DF-2312 unbounded I2CRDWR allocations (BUSAUDIT kernel, same rig)
====================================================================
PHASE A (moderate):
DF2312-A: nmsgs=262144 -> kmalloc(4194304) + kmalloc(2097152) M_WAITOK, no validation
DF2312-A: I2CRDWR rc=-1 errno=14 (Bad address) -- allocation was still attempted+performed first
vmstat -m | grep -w temp:      before: temp 471 2.33M ... / after 3 calls: temp 474 8.33M
  (+2 MiB leaked usrbufs per call [DF-2309 interaction], proving the full
   unbounded 6 MiB allocation pair really executed per single ioctl)

PHASE B (extreme, separate run -- panics):
DF2312-B: nmsgs=134217728 -> kmalloc(2147483648) (2.0 GiB) M_WAITOK -> expect kmem panic NOW
<guest died>
console:
panic: temp: malloc limit exceeded.
_kmalloc() at _kmalloc+0xb09
iicioctl() at iicioctl+0x217
dev_dioctl() at dev_dioctl+0xa3
...

One unvalidated u32 multiplied straight into a 2 GiB M_WAITOK kmalloc:
single-syscall kernel panic (privileged DoS), exactly as claimed.