# DF-2312 — I2CRDWR: unbounded nmsgs drives unbounded M_WAITOK allocations

## What (sys/bus/iicbus/iic.c:350-352)
d->nmsgs is a fully user-controlled u32 used directly as the multiplier
of kmalloc(16*nmsgs) and kmalloc(8*nmsgs), both M_WAITOK, with no upper
bound.

## Reproduce / Result (run.log + panic.txt)
* Phase A (nmsgs=262144): the kernel really performs the 4 MiB + 2 MiB
  allocations in one ioctl (temp +2 MiB retained per call via the
  DF-2309 usrbufs interaction proves the sizes).
* Phase B (nmsgs=134217728): kmalloc(2 GiB) -> `panic: temp: malloc
  limit exceeded`, backtrace malloc <- _kmalloc <- iicioctl.  One
  unvalidated u32 = one-syscall privileged kernel panic.

## Fix
fix.diff rejects nmsgs == 0 || nmsgs > 4096 with EINVAL.  Validated:
both phases return EINVAL, no allocation, no panic.