I2CRDWR ioctl leaks usrbufs array on copyin failure (kernel memory exhaustion DoS)

Summary

In I2CRDWR handler usrbufs allocated at :352 before copyin of msgs array at :353. If copyin fails code breaks to cleanup at :385 which only frees buf - usrbufs never freed. Each failed call leaks sizeof(void*)*nmsgs bytes. Attacker can repeat indefinitely to exhaust kernel memory. For nmsgs=100000: each call allocates ~1.6MB buf + ~800KB usrbufs copyin fails buf freed but usrbufs (~800KB) leaked. After ~1000 iterations ~800MB leaked.