fw_version capacity : 32 bytes (all non-NUL from device)
strlen() walked     : 87 bytes  (+55 past the buffer)
RESULT: strlen OOB confirmed; kernel copies len+1 bytes (incl. adjacent softc fields) to userspace
T6_EXIT=0