# DF-2310 — I2CRDWR unchecked copyin sends uninitialized kernel heap to the I2C device

## What (sys/bus/iicbus/iic.c:357-363, 366-371)
`copyin(usrbufs[i], m->buf, m->len)` at :362 (write-direction messages) and
`copyout(m->buf, usrbufs[i], m->len)` at :369 (read-direction) both ignore
their return values.  `m->buf` is a fresh `kmalloc(m->len, M_TEMP, M_WAITOK)`
with **no M_ZERO** (:360): a failed copyin leaves stale kernel heap in the
buffer and `iicbus_transfer` (:364) clocks it out to the peripheral; a
failed copyout silently drops read data.

## Rig
Production iic.ko/iicbus.ko/iicbb.ko on the fakebb3 harness (DF-5539
family; disclosed setup patches DF-5559/5560 make /dev/iic0 reachable —
the I2CRDWR logic under test stays stock).  The harness emulates a wired
I2C slave that CAPTURES every byte the master transmits
(hw.fakebb3.dumprx).  groom5558.ko provides the deterministic M_TEMP
heap groom (marker "DF5558STALEHEAP!" + kernel-realm pointer qwords).

## Reproduce (guest, root)
    sh rigup.sh            # patches (disclosed setup), modules, groom, PoCs
    ./poc2310

## Result (run.log)
* CONTROL (valid buf): slave captures exactly the submitted 0x40..0x5f.
* ATTACK (buf = 0xffffffff00000000 after groom): ioctl returns SUCCESS
  (copyin EFAULT swallowed) and the wire capture is
  `ffffffffffffffff 414c454845415021 01000000 00000000 20000000 5a5a5a5a`
  — the groom marker remnant + kernel-realm pointer qword: stale kernel
  heap disclosed onto the I2C bus.

## Fix
fix.diff: propagate the copyin error (skip the transfer), report copyout
failures, free exactly nalloc buffers, and zero-allocate per-message
buffers.  Validated on the fix kernel: EFAULT returned, transfer skipped,
wire capture empty.