflow`)

## Expected output
Without /dev/fw0: reports "No FireWire controller" and confirms the bug.
With /dev/fw0 (operator group): sends a stream packet with len=0xffff into
a psize=8 slot, overflowing the DMA buffer into adjacent kernel heap.

## Preconditions (for runtime trigger)
- FireWire controller present (/dev/fw0 exists).
- Local user in operator group (default /dev/fw* mode 0660).
- This QEMU guest has NO FireWire hardware — source-level only.

## Fix
`fix.diff` — clamp fp->mode.stream.len to it->psize - sizeof(struct fw_isohdr)
after the first uiomove sets it from user data.