Read-before-bounds-check: 1-byte OOB read of source buffer in UCS-2/UTF-16 input parsing

Summary

In iconv_ucs_conv src-code-is-proper-subset-of-ENCODING_UNICODE branch converter unconditionally reads two bytes from source buffer (lines 248-253) before checking ir<inlen at line 267. When caller passes odd inbytesleft (ir==1) trivially produced by truncated UCS-2/UTF-16 string in crafted filesystem image or SMB packet this reads one byte past end of source buffer. Sibling iconv_xlat16 performs same operation safely via ir>1?*(src+1)&0xff:0 (iconv_xlat16.c:135). If OOB byte matches surrogate pattern 0xd8-0xdb AND UCS4+FROM_UTF16 set inlen becomes 4 function also reads src[2] and src[3] up to 3-byte overrun worst case. All overrun paths break with ret=-1 before any output written no info leak. Memory-safety/defense-in-depth defect. Trigger: crafted filesystem image (msdosfs long-name ntfs filename cd9660 Joliet UDF) with UCS-2/UTF-16 string odd length mounted by root with KICONV direct UCS-2LE/UTF-16BE cspair. Also via SMB client smb_copy_iconv processing server-supplied UCS-2 odd length. Practical impact low kernel heap slack rarely faults no data exfiltrated. Under KASAN definite report.