DF-5523 fixed (bridge validates *count in [1,32]; smb.c seeds bcount)
=====================================================================
#/root/df5521_poc proto   (fix.diff: `if (*count < 1 || *count > 32)
#                          return (SMB_EINVAL);` at both bridge entry
#                          points + `bcount = s->rcount;` in smbioctl)
poc: SMB_BREAD#0 -> 0 asked rcount=16 got rcount=8 rbuf=a0 a1 a2 a3 a4 a5 a6 a7
(6/6 identical -- DETERMINISTIC, no stack-state dependence)
#dmesg:
df5521-wire: READ req_len=1  <== bridge *count      <- seeded bcount path
df5521-wire: READ req_len=8  <== bridge *count      <- device count honored
=> the transfer length is now derived from initialized state (the ioctl's
   rcount) and bounded by the SMBus block limit; an out-of-range count
   (garbage 0 or >32, as observed in the baseline) is rejected with
   SMB_EINVAL before any wire traffic.