iconv_add() and iconv_register_cspair() accept unbounded charset names; iconv_sysctl_cslist() strcpy overflows 31-byte stack buffer

Summary

Exported kernel API iconv_add() (line 382) performs no length validation on charset-name strings. iconv_register_cspair() stores them verbatim arbitrary length in heap via strcpy lines 201/207. sysctl_add path DOES validate strlen>=ICONV_CSNMAXLEN(31) and rejects lines 412-415 but iconv_add has no equivalent check. iconv_sysctl_cslist (lines 368-369) does strcpy(csi.cs_to csp->cp_to) and strcpy(csi.cs_from csp->cp_from) where csi.cs_to/cs_from are char[ICONV_CSNMAXLEN]=char[31]. If csp->cp_to >= 31 bytes strcpy writes past csi into adjacent stack locals (cs_base cs_refcount cs_id cs_version saved frame pointer return address). iconv_add is EXPORTED symbol callable by any loaded KLD module. KLD module (loaded by root) with 40-char charset name creates cspair. Any subsequent read of kern.iconv.cslist (world-readable CTLFLAG_RD line 378) by ANY user copies 40 bytes into 31-byte stack buffer kernel stack overflow controlled by cspair name content. Currently latent all in-tree callers pass short compile-time constants (iconv_ucs.c ENCODING_UNICODE UTF-16BE ENCODING_UTF8 UTF-8). API contract unsafe any future/out-of-tree caller passing mount-option-derived string without own length check activates overflow.