I2CREAD ioctl leaks uninitialized kernel heap memory to userspace

Summary

I2CREAD allocates kernel buffer with kmalloc(M_WAITOK not zeroed) calls iicbus_read() which may read fewer bytes than requested returning actual count via &count but copyout() copies s->count bytes (requested) instead of count (actual). Uninitialized kernel heap data from tail of buffer copied to userspace leaking stale heap contents. Variable count holding actual read length computed at :344 but never used for copyout. Compare iicread() at :275 which correctly uses bufsize for uiomove. Device node 0600 root:wheel.