convchar==1 path converts one byte without checking inbytesleft/outbytesleft > 0: 1-byte OOB read/write

Summary

When called in single-character mode (convchar==1 via iconv_convchr/iconv_convchr_case iconv.c:290-301) iconv_xlat_conv unconditionally sets r=n=1 (iconv_xlat.c:92-93) without verifying at least one input byte and one output byte available. Subsequent loop (iconv_xlat.c:98-99) reads *src and writes *dst exactly once regardless. If *inbytesleft==0 reads one byte past source buffer. If *outbytesleft==0 writes one byte (value dp->d_table[oob_index] attacker-influenced via table contents) past destination buffer. Sibling iconv_xlat16_conv correctly bounds loop with while(ir>0&&or>0). Only in-tree convchr caller msdosfs dispatches to xlat16 not xlat. iconv_ucs calls convchr_case on _wctype handles normally xlat16. smbfs primary xlat consumer uses conv/convstr/convmem never convchr. Today effectively dead for xlat becomes live if future code calls iconv_convchr on xlat handle with empty buffer natural off-by-one in byte-at-a-time loop. 1-byte kernel heap write of table-derived value usable corruption primitive for slab grooming. [VERIFIED pass2: value-attributed - empty inbytesleft emits table Z 0x5c read past empty buffer, empty outbytesleft writes dst 0x51 to 0x41; dead path today, future 1-byte table-controlled heap write; empty-side guard fix-validated]