fw_read copies iso stream packet by attacker-controlled stream.len without bounding to psize (DMA buffer over-read)

Summary

In fw_read bulk-iso path uiomove size is fp->mode.stream.len + sizeof(u_int32_t) where stream.len taken directly from received packet header with no upper bound. Packet slot returned by fwdma_v_addr is only ir->psize bytes. Malicious FireWire peer transmitting iso stream packet with stream.len larger than psize-4 causes kernel to copy adjacent DMA-buffer bytes into userspace. For psize=512 and stream.len=1500 over-reads 988 bytes past packet slot.