Integer truncation in fw_xfer_alloc_buf (int -> u_int16_t pay_len) -> length/buffer mismatch for len > 0xFFFF (latent)

Summary

fw_xfer_alloc_buf at firewire.c:956-957 xfer->send.pay_len=send_len where pay_len is u_int16_t (firewirereg.h:255) but send_len is int. kmalloc at :959/:966 uses original int -> buffer/length mismatch for len>0xFFFF. No in-tree caller in firewire.c triggers (max 8/4 bytes). fwdev.c FW_ASYREQ uses unsigned short req.len (max 65535) so also capped. Latent footgun for future callers; magnifier for fwdev.c bcopy typo. Fix: range check or widen pay_len.