I2CRDWR: unchecked copyin return value sends uninitialized kernel heap to I2C device

Summary

In I2CRDWR message loop copyin(usrbufs[i] m->buf m->len) at :362 does not check return value. If copyin fails (invalid user buffer) m->buf contains uninitialized heap data (kmalloc without M_ZERO) subsequently sent to I2C peripheral via iicbus_transfer. Similarly copyout at :369 unchecked. Attacker crafts write message with invalid buf pointer copyin silently fails uninitialized kernel heap written to EEPROM then read back for indirect info leak.