FW_ASYREQ send-path bcopy over-reads ioctl heap buffer when req.len exceeds data[] capacity

Summary

In FW_ASYREQ send path pay_len=MAX(0 req.len-hdr_len) bounded only by 16-bit req.len field never by sizeof(asyreq->data). bcopy reads pay_len bytes from &asyreq->data[0] (2048 bytes) so any req.len>2064 causes kernel heap over-read into adjacent M_IOCTLOPS object. On typical S400 hardware MAXREC(fc->maxrec)=512 causes fw_asyreq to reject xfer before transmission so over-read data stays in xfer->send.payload and freed - but bcopy has already executed. On faster controllers or large maxrec leaked heap can be transmitted to FireWire peer.