DF-5522 fixed (patched iicsmb.ko): count byte on the wire / consumed on read
============================================================================
#/root/df5521_poc proto   (after fix.diff: bwrite sends count byte; bread
#                          reads the device count byte first, clamps to the
#                          caller's count, then reads exactly that many bytes)
poc: SMB_BWRITE(5 bytes) -> 0 (wire should be [cmd 07][count 05][de ad be ef 99])
poc: SMB_BREAD#0 -> 0 asked rcount=16 got rcount=8 rbuf=a0 a1 a2 a3 a4 a5 a6 a7
...(#1..#5 identical -- deterministic)

#dmesg | grep df5521-wire (BWRITE):
df5521-wire: WRITE len=1 bytes: 07          <-- command byte
df5521-wire: WRITE len=1 bytes: 05          <-- COUNT BYTE NOW ON THE WIRE
df5521-wire: WRITE len=5 bytes: de ad be ef 99
df5521-wire: STOP

#dmesg (BREAD):
df5521-wire: START slave=0x5a WRITE
df5521-wire: WRITE len=1 bytes: 07
df5521-wire: REPEATED_START slave=0x5b READ
df5521-wire: READ req_len=1  <== bridge *count     <-- consumes the count byte
df5521-wire: READ gave 1 bytes: 08 ...
df5521-wire: READ req_len=8  <== bridge *count     <-- device's block count (8)
df5521-wire: READ gave 8 bytes: a0 a1 a2 a3 ...
df5521-wire: STOP
=> rcount=8, rbuf=a0 a1 a2 a3 a4 a5 a6 a7: unshifted data, device-declared
   length honored (rig slave offers [08][a0..a7] as a spec-compliant slave).