amdsmb_bread uses unbounded hardware byte-count for register indexing and out-param

Summary

amdsmb_bread reads block byte-count directly from controller SMB_BCNT register into len with no validation. Non-compliant/malicious SMBus slave can return up to 255 causing loop to issue bus_read_1() at offsets SMB_DATA+i (0x04..0x102) far beyond 32-entry data register file (0x04..0x23). *count=len reports hardware length back to caller breaking contract. Buf write guarded by i<*count so buf not overwritten OOB but *count reports unbounded len so caller trusting *count reads uninitialized buffer. /dev/smbN 0600 root:wheel. Impact: out-of-range I/O register reads + inconsistent out-param.