User-controlled iconv charset names copied without null-termination — bounded kernel-stack OOB read via kprintf/strcasecmp

Summary

msdosfs_vfsops.c:116-117 memcpy(cs_local,argp->cs_local,31) memcpy(cs_dos,argp->cs_dos,31) — NO explicit null termination. argp from copyin raw user mount(2) no validation. :118 kprintf(%s,argp->cs_local,argp->cs_dos) scans past 31-byte arrays. :119-130 msdosfs_iconv->open() strcasecmp scans until null. Requires MSDOSFSMNT_KICONV flag + msdosfs_iconv kld. Bounded read of stack bytes adjacent to args struct. No write primitive no control-flow redirect. Fix: memcpy sizeof-1 + force NUL.