Unchecked info_len in crom_init_context enables OOB heap reads up to ~1000 bytes past csrrom[] buffer

Summary

crom_init_context does not validate hdr->info_len keeps root-directory pointer within 1024-byte csrrom[] buffer. CROM_END computed as root_dir+1003 (assuming info_len==4). For any info_len>4 the bound extends up to ~999 bytes past buffer end neutralizing every subsequent bounds check. For info_len=254: root dir starts at csrrom+1020 CROM_END=csrrom+2023 - 999 bytes past 1024-byte buffer. Every entry read by crom_get via crom_search_key at csrrom[256+] fully OOB and check at line 131 passes because CROM_END itself is OOB. Leaked data includes adjacent fw_device fields and neighboring kernel heap. Values flow into reg->key/reg->val used for pointer arithmetic. Can reach userland via crom_parse_text writing to sdev->vendor/sdev->product exposed through SCSI INQUIRY.