DF-5522 baseline (stock iicsmb.ko): SMB_BWRITE/SMB_BREAD wire capture
======================================================================
#/root/df5521_poc proto
poc: SMB_BWRITE(5 bytes) -> 0 (wire should be [cmd 07][count 05][de ad be ef 99])
poc: SMB_BREAD#0 -> 0 asked rcount=16 got rcount=0 rbuf=
...(#1..#5 identical)
poc: proto done

#dmesg | grep df5521-wire (BWRITE):
df5521-wire: START slave=0x5a WRITE
df5521-wire: WRITE len=1 bytes: 07          <-- command byte
df5521-wire: WRITE len=5 bytes: de ad be ef 99   <-- data IMMEDIATELY after cmd:
                                               NO count byte (0x05) on the wire
df5521-wire: STOP

SMBus 2.0 Block Write = [addr/W][cmd][COUNT][data...]; every other in-tree
smbus controller driver transmits the count (ichsmb writes ICH_D0=count and
DMA-includes it, ichsmb.c bwrite; intpm/amdsmb likewise). The iicsmb bridge
omits it: every Block Write through this bridge is malformed on the wire.

Block Read side: the bridge never consumes the device's count byte either --
it transfers exactly *count raw bytes (see the DF-5523 logs for the length
source). A spec-compliant slave (the rig's) sends [count][data...]; callers
receive the count byte shifted into data[0] and a transfer length unrelated
to the device's block length.