# DF-5458 PoC — ichsmb_bread's count contract is broken in both directions; /dev/smb passes an uninitialized stack byte

## Root cause

- `ichsmb_bread()` (ichsmb.c:416-461) treats `*count` as INPUT (validated
  1..32 at ichsmb.c:424 and transmitted to the device as the expected block
  count in ICH_D0 at ichsmb.c:436 `/* XXX? */`) and as OUTPUT (overwritten
  with the received count at :441).
- The only userland caller, smbioctl SMB_BREAD (smb.c:318-330), passes
  `u_char bcount;` declared **uninitialized** (smb.c:217) — ichsmb_bread
  validates and transmits stale kernel stack garbage.
- Observable effects: SMB_BREAD fails with EINVAL whenever the stale byte is
  0 or >32 (on this rig: deterministically, i.e. the block-read interface is
  dead), and when it happens to pass the gate, a garbage "expected count" is
  written to the ICH_D0 device register.

## Live result (q35 rig, QEMU smbus-ipmi BMC at 0x20 answering real SSIF traffic)

```
BWRITE cmd=2 (SSIF req)            rc= 0      <- block-write path fully works
BREAD  cmd=3 (SSIF rsp)            rc=-1 errno=22 (EINVAL)   <- every time
... 12 further BREAD attempts, stack-dirtying syscalls in between: all EINVAL
```
The BMC is present and answering (BWRITE succeeds; the fixed module below
reads real IPMI data through the identical path), proving the EINVAL comes
from the uninitialized count gate, not from the bus.

## Fix validation (same run as DF-5459's pack)

fix.diff: initialize `bcount = 32` in smb.c and make ichsmb_bread clamp an
invalid input instead of rejecting it (`expect = (*count >= 1 && *count <= 32)
? *count : 32`). With the patched modules, on the identical rig:

```
BREAD  cmd=3 (SSIF rsp)            rc= 0 errno=0 rcount=3 data=06 18 00 ...
fresh-process BREAD x3             rc= 0 ... (every attempt)
BREAD slave=0x50 cmd=1 (DDC)       rc=-1 errno=35 (clean timeout error, no garbage gate)
```
i.e. the interface goes from deterministically-broken to working.

## Build & run

```
guest: cc -O0 -o /root/df5457_poc /root/df5457_poc.c
vm.sh run_root 'kldload ichsmb && kldload smb && /root/df5457_poc dev && /root/df5457_poc uninit'
```