Latent negative-length bcopy in fwohci_arcv split-header reassembly can cause kernel panic

Summary

In fwohci_arcv split-header reassembly path rlen recomputed as sizeof(pktbuf)-old_rlen. If old_rlen exceeds sizeof(pktbuf)=16 new rlen goes negative. Code detects with if(rlen<0) kprintf but does NOT skip subsequent bcopy which receives negative int implicitly converted to huge size_t causing massive kernel memory write and panic. Developer comment this must be too long but harmless and why rlen<0 diagnostic show awareness without understanding consequence. Currently unreachable due to buf_offset overwrite guard at line 2871 but latent landmine if control flow changes.