FD_FORM formats with unbounded attacker nsecs over-reading fd_formb heap buffer via DMA/PIO

Summary

FD_FORM/FD_FORMAT path derives transfer byte count as sizeof(struct fd_idfield_data)*finfo->fd_formb_nsecs without clamping nsecs to FD_MAX_NSEC(36). Valid idfield region only 36*4=144 bytes past format header but nsecs is u_char verbatim from caller so DMA/PIO transfer can be sized up to 1020 bytes from 164-byte heap object. fdstate isa_dmastart/isa_dmabp uses bp->b_data+fd->skip format?bp->b_bcount:fdblk. PCMCIA FDC_NODMA fdcpio write branch bus_space_write_multi_1 reads ENTIRE count unconditionally. nsecs=255 reads 876 bytes past end. Contents written onto floppy as sector-ID data root reads back to recover kernel heap info disclosure. Requires root FD_FORM FWRITE. Full leak on YE Data PCMCIA FDC_NODMA.