trm_check_eeprom default-load writes 8-byte u_long into 4-byte field schema 122-byte OOB write of static trm_eepromBuf[] on x86_64 at attach

Summary

trm_check_eeprom EEPROM-default init code written for ILP32 where u_long is 4 bytes. On x86_64 u_long is 8 bytes so each *dpEeprom write 8 bytes instead of 4. First loop (16 iters) writes 128 bytes into NvramTarget[64] overflow 64 bytes. Two single writes add 16 bytes. 12-iteration zeroing loop adds 96 bytes. Total 240 bytes from offset 10 of NVRAM_STRUC(128 bytes) 122-byte overflow into adjacent trm_eepromBuf elements and for last adapter past array into BSS. Data written is constant (0x77 0x07 0x15 zeros) not attacker-controlled. Triggered whenever NVRAM checksum wrong.