# DF-5522 — iicsmb block read/write omit the SMBus count byte in both directions: every Block Write is malformed on the wire and every Block Read returns one-byte-shifted data

## Files

Same rig/PoC as DF-5521 (shared evidence pack artifacts copied here for
self-containment):

  df5521_rig.c     software iicbus controller; the emulated slave is
                   SPEC-COMPLIANT: within one transaction its byte stream is
                   [count][data...] and it continues across reads
  df5521_poc.c     `proto` mode drives SMB_BWRITE + SMB_BREAD on /dev/smb0
  run.baseline.log stock-module wire capture (no count byte; shifted data)
  run.fixed.log    patched-module wire capture (count byte present/consumed)
  fix.diff         the count-byte fix (also carries the [1,32] validation
                   of DF-5523, which the rewritten bread needs anyway)

## Reproduce

1. build + load chain (see build.sh / load_chain.sh; same as DF-5521)
2. `/root/df5521_poc proto`
3. compare `dmesg | grep df5521-wire` with the two logs here.

Baseline: `WRITE len=1 bytes: 07` is followed directly by
`WRITE len=5 bytes: de ad be ef 99` — **no count byte**.  SMBus 2.0 Block
Write is `[addr/W][cmd][count][data...]`; ichsmb/intpm/amdsmb all transmit
the count (ichsmb: `bus_write_1(sc->io_res, ICH_D0, count)`).  On read the
bridge never consumes the slave's count byte: it transfers `*count` raw
bytes, so a compliant slave's count byte lands in the caller's `data[0]`
and every reply is mis-parsed one byte to the right.