Heap OOB read/write via zero-length segment array from integer overflow in n

Summary

fwdma_malloc_multiseg accepts untrusted int n without validating n>0 or checking caller nchunk*npacket product did not overflow. When product overflows to 0 (e.g. nchunk=65536 npacket=65536 -> 0 mod 2^32) nseg computes to 0 and function allocates struct fwdma_alloc_multi header with zero seg[] entries. Caller stores original non-overflowed nchunk/npacket in fw_xferq and inline accessors fwdma_v_addr/fwdma_bus_addr index am->seg[0] without bounds-checking against am->nseg reading 24 bytes past 32-byte allocation from adjacent slab object and dereferencing result. fw_write path writes user data through OOB-derived pointer (arbitrary kernel write). fw_read path reads kernel memory (info leak). Exploitation requires heap grooming to control adjacent chunk contents.